friendica/include/api.php

<?php
/**
 * Friendica implementation of statusnet/twitter API
 *
 * @file include/api.php
 * @todo Automatically detect if incoming data is HTML or BBCode
 */

use Friendica\App;
use Friendica\Content\ContactSelector;
use Friendica\Content\Feature;
use Friendica\Content\Text\BBCode;
use Friendica\Content\Text\HTML;
use Friendica\Core\Addon;
use Friendica\Core\Config;
use Friendica\Core\L10n;
use Friendica\Core\NotificationsManager;
use Friendica\Core\PConfig;
use Friendica\Core\System;
use Friendica\Core\Worker;
use Friendica\Database\DBM;
use Friendica\Model\Contact;
use Friendica\Model\Group;
use Friendica\Model\Item;
use Friendica\Model\Mail;
use Friendica\Model\Photo;
use Friendica\Model\User;
use Friendica\Network\FKOAuth1;
use Friendica\Network\HTTPException;
use Friendica\Network\HTTPException\BadRequestException;
use Friendica\Network\HTTPException\ForbiddenException;
use Friendica\Network\HTTPException\InternalServerErrorException;
use Friendica\Network\HTTPException\MethodNotAllowedException;
use Friendica\Network\HTTPException\NotFoundException;
use Friendica\Network\HTTPException\NotImplementedException;
use Friendica\Network\HTTPException\TooManyRequestsException;
use Friendica\Network\HTTPException\UnauthorizedException;
use Friendica\Object\Image;
use Friendica\Protocol\Diaspora;
use Friendica\Util\DateTimeFormat;
use Friendica\Util\Network;
use Friendica\Util\XML;

require_once 'include/conversation.php';
require_once 'mod/share.php';
require_once 'mod/item.php';
require_once 'include/security.php';
require_once 'mod/wall_upload.php';
require_once 'mod/proxy.php';

define('API_METHOD_ANY', '*');
define('API_METHOD_GET', 'GET');
define('API_METHOD_POST', 'POST,PUT');
define('API_METHOD_DELETE', 'POST,DELETE');

$API = [];
$called_api = [];

/**
 * It is not sufficient to use local_user() to check whether someone is allowed to use the API,
 * because this will open CSRF holes (just embed an image with src=friendicasite.com/api/statuses/update?status=CSRF
 * into a page, and visitors will post something without noticing it).
 *
 * @brief Auth API user
 */
function api_user()
{
	if (x($_SESSION, 'allow_api')) {
		return local_user();
	}

	return false;
}

/**
 * Clients can send 'source' parameter to be show in post metadata
 * as "sent via <source>".
 * Some clients doesn't send a source param, we support ones we know
 * (only Twidere, atm)
 *
 * @brief Get source name from API client
 *
 * @return string
 * 		Client source name, default to "api" if unset/unknown
 */
function api_source()
{
	if (requestdata('source')) {
		return requestdata('source');
	}

	// Support for known clients that doesn't send a source name
	if (strpos($_SERVER['HTTP_USER_AGENT'], "Twidere") !== false) {
		return "Twidere";
	}

	logger("Unrecognized user-agent ".$_SERVER['HTTP_USER_AGENT'], LOGGER_DEBUG);

	return "api";
}

/**
 * @brief Format date for API
 *
 * @param string $str Source date, as UTC
 * @return string Date in UTC formatted as "D M d H:i:s +0000 Y"
 */
function api_date($str)
{
	// Wed May 23 06:01:13 +0000 2007
	return DateTimeFormat::utc($str, "D M d H:i:s +0000 Y");
}

/**
 * Register a function to be the endpoint for defined API path.
 *
 * @brief Register API endpoint
 *
 * @param string $path   API URL path, relative to System::baseUrl()
 * @param string $func   Function name to call on path request
 * @param bool   $auth   API need logged user
 * @param string $method HTTP method reqiured to call this endpoint.
 *                       One of API_METHOD_ANY, API_METHOD_GET, API_METHOD_POST.
 *                       Default to API_METHOD_ANY
 */
function api_register_func($path, $func, $auth = false, $method = API_METHOD_ANY)
{
	global $API;

	$API[$path] = [
		'func'   => $func,
		'auth'   => $auth,
		'method' => $method,
	];

	// Workaround for hotot
	$path = str_replace("api/", "api/1.1/", $path);

	$API[$path] = [
		'func'   => $func,
		'auth'   => $auth,
		'method' => $method,
	];
}

