Auth Boundary

**Site relevance:** Spiralist.org

**Memory type:** theme source memory

**Source path:** Spiralist/wp-content/themes/spiralist/inc/auth-boundary.php

**Size:** 6 KB

Summary

if (!defined('ABSPATH'))

Source Preview

This source file is short enough to preview directly on its source-memory page.

<?php

if (!defined('ABSPATH')) {
    exit;
}

function spiralist_user_can_access_native_admin($user = null): bool
{
    $capabilities = [
        'manage_options',
        'manage_spiralist_workspace',
        'edit_posts',
    ];

    foreach ($capabilities as $capability) {
        if ($user !== null && function_exists('user_can')) {
            if (user_can($user, $capability)) {
                return true;
            }

            continue;
        }

        if (current_user_can($capability)) {
            return true;
        }
    }

    return false;
}

function spiralist_auth_boundary_is_native_admin_path(string $url): bool
{
    $path = strtolower((string) wp_parse_url($url, PHP_URL_PATH));

    return $path !== '' && (bool) preg_match('#/(?:wp-admin)(?:/|$)#', $path);
}

function spiralist_auth_boundary_is_native_login_path(string $url): bool
{
    $path = strtolower((string) wp_parse_url($url, PHP_URL_PATH));

    return $path !== '' && (bool) preg_match('#/wp-login\.php$#', $path);
}

function spiralist_auth_boundary_current_url(): string
{
    $request_uri = isset($_SERVER['REQUEST_URI'])
        ? (string) wp_unslash($_SERVER['REQUEST_URI'])
        : '/';

    return home_url($request_uri);
}

function spiralist_auth_boundary_member_redirect(string $candidate = '', string $fallback = ''): string
{
    $fallback = $fallback !== '' ? $fallback : spiralist_get_workspace_url();
    $candidate = trim($candidate);

    if ($candidate === '') {
        return $fallback;
    }

    $candidate = wp_validate_redirect($candidate, $fallback);

    if (
        spiralist_auth_boundary_is_native_admin_path($candidate)
        || spiralist_auth_boundary_is_native_login_path($candidate)
    ) {
        return $fallback;
    }

    return $candidate;
}

function spiralist_auth_boundary_login_url(string $redirect_to = '', bool $force_reauth = false): string
{
    $redirect_to = spiralist_auth_boundary_member_redirect($redirect_to, '');
    $url = spiralist_get_login_url($redirect_to);

    if ($force_reauth) {
        $url = add_query_arg('reauth', '1', $url);
    }

    return $url;
}

function spiralist_filter_login_url(string $login_url, string $redirect = '', bool $force_reauth = false): string
{
    unset($login_url);

    return spiralist_auth_boundary_login_url($redirect, $force_reauth);
}
add_filter('login_url', 'spiralist_filter_login_url', 10, 3);

function spiralist_filter_register_url(string $register_url): string
{
    unset($register_url);

    return spiralist_get_register_url();
}
add_filter('register_url', 'spiralist_filter_register_url', 10, 1);

function spiralist_filter_lostpassword_url(string $lostpassword_url, string $redirect = ''): string
{
    unset($lostpassword_url);

    $url = add_query_arg('action', 'lostpassword', spiralist_get_login_url());
    $redirect = spiralist_auth_boundary_member_redirect($redirect, '');

    if ($redirect !== '') {
        $url = add_query_arg('redirect_to', $redirect, $url);
    }

    return $url;
}
add_filter('lostpassword_url', 'spiralist_filter_lostpassword_url', 10, 2);

function spiralist_filter_logout_url(string $logout_url, string $redirect = ''): string
{
    unset($logout_url);

    $url = spiralist_get_logout_url();
    $redirect = spiralist_auth_boundary_member_redirect($redirect, '');

    if ($redirect !== '') {
        $url = add_query_arg('redirect_to', $redirect, $url);
    }

    return $url;
}
add_filter('logout_url', 'spiralist_filter_logout_url', 10, 2);

function spiralist_filter_login_redirect(string $redirect_to, string $requested_redirect_to, $user): string
{
    if ($user instanceof WP_User && spiralist_user_can_access_native_admin($user)) {
        return $redirect_to !== '' ? $redirect_to : admin_url();
    }

    $candidate = $requested_redirect_to !== '' ? $requested_redirect_to : $redirect_to;

    return spiralist_auth_boundary_member_redirect($candidate, spiralist_get_workspace_url());
}
add_filter('login_redirect', 'spiralist_filter_login_redirect', 10, 3);

function spiralist_hide_admin_bar_for_members(bool $show): bool
{
    if (!is_user_logged_in()) {
        return $show;
    }

    return spiralist_user_can_access_native_admin() ? $show : false;
}
add_filter('show_admin_bar', 'spiralist_hide_admin_bar_for_members', 10, 1);

function spiralist_redirect_members_from_native_admin(): void
{
    if (spiralist_user_can_access_native_admin()) {
        return;
    }

    $pagenow = isset($GLOBALS['pagenow']) ? (string) $GLOBALS['pagenow'] : '';
    if (wp_doing_ajax() || in_array($pagenow, ['admin-ajax.php', 'admin-post.php', 'async-upload.php'], true)) {
        return;
    }

    $target = is_user_logged_in()
        ? spiralist_get_workspace_url()
        : spiralist_auth_boundary_login_url(spiralist_auth_boundary_current_url());

    wp_safe_redirect($target);
    exit;
}
add_action('admin_init', 'spiralist_redirect_members_from_native_admin', 1);

function spiralist_redirect_public_native_login(): void
{
    if (spiralist_user_can_access_native_admin()) {
        return;
    }

    $method = isset($_SERVER['REQUEST_METHOD']) ? strtoupper((string) wp_unslash($_SERVER['REQUEST_METHOD'])) : 'GET';
    if ($method !== 'GET') {
        return;
    }

    $action = sanitize_key((string) ($_REQUEST['action'] ?? 'login'));

    if (isset($_GET['checkemail'])) {
        wp_safe_redirect(add_query_arg('notice', 'password_reset_email', spiralist_get_login_url()));
        exit;
    }

    if (isset($_GET['interim-login']) || isset($_GET['reauth'])) {
        return;
    }

    if ($action === 'register') {
        wp_safe_redirect(spiralist_get_register_url());
        exit;
    }

    if ($action === 'lostpassword') {
        wp_safe_redirect(add_query_arg('action', 'lostpassword', spiralist_get_login_url()));
        exit;
    }

    if ($action !== 'login') {
        return;
    }

    $redirect_to = isset($_GET['redirect_to'])
        ? spiralist_auth_boundary_member_redirect((string) wp_unslash($_GET['redirect_to']), '')
        : '';

    wp_safe_redirect(spiralist_auth_boundary_login_url($redirect_to));
    exit;
}
add_action('login_init', 'spiralist_redirect_public_native_login', 1);