render_flash_notice( $config ); ?>
$feed_id && $this->repository->has_verifier( $feed_id ),
'https_ok' => Access_Policy::site_supports_protected_feeds(),
'local_site' => Access_Policy::is_local_site(),
);
( new Edit_Screen() )->render( $config, $feed_id, $post_types, $taxonomies, $meta_keys, $access, $this->builder->site_defaults() );
?>
require_capability();
( new Help_Page() )->render();
}
// Handlers.
/**
* Save handler (admin-post).
*/
public function handle_save(): void {
$this->require_capability();
check_admin_referer( 'feedweaver_save', 'feedweaver_nonce' );
$feed_id = isset( $_POST['feed_id'] ) ? absint( $_POST['feed_id'] ) : 0;
$raw = isset( $_POST['fw'] ) && is_array( $_POST['fw'] ) ? Form_Input::shape( map_deep( wp_unslash( $_POST['fw'] ), 'sanitize_text_field' ) ) : array();
$outcome = $this->process_save( $raw, $feed_id );
if ( $outcome['errors'] ) {
wp_safe_redirect( $this->edit_url( $feed_id ) );
exit;
}
wp_safe_redirect( add_query_arg( 'feedweaver_notice', 'saved', $this->edit_url( $outcome['id'] ) ) );
exit;
}
/**
* Validates and stores a submitted feed. Capability and nonce checks are the caller's job.
*
* On validation failure nothing is stored; the submission is stashed briefly so the
* form can be redisplayed with the user's input.
*
* @param array $raw Unslashed submission (the "fw" array).
* @param int $feed_id Existing feed ID, or 0 for a new feed.
* @return array{id:int,errors:string[]}
*/
public function process_save( array $raw, int $feed_id ): array {
$config = Feed_Config::from_array( $raw );
$existing = $feed_id ? $this->repository->find( $feed_id ) : null;
if ( $feed_id && ! $existing ) {
wp_die( esc_html__( 'That feed does not exist.', 'feedweaver' ), '', array( 'response' => 404 ) );
}
// A submission that does not mention access (an older form, a script) must never
// silently make a protected feed public.
if ( $existing && ! array_key_exists( 'access', $raw ) ) {
$config->access = $existing->access;
}
$errors = $this->builder->validate_for_save( $config );
if ( ! $errors && $this->repository->slug_conflicts( $config->slug, $feed_id ) ) {
$errors[] = __( 'Another feed already uses this URL slug.', 'feedweaver' );
}
if ( ! $errors ) {
$saved = $this->repository->save( $config, $feed_id );
if ( ! is_wp_error( $saved ) ) {
if ( Feed_Config::ACCESS_PROTECTED !== $config->access ) {
// A public feed keeps no token, so a stale one can never come back to life.
$this->repository->clear_verifier( (int) $saved );
}
return array(
'id' => (int) $saved,
'errors' => array(),
);
}
$errors[] = $saved->get_error_message();
}
set_transient(
'feedweaver_form_' . get_current_user_id(),
array(
'data' => $config->to_array(),
'errors' => $errors,
'id' => $feed_id,
),
120
);
return array(
'id' => $feed_id,
'errors' => $errors,
);
}
/**
* Delete handler (admin-post).
*/
public function handle_delete(): void {
$this->require_capability();
$feed_id = isset( $_GET['feed'] ) ? absint( $_GET['feed'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- verified on the next line.
check_admin_referer( 'feedweaver_delete_' . $feed_id );
$this->repository->delete( $feed_id );
wp_safe_redirect( add_query_arg( 'feedweaver_notice', 'deleted', admin_url( 'admin.php?page=' . self::PAGE_LIST ) ) );
exit;
}
/**
* Preview handler (admin-ajax, logged-in users only).
*
* Renders an unsaved configuration with the same builder as public feeds.
