Harden REST auth and adapter handling

Require authentication for all Microsub requests, tighten scope fallback by checking a configurable capability, and propagate WP_Error responses instead of treating them as success. This also improves adapter interoperability by passing user_id into timeline filters, clamping timeline limits, preserving aggregated search results, enforcing first-wins follow behavior, and updating Friends integration to use current feed/user discovery APIs.

Author: pfefferle

includes/adapters/class-activitypub.php

@@ -153,9 +153,10 @@ protected function get_object_types_for_user( $user_id ) {
 	 * @param array  $result  Current result with 'items' from other adapters.
 	 * @param string $channel Channel UID.
 	 * @param array  $args    Query arguments (after, before, limit).
+	 * @param int    $user_id The user ID the timeline is requested for.
 	 * @return array Timeline data with 'items' and optional 'paging'.
 	 */
-	public function get_timeline( $result, $channel, $args ) {
+	public function get_timeline( $result, $channel, $args, $user_id = 0 ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
 		if ( ! self::is_available() ) {
 			return $result;
 		}
@@ -270,6 +271,11 @@ public function get_following( $result, $channel, $user_id ) {
 	 * @return array|null Feed data on success, null to pass to next adapter.
 	 */
 	public function follow( $result, $channel, $url, $user_id ) {
+		// Respect the "first adapter that can handle the URL wins" contract.
+		if ( null !== $result ) {
+			return $result;
+		}
+
 		if ( ! self::is_available() ) {
 			return $result;
 		}
@@ -313,14 +319,20 @@ public function unfollow( $result, $channel, $url, $user_id ) {
 			return $result;
 		}
 
-		// Use ActivityPub unfollow function.
+		// Use ActivityPub unfollow function. Returns the Undo outbox ID, or 0 when
+		// no matching Follow existed (i.e. this user was not following the actor).
 		$unfollow_result = \Activitypub\unfollow( $actor->ID, $user_id );
 
-		if ( ! \is_wp_error( $unfollow_result ) ) {
-			return true;
+		if ( \is_wp_error( $unfollow_result ) ) {
+			return false;
+		}
+
+		// A falsy result (0) means nothing was actually unfollowed here; pass through.
+		if ( ! $unfollow_result ) {
+			return $result;
 		}
 
-		return false;
+		return true;
 	}
 
 	/**

includes/adapters/class-friends.php

@@ -76,7 +76,7 @@ public function can_handle_url( $url ) {
 		}
 
 		// Try to discover feeds from the URL.
-		$discovered = $friends->feed->discover_feeds( $url );
+		$discovered = $friends->feed->discover_available_feeds( $url );
 
 		return ! \is_wp_error( $discovered ) && ! empty( $discovered );
 	}
@@ -103,7 +103,7 @@ public function owns_feed( $url ) {
 	 * @return \Friends\User_Feed|null The feed or null if not found.
 	 */
 	protected function get_feed_by_url( $url ) {
-		$friend_users = \Friends\User_Query::all_friends_subscriptions();
+		$friend_users = \Friends\User_Query::all_associated_users();
 
 		foreach ( $friend_users->get_results() as $friend_user ) {
 			if ( ! $friend_user instanceof \Friends\User ) {
@@ -309,9 +309,10 @@ public function delete_channel( $result, $uid, $user_id ) {
 	 * @param array  $result  Current result with 'items' from other adapters.
 	 * @param string $channel Channel UID.
 	 * @param array  $args    Query arguments (after, before, limit).
+	 * @param int    $user_id The user ID the timeline is requested for.
 	 * @return array Timeline data with 'items' and optional 'paging'.
 	 */
-	public function get_timeline( $result, $channel, $args ) {
+	public function get_timeline( $result, $channel, $args, $user_id = 0 ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
 		if ( ! self::is_available() ) {
 			return $result;
 		}
@@ -466,7 +467,7 @@ public function get_following( $result, $channel, $user_id ) {
 	protected function get_friend_users_for_channel( $channel ) {
 		// For home, notifications, and format channels, return all friends.
 		if ( 'home' === $channel || 'notifications' === $channel || str_starts_with( $channel, 'friends-' ) ) {
-			$query = \Friends\User_Query::all_friends_subscriptions();
+			$query = \Friends\User_Query::all_associated_users();
 			return $query->get_results();
 		}
 
