<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* FraudProtectionController class file.

[2] Fix | Delete

*/

[3] Fix | Delete

[4] Fix | Delete

declare( strict_types=1 );

[5] Fix | Delete

[6] Fix | Delete

namespace Automattic\WooCommerce\Internal\FraudProtection;

[7] Fix | Delete

[8] Fix | Delete

use Automattic\WooCommerce\Internal\Features\FeaturesController;

[9] Fix | Delete

use Automattic\WooCommerce\Internal\Jetpack\JetpackConnection;

[10] Fix | Delete

use Automattic\WooCommerce\Internal\RegisterHooksInterface;

[11] Fix | Delete

[12] Fix | Delete

defined( 'ABSPATH' ) || exit;

[13] Fix | Delete

[14] Fix | Delete

/**

[15] Fix | Delete

* Main controller for fraud protection features.

[16] Fix | Delete

*

[17] Fix | Delete

* This class orchestrates all fraud protection components and ensures

[18] Fix | Delete

* zero-impact when the feature flag is disabled.

[19] Fix | Delete

*

[20] Fix | Delete

* @since 10.5.0

[21] Fix | Delete

* @internal This class is part of the internal API and is subject to change without notice.

[22] Fix | Delete

*/

[23] Fix | Delete

class FraudProtectionController implements RegisterHooksInterface {

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Features controller instance.

[27] Fix | Delete

*

[28] Fix | Delete

* @var FeaturesController

[29] Fix | Delete

*/

[30] Fix | Delete

private FeaturesController $features_controller;

[31] Fix | Delete

[32] Fix | Delete

/**

[33] Fix | Delete

* Blocked session notice instance.

[34] Fix | Delete

*

[35] Fix | Delete

* @var BlockedSessionNotice

[36] Fix | Delete

*/

[37] Fix | Delete

private BlockedSessionNotice $blocked_session_notice;

[38] Fix | Delete

[39] Fix | Delete

/**

[40] Fix | Delete

* Blackbox script handler instance.

[41] Fix | Delete

*

[42] Fix | Delete

* @var BlackboxScriptHandler

[43] Fix | Delete

*/

[44] Fix | Delete

private BlackboxScriptHandler $blackbox_script_handler;

[45] Fix | Delete

[46] Fix | Delete

/**

[47] Fix | Delete

* Register hooks.

[48] Fix | Delete

*/

[49] Fix | Delete

public function register(): void {

[50] Fix | Delete

add_action( 'init', array( $this, 'on_init' ) );

[51] Fix | Delete

add_action( 'admin_notices', array( $this, 'on_admin_notices' ) );

[52] Fix | Delete

add_action( FeaturesController::FEATURE_ENABLED_CHANGED_ACTION, array( $this, 'maybe_register_jetpack_connection' ), 10, 2 );

[53] Fix | Delete

}

[54] Fix | Delete

[55] Fix | Delete

/**

[56] Fix | Delete

* Initialize the instance, runs when the instance is created by the dependency injection container.

[57] Fix | Delete

*

[58] Fix | Delete

* @internal

[59] Fix | Delete

*

[60] Fix | Delete

* @param FeaturesController $features_controller The instance of FeaturesController to use.

[61] Fix | Delete

* @param BlockedSessionNotice $blocked_session_notice The instance of BlockedSessionNotice to use.

[62] Fix | Delete

* @param BlackboxScriptHandler $blackbox_script_handler The instance of BlackboxScriptHandler to use.

[63] Fix | Delete

*/

[64] Fix | Delete

final public function init(

[65] Fix | Delete

FeaturesController $features_controller,

[66] Fix | Delete

BlockedSessionNotice $blocked_session_notice,

[67] Fix | Delete

BlackboxScriptHandler $blackbox_script_handler

[68] Fix | Delete

): void {

[69] Fix | Delete

$this->features_controller = $features_controller;

[70] Fix | Delete

$this->blocked_session_notice = $blocked_session_notice;

[71] Fix | Delete

$this->blackbox_script_handler = $blackbox_script_handler;

[72] Fix | Delete

}

[73] Fix | Delete

[74] Fix | Delete

/**

[75] Fix | Delete

* Hook into WordPress on init.

[76] Fix | Delete

*

[77] Fix | Delete

* @internal

[78] Fix | Delete

*/

[79] Fix | Delete

public function on_init(): void {

[80] Fix | Delete

// Bail if the feature is not enabled.

[81] Fix | Delete

if ( ! $this->feature_is_enabled() ) {

[82] Fix | Delete

return;

[83] Fix | Delete

}

[84] Fix | Delete

[85] Fix | Delete

$this->blocked_session_notice->register();

[86] Fix | Delete

$this->blackbox_script_handler->register();

[87] Fix | Delete

}

[88] Fix | Delete

[89] Fix | Delete

/**

[90] Fix | Delete

* Display admin notice when Jetpack connection is not available.

[91] Fix | Delete

*

[92] Fix | Delete

* @internal

[93] Fix | Delete

*/

[94] Fix | Delete

public function on_admin_notices(): void {

[95] Fix | Delete

// Only show if feature is enabled.

[96] Fix | Delete

if ( ! $this->feature_is_enabled() || JetpackConnection::get_manager()->is_connected() ) {

[97] Fix | Delete

return;

[98] Fix | Delete

}

[99] Fix | Delete

[100] Fix | Delete

// Only show on WooCommerce settings page.