*/
public function handle_preview(): void {
check_ajax_referer( 'feedweaver_preview' );
if ( ! current_user_can( self::CAPABILITY ) ) {
wp_send_json_error( array( 'errors' => array( __( 'You are not allowed to preview feeds.', 'feedweaver' ) ) ), 403 );
}
$raw = isset( $_POST['fw'] ) && is_array( $_POST['fw'] ) ? Form_Input::shape( map_deep( wp_unslash( $_POST['fw'] ), 'sanitize_text_field' ) ) : array();
$config = Feed_Config::from_array( $raw );
// Same pipeline as the public feed. Only the first few items are written out, but the
// diagnostics cover every item the feed would contain.
$result = $this->builder->build( $config, false, true, 5 );
if ( ! $result->ok ) {
wp_send_json_success(
array(
'ok' => false,
'errors' => $result->errors,
'error_targets' => Error_Targets::describe( $result->errors ),
)
);
}
wp_send_json_success(
array(
'ok' => true,
'errors' => array(),
'output' => $result->body,
'content_type' => $result->content_type,
'count' => $result->count,
'diagnostics' => Feed_Diagnostics::describe( $result->diagnostics ),
)
);
}
/**
* Custom field discovery (admin-ajax, logged-in administrators only).
*
* Returns key names and labels for the chosen content types; never values.
*/
public function handle_meta_keys(): void {
check_ajax_referer( 'feedweaver_meta_keys' );
$this->require_ajax_capability();
wp_send_json_success( array( 'keys' => $this->discovery->discover_many( $this->requested_post_types( 'feedweaver_meta_keys' ) ) ) );
}
/**
* Taxonomy discovery for the chosen content types (admin-ajax, administrators only).
*/
public function handle_taxonomies(): void {
check_ajax_referer( 'feedweaver_discovery' );
$this->require_ajax_capability();
wp_send_json_success( array( 'taxonomies' => $this->taxonomies->for_post_types( $this->requested_post_types( 'feedweaver_discovery' ) ) ) );
}
/**
* Term search within one taxonomy (admin-ajax, administrators only).
*/
public function handle_terms(): void {
check_ajax_referer( 'feedweaver_discovery' );
$this->require_ajax_capability();
$types = $this->requested_post_types( 'feedweaver_discovery' );
$taxonomy = isset( $_POST['taxonomy'] ) && is_string( $_POST['taxonomy'] ) ? Form_Input::identifier( sanitize_text_field( wp_unslash( $_POST['taxonomy'] ) ) ) : '';
$search = isset( $_POST['search'] ) ? sanitize_text_field( wp_unslash( $_POST['search'] ) ) : '';
if ( ! array_key_exists( $taxonomy, Eligibility::taxonomies_for( $types ) ) ) {
wp_send_json_error( array( 'message' => __( 'Choose a taxonomy used by the selected content types.', 'feedweaver' ) ), 400 );
}
wp_send_json_success( array( 'terms' => $this->taxonomies->terms( $taxonomy, Text_Sanitizer::truncate_bytes( $search, 100 ) ) ) );
}
/**
* Generates or rotates a feed's access token (admin-ajax, administrators only).
*
* The raw token is returned in this one response and is never stored; only its SHA-256
* verifier is. Calling this again replaces the verifier, so the previous token stops
* working immediately. Generating a token also marks the feed as protected, so the
* token is never issued for a feed that is still public.
*/
public function handle_token(): void {
check_ajax_referer( 'feedweaver_token' );
$this->require_ajax_capability();
$feed_id = isset( $_POST['feed_id'] ) ? absint( $_POST['feed_id'] ) : 0;
$config = $feed_id ? $this->repository->find( $feed_id ) : null;
if ( ! $config ) {
wp_send_json_error( array( 'message' => __( 'Save the feed first.', 'feedweaver' ) ), 400 );
}
try {
$token = Token_Service::generate();
} catch ( \Throwable $e ) {
wp_send_json_error( array( 'message' => __( 'The server could not generate a secure token.', 'feedweaver' ) ), 500 );
}
$rotated = $this->repository->has_verifier( $feed_id );
$this->repository->set_verifier( $feed_id, Token_Service::verifier( $token ) );
if ( Feed_Config::ACCESS_PROTECTED !== $config->access ) {
$config->access = Feed_Config::ACCESS_PROTECTED;
$this->repository->save( $config, $feed_id );
}
nocache_headers();
wp_send_json_success(
array(
'token' => $token,
'rotated' => $rotated,
)
);
}
/**
* Formats the current time with a custom date pattern, so the editor can show a live example.
