Refactoring privacy enforcement hooks to new class

composer.json

@@ -74,6 +74,7 @@
 			"includes/openid-connect-generic-login-form.php",
 			"includes/openid-connect-generic-option-logger.php",
 			"includes/openid-connect-generic-option-settings.php",
+			"includes/openid-connect-generic-privacy.php",
 			"includes/openid-connect-generic-settings-page.php"
 		]
 	},

includes/openid-connect-generic-privacy.php

@@ -0,0 +1,85 @@
+<?php
+/**
+ * Plugin OIDC/oAuth site privacy class.
+ *
+ * @package   OpenID_Connect_Generic
+ * @category  Authentication
+ * @author    Jonathan Daggerhart <[email protected]>
+ * @copyright 2015-2020 daggerhart
+ * @license   http://www.gnu.org/licenses/gpl-2.0.txt GPL-2.0+
+ */
+
+/**
+ * OpenID_Connect_Generic_Privacy class.
+ *
+ * Plugin OIDC/oAuth site privacy class.
+ *
+ * @package  OpenID_Connect_Generic
+ * @category Authentication
+ */
+class OpenID_Connect_Generic_Privacy {
+
+	/**
+	 * The settings object instance.
+	 *
+	 * @var OpenID_Connect_Generic_Option_Settings
+	 */
+	private $settings;
+
+	/**
+	 * Construct an instance of the privacy extension.
+	 *
+	 * @param OpenID_Connect_Generic_Option_Settings $settings A plugin settings object instance.
+	 */
+	public function __construct( OpenID_Connect_Generic_Option_Settings $settings ) {
+		$this->settings = $settings;
+	}
+
+	/**
+	 * Handle site privacy enforcement.
+	 *
+	 * @param \OpenID_Connect_Generic_Option_Settings $settings The plugin settings instance.
+	 *
+	 * @return \OpenID_Connect_Generic_Privacy
+	 */
+	static public function register( OpenID_Connect_Generic_Option_Settings $settings ) {
+		$plugin = new self( $settings );
+		// Privacy hooks.
+		add_action( 'template_redirect', array( $plugin, 'enforce_privacy_redirect' ), 0 );
+		add_filter( 'the_content_feed', array( $plugin, 'enforce_privacy_feeds' ), 999 );
+		add_filter( 'the_excerpt_rss', array( $plugin, 'enforce_privacy_feeds' ), 999 );
+		add_filter( 'comment_text_rss', array( $plugin, 'enforce_privacy_feeds' ), 999 );
+
+		return $plugin;
+	}
+
+	/**
+	 * Check if privacy enforcement is enabled, and redirect users that aren't
+	 * logged in.
+	 *
+	 * @return void
+	 */
+	function enforce_privacy_redirect() {
+		if ( $this->settings->enforce_privacy && ! is_user_logged_in() ) {
+			// The client endpoint relies on the wp admind ajax endpoint.
+			if ( ! defined( 'DOING_AJAX' ) || ! DOING_AJAX || ! isset( $_GET['action'] ) || 'openid-connect-authorize' != $_GET['action'] ) {
+				auth_redirect();
+			}
+		}
+	}
+
+	/**
+	 * Enforce privacy settings for rss feeds.
+	 *
+	 * @param string $content The content.
+	 *
+	 * @return mixed
+	 */
+	function enforce_privacy_feeds( $content ) {
+		if ( $this->settings->enforce_privacy && ! is_user_logged_in() ) {
+			$content = __( 'Private site', 'daggerhart-openid-connect-generic' );
+		}
+		return $content;
+	}
+
+}