feat(auth): add REST API routes for login, refresh, and logout

assets/src/js/admin-dashboard/segments/manage-api-keys.js

@@ -10,15 +10,46 @@ document.addEventListener("DOMContentLoaded", async function() {
     const submitBtn = document.querySelector("#tutor-generate-api-keys button[type=submit]");
     const modal = document.getElementById("tutor-add-new-api-keys");
     const noRecordElem = document.getElementById("tutor-api-keys-no-record");
+    const tokenSettingsForm = document.getElementById("tutor-rest-api-token-settings");
+    const tokenSettingsSubmitBtn = document.querySelector("#tutor-rest-api-token-settings button[type=submit]");
 
     const updatePermissionForm = document.querySelector("#tutor-update-permission-form");
     const updateSubmitBtn = document.querySelector("#tutor-update-permission-modal button[type=submit]");
     const updatePermissionModal = document.querySelector("#tutor-update-permission-modal");
 
-    if (!keysListWrapper) {
+    if (!keysListWrapper && !tokenSettingsForm) {
         return;
     }
 
+    // Save token lifetime settings
+    if (tokenSettingsForm) {
+        tokenSettingsForm.onsubmit = async (e) => {
+            e.preventDefault();
+
+            const formData = new FormData(tokenSettingsForm);
+
+            try {
+                tokenSettingsSubmitBtn.classList.add("is-loading");
+                tokenSettingsSubmitBtn.setAttribute("disabled", true);
+
+                const post = await ajaxHandler(formData);
+                const res = await post.json();
+                const { success, data } = res;
+
+                if (success) {
+                    tutor_toast(__("Success", "tutor"), data, "success");
+                } else {
+                    tutor_toast(__("Failed", "tutor"), data, "error");
+                }
+            } catch (error) {
+                tutor_toast(__("Failed", "tutor"), defaultErrMsg, "error");
+            } finally {
+                tokenSettingsSubmitBtn.classList.remove("is-loading");
+                tokenSettingsSubmitBtn.removeAttribute("disabled");
+            }
+        };
+    }
+
     // Add API keys
     if (apiKeysForm) {
         apiKeysForm.onsubmit = async (e) => {

assets/src/scss/admin-dashboard/v2/components/_form-elements.scss

@@ -20,6 +20,14 @@
 			min-width: 90px;
 			height: 40px;
 		}
+
+		&.tutor-w-160 {
+			padding: 0px 5px;
+			text-align: center;
+			max-width: 160px;
+			min-width: 160px;
+			height: 40px;
+		}
 	}
 
 	textarea.tutor-form-control {

classes/RestAPI.php

@@ -232,6 +232,37 @@ private function loader( $class_name ) {
 	 * @return void
 	 */
 	public function init_routes() {
+		// Auth: login / refresh / logout.
+		register_rest_route(
+			$this->namespace,
+			'/auth/login',
+			array(
+				'methods'             => 'POST',
+				'callback'            => array( RestAuth::class, 'rest_login' ),
+				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+			)
+		);
+
+		register_rest_route(
+			$this->namespace,
+			'/auth/refresh',
+			array(
+				'methods'             => 'POST',
+				'callback'            => array( RestAuth::class, 'rest_refresh' ),
+				'permission_callback' => '__return_true',
+			)
+		);
+
+		register_rest_route(
+			$this->namespace,
+			'/auth/logout',
+			array(
+				'methods'             => 'POST',
+				'callback'            => array( RestAuth::class, 'rest_logout' ),
+				'permission_callback' => '__return_true',
+			)
+		);
+
 		// Courses.
 		register_rest_route(
 			$this->namespace,
@@ -284,7 +315,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_topics' ),
 			)
 		);
 
@@ -305,7 +336,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_by_topic' ),
 			)
 		);
 
@@ -326,7 +357,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_course_content' ),
 			)
 		);
 
@@ -347,7 +378,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_by_topic' ),
 			)
 		);
 
@@ -368,7 +399,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_quiz' ),
 			)
 		);
 
@@ -389,7 +420,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_quiz' ),
 			)
 		);
 
@@ -410,7 +441,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_quiz' ),
 			)
 		);
 
@@ -473,7 +504,7 @@ public function init_routes() {
 						},
 					),
 				),
-				'permission_callback' => array( RestAuth::class, 'process_api_request' ),
+				'permission_callback' => array( RestAuth::class, 'permission_course_content' ),
 			)
 		);
 	}

restapi/REST_Author.php

@@ -41,34 +41,38 @@ class REST_Author {
 	 * @return mixed
 	 */
 	public function author_detail( WP_REST_Request $request ) {
-		$this->user_id = $request->get_param( 'id' );
+		$this->user_id = absint( $request->get_param( 'id' ) );
 
 		$user_data = get_userdata( $this->user_id );
 