[101] Fix | Delete

$screen = get_current_screen();

[102] Fix | Delete

[103] Fix | Delete

if ( ! $screen || 'woocommerce_page_wc-settings' !== $screen->id ) {

[104] Fix | Delete

return;

[105] Fix | Delete

}

[106] Fix | Delete

[107] Fix | Delete

?>

[108] Fix | Delete

<div class="notice notice-warning is-dismissible">

[109] Fix | Delete

<p>

[110] Fix | Delete

<?php

[111] Fix | Delete

printf(

[112] Fix | Delete

/* translators: %s: Getting Started with Jetpack documentation URL */

[113] Fix | Delete

wp_kses_post( __( 'Your site failed to connect to Jetpack automatically. Fraud protection will fail open and allow all sessions until your site is connected to Jetpack. <a href="%s">How to connect to Jetpack</a>', 'woocommerce' ) ),

[114] Fix | Delete

esc_url( 'https://jetpack.com/support/getting-started-with-jetpack/' )

[115] Fix | Delete

);

[116] Fix | Delete

?>

[117] Fix | Delete

</p>

[118] Fix | Delete

</div>

[119] Fix | Delete

<?php

[120] Fix | Delete

}

[121] Fix | Delete

[122] Fix | Delete

/**

[123] Fix | Delete

* Maybe register Jetpack connection when fraud protection is enabled.

[124] Fix | Delete

*

[125] Fix | Delete

* Attempts to automatically register the site with Jetpack when the fraud protection

[126] Fix | Delete

* feature is enabled and the site is not already connected.

[127] Fix | Delete

*

[128] Fix | Delete

* @since 10.5.0

[129] Fix | Delete

*

[130] Fix | Delete

* @internal

[131] Fix | Delete

*

[132] Fix | Delete

* @param string $feature_id The feature ID being toggled.

[133] Fix | Delete

* @param bool $is_enabled Whether the feature is being enabled or disabled.

[134] Fix | Delete

*/

[135] Fix | Delete

public function maybe_register_jetpack_connection( string $feature_id, bool $is_enabled ): void {

[136] Fix | Delete

if ( 'fraud_protection' !== $feature_id || ! $is_enabled ) {

[137] Fix | Delete

return;

[138] Fix | Delete

}

[139] Fix | Delete

[140] Fix | Delete

$manager = JetpackConnection::get_manager();

[141] Fix | Delete

[142] Fix | Delete

if ( $manager->is_connected() ) {

[143] Fix | Delete

return;

[144] Fix | Delete

}

[145] Fix | Delete

[146] Fix | Delete

$result = $manager->try_registration();

[147] Fix | Delete

[148] Fix | Delete

if ( is_wp_error( $result ) ) {

[149] Fix | Delete

$this->log( 'error', 'Failed to register Jetpack connection: ' . $result->get_error_message() );

[150] Fix | Delete

return;

[151] Fix | Delete

}

[152] Fix | Delete

[153] Fix | Delete

$this->log( 'info', 'Jetpack connection registered successfully' );

[154] Fix | Delete

}

[155] Fix | Delete

[156] Fix | Delete

/**

[157] Fix | Delete

* Check if fraud protection feature is enabled.

[158] Fix | Delete

*

[159] Fix | Delete

* This method can be used by other fraud protection classes to check

[160] Fix | Delete

* the feature flag status. Returns false (fail-open) if init hasn't run yet.

[161] Fix | Delete

*

[162] Fix | Delete

* @return bool True if enabled, false if not enabled or init hasn't run yet.

[163] Fix | Delete

*/

[164] Fix | Delete

public function feature_is_enabled(): bool {

[165] Fix | Delete

// Fail-open: don't block if init hasn't run yet to avoid FeaturesController translation notices.

[166] Fix | Delete

if ( ! did_action( 'init' ) ) {

[167] Fix | Delete

return false;

[168] Fix | Delete

}

[169] Fix | Delete

return $this->features_controller->feature_is_enabled( 'fraud_protection' );

[170] Fix | Delete

}

[171] Fix | Delete

[172] Fix | Delete

/**

[173] Fix | Delete

* Log helper method for consistent logging across all fraud protection components.

[174] Fix | Delete

*

[175] Fix | Delete

* This static method ensures all fraud protection logs are written with

[176] Fix | Delete

* the same 'woo-fraud-protection' source for easy filtering in WooCommerce logs.

[177] Fix | Delete

*

[178] Fix | Delete

* @param string $level Log level (emergency, alert, critical, error, warning, notice, info, debug).

[179] Fix | Delete

* @param string $message Log message.

[180] Fix | Delete

* @param array $context Optional context data.

[181] Fix | Delete

*

[182] Fix | Delete

* @return void

[183] Fix | Delete

*/

[184] Fix | Delete

public static function log( string $level, string $message, array $context = array() ): void {

[185] Fix | Delete

wc_get_logger()->log(

[186] Fix | Delete

$level,

[187] Fix | Delete

$message,

[188] Fix | Delete

array_merge( $context, array( 'source' => 'woo-fraud-protection' ) )

[189] Fix | Delete

);

[190] Fix | Delete

}

[191] Fix | Delete

}

[192] Fix | Delete

[193] Fix | Delete