/**
 * Log in user via OAuth1 or Simple HTTP Auth.
 * Simple Auth allow username in form of <pre>user@server</pre>, ignoring server part
 *
 * @brief Login API user
 *
 * @param object $a App
 * @hook 'authenticate'
 * 		array $addon_auth
 *			'username' => username from login form
 *			'password' => password from login form
 *			'authenticated' => return status,
 *			'user_record' => return authenticated user record
 * @hook 'logged_in'
 * 		array $user	logged user record
 */
function api_login(App $a)
{
	$oauth1 = new FKOAuth1();
	// login with oauth
	try {
		list($consumer, $token) = $oauth1->verify_request(OAuthRequest::from_request());
		if (!is_null($token)) {
			$oauth1->loginUser($token->uid);
			Addon::callHooks('logged_in', $a->user);
			return;
		}
		echo __FILE__.__LINE__.__FUNCTION__ . "<pre>";
		var_dump($consumer, $token);
		die();
	} catch (Exception $e) {
		logger($e);
	}

	// workaround for HTTP-auth in CGI mode
	if (x($_SERVER, 'REDIRECT_REMOTE_USER')) {
		$userpass = base64_decode(substr($_SERVER["REDIRECT_REMOTE_USER"], 6)) ;
		if (strlen($userpass)) {
			list($name, $password) = explode(':', $userpass);
			$_SERVER['PHP_AUTH_USER'] = $name;
			$_SERVER['PHP_AUTH_PW'] = $password;
		}
	}

	if (!x($_SERVER, 'PHP_AUTH_USER')) {
		logger('API_login: ' . print_r($_SERVER, true), LOGGER_DEBUG);
		header('WWW-Authenticate: Basic realm="Friendica"');
		throw new UnauthorizedException("This API requires login");
	}

	$user = $_SERVER['PHP_AUTH_USER'];
	$password = $_SERVER['PHP_AUTH_PW'];

	// allow "user@server" login (but ignore 'server' part)
	$at = strstr($user, "@", true);
	if ($at) {
		$user = $at;
	}

	// next code from mod/auth.php. needs better solution
	$record = null;

	$addon_auth = [
		'username' => trim($user),
		'password' => trim($password),
		'authenticated' => 0,
		'user_record' => null,
	];

	/*
	* An addon indicates successful login by setting 'authenticated' to non-zero value and returning a user record
	* Addons should never set 'authenticated' except to indicate success - as hooks may be chained
	* and later addons should not interfere with an earlier one that succeeded.
	*/
	Addon::callHooks('authenticate', $addon_auth);

	if ($addon_auth['authenticated'] && count($addon_auth['user_record'])) {
		$record = $addon_auth['user_record'];
	} else {
		$user_id = User::authenticate(trim($user), trim($password));
		if ($user_id !== false) {
			$record = dba::selectFirst('user', [], ['uid' => $user_id]);
		}
	}

	if (!DBM::is_result($record)) {
		logger('API_login failure: ' . print_r($_SERVER, true), LOGGER_DEBUG);
		header('WWW-Authenticate: Basic realm="Friendica"');
		//header('HTTP/1.0 401 Unauthorized');
		//die('This api requires login');
		throw new UnauthorizedException("This API requires login");
	}

	authenticate_success($record);

	$_SESSION["allow_api"] = true;

	Addon::callHooks('logged_in', $a->user);
}

/**
 * API endpoints can define which HTTP method to accept when called.
 * This function check the current HTTP method agains endpoint
 * registered method.
 *
 * @brief Check HTTP method of called API
 *
 * @param string $method Required methods, uppercase, separated by comma
 * @return bool
 */
function api_check_method($method)
{
	if ($method == "*") {
		return true;
	}
	return (strpos($method, $_SERVER['REQUEST_METHOD']) !== false);
}

/**
 * Authenticate user, call registered API function, set HTTP headers
 *
 * @brief Main API entry point
 *
 * @param object $a App
 * @return string|array API call result
 */
function api_call(App $a)
{
	global $API, $called_api;

	$type = "json";
	if (strpos($a->query_string, ".xml") > 0) {
		$type = "xml";
	}
	if (strpos($a->query_string, ".json") > 0) {
		$type = "json";
	}
	if (strpos($a->query_string, ".rss") > 0) {
		$type = "rss";
	}
	if (strpos($a->query_string, ".atom") > 0) {
		$type = "atom";
	}

	try {
		foreach ($API as $p => $info) {
			if (strpos($a->query_string, $p) === 0) {
				if (!api_check_method($info['method'])) {
					throw new MethodNotAllowedException();
				}

				$called_api = explode("/", $p);
				//unset($_SERVER['PHP_AUTH_USER']);

				/// @TODO should be "true ==[=] $info['auth']", if you miss only one = character, you assign a variable (only with ==). Let's make all this even.
				if ($info['auth'] === true && api_user() === false) {
					api_login($a);
				}

				logger('API call for ' . $a->user['username'] . ': ' . $a->query_string);
				logger('API parameters: ' . print_r($_REQUEST, true));