-		// Author object.
-		$author = is_a( $user_data, 'WP_User' ) ? $user_data->data : false;
-
-		if ( $author ) {
-			// Unset user pass & key.
-			unset( $author->user_pass );
-			unset( $author->user_activation_key );
-
-			// Get author course ID.
-			$author->courses = get_user_meta( $this->user_id, '_tutor_instructor_course_id', false );
-
+		if ( ! is_a( $user_data, 'WP_User' ) ) {
 			$response = array(
-				'code'    => 'success',
-				'message' => __( 'Author details retrieved successfully', 'tutor' ),
-				'data'    => $author,
+				'code'    => 'invalid_id',
+				'message' => __( 'Author not found', 'tutor' ),
+				'data'    => array(),
 			);
 
 			return self::send( $response );
 		}
 
+		$author = (object) array(
+			'ID'            => $user_data->ID,
+			'display_name'  => $user_data->display_name,
+			'user_nicename' => $user_data->user_nicename,
+			'courses'       => get_user_meta( $this->user_id, '_tutor_instructor_course_id', false ),
+		);
+
+		if ( RestAuth::can_view_user_private_fields( $this->user_id ) ) {
+			$author->user_login      = $user_data->user_login;
+			$author->user_email      = $user_data->user_email;
+			$author->user_registered = $user_data->user_registered;
+			$author->user_url        = $user_data->user_url;
+		}
+
 		$response = array(
-			'code'    => 'invalid_id',
-			'message' => __( 'Author not found', 'tutor' ),
-			'data'    => array(),
+			'code'    => 'success',
+			'message' => __( 'Author details retrieved successfully', 'tutor' ),
+			'data'    => $author,
 		);
 
 		return self::send( $response );

restapi/REST_Course.php

@@ -10,8 +10,10 @@
 
 namespace TUTOR;
 
-use WP_REST_Request;
 use WP_Query;
+use WP_REST_Request;
+use WP_REST_Response;
+use WP_Post;
 
 if ( ! defined( 'ABSPATH' ) ) {
 	exit;
@@ -132,51 +134,60 @@ public function course( WP_REST_Request $request ) {
 
 		// if post found.
 		if ( count( $query->posts ) > 0 ) {
-			// unset filter property.
-			array_map(
-				function ( $post ) {
-					unset( $post->filter );
-				},
-				$query->posts
-			);
-
 			$data = array(
 				'posts'        => array(),
 				'total_course' => $query->found_posts,
 				'total_page'   => $query->max_num_pages,
 			);
 
 			foreach ( $query->posts as $post ) {
+				if ( ! $post instanceof WP_Post ) {
+					continue;
+				}
+
+				$item = (object) $post->to_array();
+				unset( $item->filter );
+
 				$category = wp_get_post_terms( $post->ID, $this->course_cat_tax );
 
 				$tag = wp_get_post_terms( $post->ID, $this->course_tag_tax );
 
 				$author = get_userdata( $post->post_author );
 
 				if ( $author ) {
-					// Unset user pass & key.
-					unset( $author->data->user_pass );
-					unset( $author->data->user_activation_key );
-				}
+					$author_payload = (object) array(
+						'ID'            => $author->ID,
+						'display_name'  => $author->display_name,
+						'user_nicename' => $author->user_nicename,
+					);
+
+					if ( RestAuth::can_view_user_private_fields( (int) $author->ID ) ) {
+						$author_payload->user_login      = $author->user_login;
+						$author_payload->user_email      = $author->user_email;
+						$author_payload->user_registered = $author->user_registered;
+					}
 
-				is_a( $author, 'WP_User' ) ? $post->post_author = $author->data : new \stdClass();
+					$item->post_author = $author_payload;
+				} else {
+					$item->post_author = new \stdClass();
+				}
 
 				$thumbnail_size      = apply_filters( 'tutor_rest_course_thumbnail_size', 'post-thumbnail' );
-				$post->thumbnail_url = get_the_post_thumbnail_url( $post->ID, $thumbnail_size );
+				$item->thumbnail_url = get_the_post_thumbnail_url( $post->ID, $thumbnail_size );
 
-				$post->additional_info = $this->course_additional_info( $post->ID );
+				$item->additional_info = $this->course_additional_info( $post->ID );
 
-				$post->ratings = tutor_utils()->get_course_rating( $post->ID );
+				$item->ratings = tutor_utils()->get_course_rating( $post->ID );
 
-				$post->course_category = $category;
+				$item->course_category = $category;
 
-				$post->course_tag = $tag;
+				$item->course_tag = $tag;
 
-				$post->price = get_post_meta( $post->ID, '_regular_price', true );
+				$item->price = get_post_meta( $post->ID, '_regular_price', true );
 
-				$post = apply_filters( 'tutor_rest_course_single_post', $post );
+				$item = apply_filters( 'tutor_rest_course_single_post', $item );
 
-				array_push( $data['posts'], $post );
+				array_push( $data['posts'], $item );
 			}
 
 			$response = array(