@@ -508,23 +509,80 @@ protected function get_friend_users_for_channel( $channel ) {
 	 * @return array|null Feed data on success, null to pass to next adapter.
 	 */
 	public function follow( $result, $channel, $url, $user_id ) {
+		// Respect the "first adapter that can handle the URL wins" contract.
+		if ( null !== $result ) {
+			return $result;
+		}
+
 		if ( ! self::is_available() ) {
 			return $result;
 		}
 
-		// Check if we can handle this URL.
-		if ( ! $this->can_handle_url( $url ) ) {
+		$friends = $this->get_friends();
+		if ( ! $friends || ! isset( $friends->feed ) ) {
+			return $result;
+		}
+
+		// Discover subscribable feeds at the URL.
+		$feeds = $friends->feed->discover_available_feeds( $url );
+
+		if ( \is_wp_error( $feeds ) || empty( $feeds ) ) {
 			return $result;
 			// Pass to next adapter.
 		}
 
-		// Use Friends plugin to subscribe to the URL.
-		$friend_user = \Friends\Subscription::subscribe( $url );
+		// Derive a user login and display name from the discovered feeds.
+		$user_login   = \Friends\User::get_user_login_from_feeds( $feeds );
+		$display_name = \Friends\User::get_display_name_from_feeds( $feeds );
+
+		if ( empty( $user_login ) ) {
+			$user_login = \sanitize_user( (string) \wp_parse_url( $url, \PHP_URL_HOST ), true );
+		}
+
+		if ( empty( $user_login ) ) {
+			return $result;
+		}
+
+		// Pull an avatar and description from the discovered feeds, if available.
+		$avatar      = null;
+		$description = null;
+		foreach ( $feeds as $feed_details ) {
+			if ( ! $avatar && ! empty( $feed_details['avatar'] ) ) {
+				$avatar = $feed_details['avatar'];
+			}
+			if ( ! $description && ! empty( $feed_details['description'] ) ) {
+				$description = $feed_details['description'];
+			}
+		}
+
+		// Create (or fetch) the subscription user.
+		$friend_user = \Friends\User::create( $user_login, 'subscription', $url, $display_name, $avatar, $description );
 
 		if ( \is_wp_error( $friend_user ) ) {
 			return $result;
 		}
 
+		// Subscribe to the discovered feeds (autoselected, or any supported parser).
+		$subscribed = false;
+		foreach ( $feeds as $feed_url => $feed_details ) {
+			$autoselect  = ! empty( $feed_details['autoselect'] );
+			$unsupported = isset( $feed_details['parser'] ) && 'unsupported' === $feed_details['parser'];
+
+			if ( ! $autoselect && $unsupported ) {
+				continue;
+			}
+
+			$subscribed_feed = $friend_user->subscribe( $feed_url, $feed_details );
+
+			if ( ! \is_wp_error( $subscribed_feed ) ) {
+				$subscribed = true;
+			}
+		}
+
+		if ( ! $subscribed ) {
+			return $result;
+		}
+
 		// If subscribing to a specific list channel, add to that list.
 		if ( str_starts_with( $channel, 'tag-' ) ) {
 			$slug = substr( $channel, 4 );
@@ -603,13 +661,15 @@ public function search( $result, $query, $user_id ) {
 		}
 
 		// Use Friends feed discovery.
-		$discovered = $friends->feed->discover_feeds( $query );
+		$discovered = $friends->feed->discover_available_feeds( $query );
 
 		if ( \is_wp_error( $discovered ) || empty( $discovered ) ) {
-			return array( 'results' => array() );
+			// Nothing to add; preserve results from other adapters.
+			return $result;
 		}
 
-		$results = array();
+		// Preserve results aggregated by earlier adapters.
+		$results = ( \is_array( $result ) && isset( $result['results'] ) ) ? $result['results'] : array();
 
 		foreach ( $discovered as $feed_url => $feed_data ) {
 			$item = array(
@@ -646,7 +706,7 @@ public function preview( $result, $url, $user_id ) {
 		}
 