*/
public function handle_date_example(): void {
check_ajax_referer( 'feedweaver_discovery' );
$this->require_ajax_capability();
$pattern = isset( $_POST['pattern'] ) && is_string( $_POST['pattern'] ) ? sanitize_text_field( wp_unslash( $_POST['pattern'] ) ) : '';
$errors = Date_Formatter::pattern_errors( $pattern );
if ( $errors ) {
wp_send_json_success(
array(
'ok' => false,
'message' => $errors[0],
)
);
}
wp_send_json_success(
array(
'ok' => true,
'example' => (string) Date_Formatter::format( time(), Date_Formatter::CUSTOM, $pattern ),
)
);
}
// Helpers.
/**
* Ends an AJAX request unless the user can manage FeedWeaver.
*/
private function require_ajax_capability(): void {
if ( ! current_user_can( self::CAPABILITY ) ) {
wp_send_json_error( array( 'message' => __( 'You are not allowed to do this.', 'feedweaver' ) ), 403 );
}
}
/**
* Eligible post types named in the request (post_types[], or the single post_type of earlier versions).
* Ends the request with 400 when none is eligible.
*
* The nonce is checked here, ahead of reading anything, so this helper is safe on its own.
*
* @param string $nonce_action Nonce action the calling endpoint uses.
* @return string[]
*/
private function requested_post_types( string $nonce_action ): array {
check_ajax_referer( $nonce_action );
$raw = array();
if ( isset( $_POST['post_types'] ) && is_array( $_POST['post_types'] ) ) {
$raw = Form_Input::identifiers( map_deep( wp_unslash( $_POST['post_types'] ), 'sanitize_text_field' ), Feed_Config::MAX_TYPES + 1 );
} elseif ( isset( $_POST['post_type'] ) && is_string( $_POST['post_type'] ) ) {
$raw = array( Form_Input::identifier( sanitize_text_field( wp_unslash( $_POST['post_type'] ) ) ) );
}
$eligible = array_keys( $this->query->eligible_post_types() );
$types = array();
foreach ( $raw as $type ) {
if ( ! is_string( $type ) || ! in_array( $type, $eligible, true ) ) {
wp_send_json_error( array( 'message' => __( 'Choose public content types.', 'feedweaver' ) ), 400 );
}
$types[ $type ] = $type;
}
if ( ! $types ) {
wp_send_json_error( array( 'message' => __( 'Choose at least one content type.', 'feedweaver' ) ), 400 );
}
return array_values( $types );
}
/**
* Aborts unless the user can manage FeedWeaver.
*/
private function require_capability(): void {
if ( ! current_user_can( self::CAPABILITY ) ) {
wp_die( esc_html__( 'You do not have permission to manage feeds.', 'feedweaver' ), '', array( 'response' => 403 ) );
}
}
/**
* Edit screen URL.
*
* @param int $feed_id Feed ID or 0.
* @return string
*/
private function edit_url( int $feed_id ): string {
$url = admin_url( 'admin.php?page=' . self::PAGE_EDIT );
return $feed_id ? add_query_arg( 'feed', $feed_id, $url ) : $url;
}
/**
* Shows a one-off confirmation notice.
*
* @param Feed_Config|null $config Feed being displayed, if any.
*/
private function render_flash_notice( $config = null ): void {
$notice = isset( $_GET['feedweaver_notice'] ) ? sanitize_key( wp_unslash( $_GET['feedweaver_notice'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
$map = array(
'saved' => __( 'Feed saved.', 'feedweaver' ),
'deleted' => __( 'Feed deleted.', 'feedweaver' ),
);
if ( isset( $map[ $notice ] ) ) {
echo '' . esc_html__( 'This feed is saved but disabled, so its public URL does not work yet. Tick "Enabled" and save again to publish it.', 'feedweaver' ) . '