				$stamp =  microtime(true);
				$return = call_user_func($info['func'], $type);
				$duration = (float) (microtime(true) - $stamp);
				logger("API call duration: " . round($duration, 2) . "\t" . $a->query_string, LOGGER_DEBUG);

				if (Config::get("system", "profiler")) {
					$duration = microtime(true)-$a->performance["start"];

					/// @TODO round() really everywhere?
					logger(
						parse_url($a->query_string, PHP_URL_PATH) . ": " . sprintf(
							"Database: %s/%s, Cache %s/%s, Network: %s, I/O: %s, Other: %s, Total: %s",
							round($a->performance["database"] - $a->performance["database_write"], 3),
							round($a->performance["database_write"], 3),
							round($a->performance["cache"], 3),
							round($a->performance["cache_write"], 3),
							round($a->performance["network"], 2),
							round($a->performance["file"], 2),
							round($duration - ($a->performance["database"]
								+ $a->performance["cache"] + $a->performance["cache_write"]
								+ $a->performance["network"] + $a->performance["file"]), 2),
							round($duration, 2)
						),
						LOGGER_DEBUG
					);

					if (Config::get("rendertime", "callstack")) {
						$o = "Database Read:\n";
						foreach ($a->callstack["database"] as $func => $time) {
							$time = round($time, 3);
							if ($time > 0) {
								$o .= $func . ": " . $time . "\n";
							}
						}
						$o .= "\nDatabase Write:\n";
						foreach ($a->callstack["database_write"] as $func => $time) {
							$time = round($time, 3);
							if ($time > 0) {
								$o .= $func . ": " . $time . "\n";
							}
						}

						$o = "Cache Read:\n";
						foreach ($a->callstack["cache"] as $func => $time) {
							$time = round($time, 3);
							if ($time > 0) {
								$o .= $func . ": " . $time . "\n";
							}
						}
						$o .= "\nCache Write:\n";
						foreach ($a->callstack["cache_write"] as $func => $time) {
							$time = round($time, 3);
							if ($time > 0) {
								$o .= $func . ": " . $time . "\n";
							}
						}

						$o .= "\nNetwork:\n";
						foreach ($a->callstack["network"] as $func => $time) {
							$time = round($time, 3);
							if ($time > 0) {
								$o .= $func . ": " . $time . "\n";
							}
						}
						logger($o, LOGGER_DEBUG);
					}
				}

				if (false === $return) {
					/*
						* api function returned false withour throw an
						* exception. This should not happend, throw a 500
						*/
					throw new InternalServerErrorException();
				}

				switch ($type) {
					case "xml":
						header("Content-Type: text/xml");
						break;
					case "json":
						header("Content-Type: application/json");
						$json = json_encode(end($return));
						if (x($_GET, 'callback')) {
							$json = $_GET['callback'] . "(" . $json . ")";
						}
						$return = $json;
						break;
					case "rss":
						header("Content-Type: application/rss+xml");
						$return  = '<?xml version="1.0" encoding="UTF-8"?>' . "\n" . $return;
						break;
					case "atom":
						header("Content-Type: application/atom+xml");
						$return = '<?xml version="1.0" encoding="UTF-8"?>' . "\n" . $return;
						break;
				}
				return $return;
			}
		}

		logger('API call not implemented: ' . $a->query_string);
		throw new NotImplementedException();
	} catch (HTTPException $e) {
		header("HTTP/1.1 {$e->httpcode} {$e->httpdesc}");
		return api_error($type, $e);
	}
}

/**
 * @brief Format API error string
 *
 * @param string $type Return type (xml, json, rss, as)
 * @param object $e    HTTPException Error object
 * @return string|array error message formatted as $type
 */
function api_error($type, $e)
{
	$a = get_app();

	$error = ($e->getMessage() !== "" ? $e->getMessage() : $e->httpdesc);
	/// @TODO:  https://dev.twitter.com/overview/api/response-codes

	$error = ["error" => $error,
			"code" => $e->httpcode . " " . $e->httpdesc,
			"request" => $a->query_string];

	$return = api_format_data('status', $type, ['status' => $error]);

	switch ($type) {
		case "xml":
			header("Content-Type: text/xml");
			break;
		case "json":
			header("Content-Type: application/json");
			$return = json_encode($return);
			break;
		case "rss":
			header("Content-Type: application/rss+xml");
			break;
		case "atom":
			header("Content-Type: application/atom+xml");
			break;
	}

	return $return;
}

/**
 * @brief Set values for RSS template
 *
 * @param App $a
 * @param array $arr       Array to be passed to template
 * @param array $user_info User info
 * @return array
 * @todo find proper type-hints
 */
function api_rss_extra(App $a, $arr, $user_info)
{
	if (is_null($user_info)) {
		$user_info = api_get_user($a);
	}