 		// Try to fetch and parse the feed.
-		$discovered = $friends->feed->discover_feeds( $url );
+		$discovered = $friends->feed->discover_available_feeds( $url );
 
 		if ( \is_wp_error( $discovered ) || empty( $discovered ) ) {
 			return $result;

includes/adapters/class-wordpress.php

@@ -100,9 +100,10 @@ public function get_channels( $channels, $user_id ) { // phpcs:ignore Generic.Co
 	 * @param array  $result  Current result with 'items' from other adapters.
 	 * @param string $channel Channel UID.
 	 * @param array  $args    Query arguments (after, before, limit).
+	 * @param int    $user_id The user ID the timeline is requested for.
 	 * @return array Timeline data with 'items' and optional 'paging'.
 	 */
-	public function get_timeline( $result, $channel, $args ) {
+	public function get_timeline( $result, $channel, $args, $user_id = 0 ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
 		$limit = isset( $args['limit'] ) ? \absint( $args['limit'] ) : 20;
 
 		// Local blog posts.
@@ -208,7 +209,9 @@ public function search( $result, $query, $user_id ) { // phpcs:ignore Generic.Co
 			return $result;
 		}
 
-		$results = array();
+		// Preserve results aggregated by earlier adapters.
+		$results = ( \is_array( $result ) && isset( $result['results'] ) ) ? $result['results'] : array();
+
 		foreach ( $posts as $post ) {
 			$results[] = array(
 				'type' => 'feed',

includes/class-adapter.php

@@ -68,7 +68,7 @@ public function register() {
 		\add_filter( 'microsub_order_channels', array( $this, 'order_channels' ), $this->priority, 3 );
 
 		// Timeline operations.
-		\add_filter( 'microsub_get_timeline', array( $this, 'get_timeline' ), $this->priority, 3 );
+		\add_filter( 'microsub_get_timeline', array( $this, 'get_timeline' ), $this->priority, 4 );
 		\add_filter( 'microsub_timeline_mark_read', array( $this, 'timeline_mark_read' ), $this->priority, 4 );
 		\add_filter( 'microsub_timeline_mark_unread', array( $this, 'timeline_mark_unread' ), $this->priority, 4 );
 		\add_filter( 'microsub_timeline_remove', array( $this, 'timeline_remove' ), $this->priority, 4 );
@@ -192,6 +192,11 @@ abstract public function get_channels( $channels, $user_id );
 	 * Results from multiple adapters are merged automatically.
 	 * Return only your adapter's items.
 	 *
+	 * Implementations may accept an optional fourth `$user_id` argument (the user
+	 * the timeline is requested for); it is passed by the `microsub_get_timeline`
+	 * filter. It is kept out of the abstract signature to preserve backwards
+	 * compatibility with existing three-parameter adapters.
+	 *
 	 * @param array  $result  Current result with 'items' from other adapters.
 	 * @param string $channel Channel UID.
 	 * @param array  $args    Query arguments.

includes/class-autoloader.php

@@ -51,7 +51,7 @@ class Autoloader {
 	public function __construct( $prefix, $path ) {
 		$this->prefix        = $prefix;
 		$this->prefix_length = \strlen( $prefix );
-		$this->path          = \rtrim( $path . '/' );
+		$this->path          = \rtrim( $path, '/' ) . '/';
 	}
 
 	/**

includes/class-microsub.php

@@ -68,7 +68,6 @@ public function init() {
 		}
 
 		$this->register_hooks();
-		$this->register_adapters();
 
 		$this->initialized = true;
 	}
@@ -145,7 +144,7 @@ public function html_header() {
 	 */
 	public function http_header() {
 		$endpoint = $this->get_endpoint();
-		\header( \sprintf( 'Link: <%s>; rel="microsub"', \esc_url( $endpoint ) ), false );
+		\header( \sprintf( 'Link: <%s>; rel="microsub"', \esc_url_raw( $endpoint ) ), false );
 	}
 
 	/**