feat(auth): add REST API routes for login, refresh, and logout

classes/RestAPI.php

@@ -232,6 +232,37 @@ private function loader( $class_name ) {
 	 * @return void
 	 */
 	public function init_routes() {
+		// Auth: login / refresh / logout.
+		register_rest_route(
+			$this->namespace,
+			'/auth/login',
+			array(
+				'methods'             => 'POST',
+				'callback'            => array( RestAuth::class, 'rest_login' ),
+				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+			)
+		);
+
+		register_rest_route(
+			$this->namespace,
+			'/auth/refresh',
+			array(
+				'methods'             => 'POST',
+				'callback'            => array( RestAuth::class, 'rest_refresh' ),
+				'permission_callback' => '__return_true',
+			)
+		);
+
+		register_rest_route(
+			$this->namespace,
+			'/auth/logout',
+			array(
+				'methods'             => 'POST',
+				'callback'            => array( RestAuth::class, 'rest_logout' ),
+				'permission_callback' => '__return_true',
+			)
+		);
+
 		// Courses.
 		register_rest_route(
 			$this->namespace,
@@ -284,7 +315,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_topics' ),
 			)
 		);
 
@@ -305,7 +336,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_by_topic' ),
 			)
 		);
 
@@ -326,7 +357,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_course_content' ),
 			)
 		);
 
@@ -347,7 +378,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_by_topic' ),
 			)
 		);
 
@@ -368,7 +399,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_quiz' ),
 			)
 		);
 
@@ -389,7 +420,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_quiz' ),
 			)
 		);
 
@@ -410,7 +441,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_quiz' ),
 			)
 		);
 
@@ -473,7 +504,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_course_content' ),
 			)
 		);
 	}

restapi/REST_Author.php

@@ -41,36 +41,40 @@ class REST_Author {
 	 * @return mixed
 	 */
 	public function author_detail( WP_REST_Request $request ) {
-		$this->user_id = $request->get_param( 'id' );
+		$this->user_id = absint( $request->get_param( 'id' ) );
 
 		$user_data = get_userdata( $this->user_id );
 
-		// Author object.
-		$author = is_a( $user_data, 'WP_User' ) ? $user_data->data : false;
-
-		if ( $author ) {
-			// Unset user pass & key.
-			unset( $author->user_pass );
-			unset( $author->user_activation_key );
-
-			// Get author course ID.
-			$author->courses = get_user_meta( $this->user_id, '_tutor_instructor_course_id', false );
-
+		if ( ! is_a( $user_data, 'WP_User' ) ) {
 			$response = array(
-				'code'    => 'success',
-				'message' => __( 'Author details retrieved successfully', 'tutor' ),
-				'data'    => $author,
+				'code'    => 'invalid_id',
+				'message' => __( 'Author not found', 'tutor' ),
+				'data'    => array(),
 			);
 
-			return self::send( $response );
+			return static::send( $response );
+		}
+
+		$author = (object) array(
+			'ID'            => $user_data->ID,
+			'display_name'  => $user_data->display_name,
+			'user_nicename' => $user_data->user_nicename,
+			'courses'       => get_user_meta( $this->user_id, '_tutor_instructor_course_id', false ),
+		);
+
+		if ( RestAuth::can_view_user_private_fields( $this->user_id ) ) {
+			$author->user_login      = $user_data->user_login;
+			$author->user_email      = $user_data->user_email;
+			$author->user_registered = $user_data->user_registered;
+			$author->user_url        = $user_data->user_url;
 		}
 
 		$response = array(
-			'code'    => 'invalid_id',
-			'message' => __( 'Author not found', 'tutor' ),
-			'data'    => array(),
+			'code'    => 'success',
+			'message' => __( 'Author details retrieved successfully', 'tutor' ),
+			'data'    => $author,
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 }

restapi/REST_Course.php

@@ -154,12 +154,22 @@ function ( $post ) {
 				$author = get_userdata( $post->post_author );
 
 				if ( $author ) {
-					// Unset user pass & key.
-					unset( $author->data->user_pass );
-					unset( $author->data->user_activation_key );
-				}
+					$author_payload = (object) array(
+						'ID'            => $author->ID,
+						'display_name'  => $author->display_name,
+						'user_nicename' => $author->user_nicename,
+					);
+
+					if ( RestAuth::can_view_user_private_fields( (int) $author->ID ) ) {
+						$author_payload->user_login      = $author->user_login;
+						$author_payload->user_email      = $author->user_email;
+						$author_payload->user_registered = $author->user_registered;
+					}
 
-				is_a( $author, 'WP_User' ) ? $post->post_author = $author->data : new \stdClass();
+					$post->post_author = $author_payload;
+				} else {
+					$post->post_author = new \stdClass();
+				}
 
 				$thumbnail_size      = apply_filters( 'tutor_rest_course_thumbnail_size', 'post-thumbnail' );
 				$post->thumbnail_url = get_the_post_thumbnail_url( $post->ID, $thumbnail_size );
@@ -185,7 +195,7 @@ function ( $post ) {
 				'data'    => $data,
 			);
 