	$arr['$user'] = $user_info;
	$arr['$rss'] = [
		'alternate'    => $user_info['url'],
		'self'         => System::baseUrl() . "/" . $a->query_string,
		'base'         => System::baseUrl(),
		'updated'      => api_date(null),
		'atom_updated' => DateTimeFormat::utcNow(DateTimeFormat::ATOM),
		'language'     => $user_info['language'],
		'logo'         => System::baseUrl() . "/images/friendica-32.png",
	];

	return $arr;
}


/**
 * @brief Unique contact to contact url.
 *
 * @param int $id Contact id
 * @return bool|string
 * 		Contact url or False if contact id is unknown
 */
function api_unique_id_to_nurl($id)
{
	$r = dba::selectFirst('contact', ['nurl'], ['uid' => 0, 'id' => $id]);

	if (DBM::is_result($r)) {
		return $r["nurl"];
	} else {
		return false;
	}
}

/**
 * @brief Get user info array.
 *
 * @param object     $a          App
 * @param int|string $contact_id Contact ID or URL
 */
function api_get_user(App $a, $contact_id = null)
{
	global $called_api;

	$user = null;
	$extra_query = "";
	$url = "";

	logger("api_get_user: Fetching user data for user ".$contact_id, LOGGER_DEBUG);

	// Searching for contact URL
	if (!is_null($contact_id) && (intval($contact_id) == 0)) {
		$user = dbesc(normalise_link($contact_id));
		$url = $user;
		$extra_query = "AND `contact`.`nurl` = '%s' ";
		if (api_user() !== false) {
			$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
		}
	}

	// Searching for contact id with uid = 0
	if (!is_null($contact_id) && (intval($contact_id) != 0)) {
		$user = dbesc(api_unique_id_to_nurl(intval($contact_id)));

		if ($user == "") {
			throw new BadRequestException("User not found.");
		}

		$url = $user;
		$extra_query = "AND `contact`.`nurl` = '%s' ";
		if (api_user() !== false) {
			$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
		}
	}

	if (is_null($user) && x($_GET, 'user_id')) {
		$user = dbesc(api_unique_id_to_nurl($_GET['user_id']));

		if ($user == "") {
			throw new BadRequestException("User not found.");
		}

		$url = $user;
		$extra_query = "AND `contact`.`nurl` = '%s' ";
		if (api_user() !== false) {
			$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
		}
	}
	if (is_null($user) && x($_GET, 'screen_name')) {
		$user = dbesc($_GET['screen_name']);
		$extra_query = "AND `contact`.`nick` = '%s' ";
		if (api_user() !== false) {
			$extra_query .= "AND `contact`.`uid`=".intval(api_user());
		}
	}

	if (is_null($user) && x($_GET, 'profileurl')) {
		$user = dbesc(normalise_link($_GET['profileurl']));
		$extra_query = "AND `contact`.`nurl` = '%s' ";
		if (api_user() !== false) {
			$extra_query .= "AND `contact`.`uid`=".intval(api_user());
		}
	}

	if (is_null($user) && ($a->argc > (count($called_api) - 1)) && (count($called_api) > 0)) {
		$argid = count($called_api);
		list($user, $null) = explode(".", $a->argv[$argid]);
		if (is_numeric($user)) {
			$user = dbesc(api_unique_id_to_nurl(intval($user)));

			if ($user != "") {
				$url = $user;
				$extra_query = "AND `contact`.`nurl` = '%s' ";
				if (api_user() !== false) {
					$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
				}
			}
		} else {
			$user = dbesc($user);
			$extra_query = "AND `contact`.`nick` = '%s' ";
			if (api_user() !== false) {
				$extra_query .= "AND `contact`.`uid`=" . intval(api_user());
			}
		}
	}

	logger("api_get_user: user ".$user, LOGGER_DEBUG);

	if (!$user) {
		if (api_user() === false) {
			api_login($a);
			return false;
		} else {
			$user = $_SESSION['uid'];
			$extra_query = "AND `contact`.`uid` = %d AND `contact`.`self` ";
		}
	}

	logger('api_user: ' . $extra_query . ', user: ' . $user);

	// user info
	$uinfo = q(
		"SELECT *, `contact`.`id` AS `cid` FROM `contact`
			WHERE 1
		$extra_query",
		$user
	);

	// Selecting the id by priority, friendica first
	if (is_array($uinfo)) {
		api_best_nickname($uinfo);
	}

	// if the contact wasn't found, fetch it from the contacts with uid = 0
	if (!DBM::is_result($uinfo)) {
		$r = [];

		if ($url != "") {
			$r = q("SELECT * FROM `contact` WHERE `uid` = 0 AND `nurl` = '%s' LIMIT 1", dbesc(normalise_link($url)));
		}