-			return self::send( $response );
+			return static::send( $response );
 		}
 
 		$response = array(
@@ -194,7 +204,7 @@ function ( $post ) {
 			'data'    => array(),
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 
 	/**
@@ -216,15 +226,15 @@ public function course_detail( WP_REST_Request $request ) {
 				'message' => __( 'Course detail retrieved successfully', 'tutor' ),
 				'data'    => $detail,
 			);
-			return self::send( $response );
+			return static::send( $response );
 		}
 		$response = array(
 			'code'    => 'course_detail',
 			'message' => __( 'Detail not found for given ID', 'tutor' ),
 			'data'    => array(),
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 
 	/**
@@ -330,7 +340,7 @@ public function course_contents( WP_REST_Request $request ) {
 				'message' => __( 'Course contents retrieved successfully', 'tutor' ),
 				'data'    => $data,
 			);
-			return self::send( $response );
+			return static::send( $response );
 		}
 
 		$response = array(
@@ -339,6 +349,6 @@ public function course_contents( WP_REST_Request $request ) {
 			'data'    => array(),
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 }

restapi/REST_Quiz.php

@@ -106,7 +106,7 @@ public function get_quiz( WP_REST_Request $request ) {
 				'message' => __( 'Quiz not found for given ID', 'tutor' ),
 				'data'    => array(),
 			);
-			return self::send( $response );
+			return static::send( $response );
 		}
 
 		$quiz->quiz_settings = get_post_meta( $quiz->ID, 'tutor_quiz_option', false );
@@ -133,6 +133,10 @@ public function get_quiz( WP_REST_Request $request ) {
 			$question->question_answers = QuizModel::get_question_answers( $question->question_id, $question->question_type );
 		}
 
+		if ( ! RestAuth::can_reveal_quiz_answers( $quiz_id ) ) {
+			$questions = static::strip_is_correct_from_questions( $questions );
+		}
+
 		$quiz->quiz_questions = $questions;
 
 		$response = array(
@@ -141,7 +145,7 @@ public function get_quiz( WP_REST_Request $request ) {
 			'data'    => $quiz,
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 
 	/**
@@ -188,15 +192,15 @@ public function quiz_with_settings( WP_REST_Request $request ) {
 					'data'    => $data,
 				);
 			}
-			return self::send( $response );
+			return static::send( $response );
 		}
 
 		$response = array(
 			'code'    => 'not_found',
 			'message' => __( 'Quiz not found for given ID', 'tutor' ),
 			'data'    => $data,
 		);
-		return self::send( $response );
+		return static::send( $response );
 	}
 
 	/**
@@ -256,13 +260,17 @@ public function quiz_question_ans( WP_REST_Request $request ) {
 				array_push( $data, $quiz );
 			}
 
+			if ( ! RestAuth::can_reveal_quiz_answers( (int) $this->post_parent ) ) {
+				$data = static::strip_is_correct_from_questions( $data );
+			}
+
 			$response = array(
 				'code'    => 'success',
 				'message' => __( 'Question retrieved successfully', 'tutor' ),
 				'data'    => $data,
 			);
 
-			return self::send( $response );
+			return static::send( $response );
 		}
 
 		$response = array(
@@ -271,7 +279,7 @@ public function quiz_question_ans( WP_REST_Request $request ) {
 			'data'    => array(),
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 
 	/**
@@ -312,8 +320,17 @@ public function quiz_attempt_details( WP_REST_Request $request ) {
 		);
 
 		if ( count( $attempts ) > 0 ) {
+			$user_id      = get_current_user_id();
+			$course_id    = (int) tutor_utils()->get_course_id_by( 'quiz', $quiz_id );
+			$can_view_all = $course_id && tutor_utils()->has_user_course_content_access( $user_id, $course_id );
+
 			// unserialize each attempt info.
 			foreach ( $attempts as $key => $attempt ) {
+				if ( ! $can_view_all && (int) $attempt->user_id !== (int) $user_id ) {
+					unset( $attempts[ $key ] );
+					continue;
+				}
+
 				$attempt->attempt_info = maybe_unserialize( $attempt->attempt_info );
 				// attach attempt ans.
 				$answers = $this->get_quiz_attempt_ans( $quiz_id );
@@ -325,13 +342,15 @@ public function quiz_attempt_details( WP_REST_Request $request ) {
 				}
 			}
 
+			$attempts = array_values( $attempts );
+
 			$response = array(
 				'code'    => 'success',
 				'message' => __( 'Quiz attempts retrieved successfully', 'tutor' ),
 				'data'    => $attempts,
 			);
 
-			return self::send( $response );
+			return static::send( $response );
 		}
 
 		$response = array(
@@ -340,7 +359,7 @@ public function quiz_attempt_details( WP_REST_Request $request ) {
 			'data'    => array(),
 		);
 
-		return self::send( $response );
+		return static::send( $response );
 	}
 
 	/**
@@ -421,4 +440,28 @@ protected function answer_titles_by_id( $id ) {
 
 		return $results;
 	}
+
+	/**
+	 * Strip is_correct from question answer options.
+	 *
+	 * @since 4.0.10
+	 *
+	 * @param array $questions questions with answers.
+	 *
+	 * @return array
+	 */
+	private static function strip_is_correct_from_questions( $questions ) {
+		foreach ( $questions as $question ) {
+			if ( empty( $question->question_answers ) || ! is_array( $question->question_answers ) ) {
+				continue;
+			}
+			foreach ( $question->question_answers as $answer ) {
+				if ( is_object( $answer ) && isset( $answer->is_correct ) ) {
+					unset( $answer->is_correct );
+				}
+			}
+		}
+
+		return $questions;
+	}
 }