WordPress

<?php
/**
 * Plugin Name:       Constaia Upload
 * Description:       Document validation with Constaia: [constaia_upload profile="dni"] shortcode + REST route constaia/v1/analyze.
 * Version:           0.1.0
 * Requires PHP:      8.1
 * License:           MIT
 */

declare(strict_types=1);

if (!defined('ABSPATH')) {
    exit;
}

require_once __DIR__ . '/vendor/autoload.php';

/**
 * What each profile validates. Decided here, on the server: the browser only picks a profile name.
 * Extend it with add_filter('constaia_profiles', …).
 */
function constaia_profiles(): array
{
    return apply_filters('constaia_profiles', [
        'dni' => [
            'expect' => ['es_dni', 'es_nie', 'passport'],
            'checks' => ['not_expired' => true],
        ],
        'medical' => [
            'expect' => 'medical_certificate_sport',
            'checks' => ['max_age_days' => 365, 'require_signature' => true],
        ],
    ]);
}

function constaia_client(): Constaia\Client
{
    static $client = null;
    $key = defined('CONSTAIA_API_KEY') ? CONSTAIA_API_KEY : null;

    return $client ??= new Constaia\Client($key, ['timeout' => 60]);
}

add_action('rest_api_init', static function (): void {
    register_rest_route('constaia/v1', '/analyze', [
        'methods' => 'POST',
        'callback' => 'constaia_rest_analyze',
        // Standard REST cookie auth: WordPress validates the X-WP-Nonce header (wp_rest) and, without
        // a valid nonce, treats the request as anonymous, so is_user_logged_in() is false.
        'permission_callback' => static function (): bool {
            return is_user_logged_in() && current_user_can('read');
        },
        'args' => [
            'profile' => ['type' => 'string', 'required' => true, 'enum' => array_keys(constaia_profiles())],
        ],
    ]);
});

function constaia_rest_analyze(WP_REST_Request $request)
{
    $profile = constaia_profiles()[$request->get_param('profile')] ?? null;
    $file = $request->get_file_params()['file'] ?? null;

    if ($profile === null || !is_array($file) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
        return constaia_rest_error('invalid_request', __('No document received.', 'constaia'), 400);
    }
    if (!is_uploaded_file($file['tmp_name']) || $file['size'] > 20 * 1024 * 1024) {
        return constaia_rest_error('file_too_large', __('The file is too large (max. 20 MB).', 'constaia'), 400);
    }

    // Only the language is taken from the widget; expect/checks come from the server-side profile.
    $clientOptions = json_decode((string) $request->get_param('options'), true);
    $language = is_array($clientOptions) && in_array($clientOptions['language'] ?? '', ['es', 'en', 'pt', 'fr'], true)
        ? $clientOptions['language']
        : 'es';

    try {
        $analysis = constaia_client()->analyze($file['tmp_name'], $profile + [
            'filename' => sanitize_file_name($file['name']),
            'storage' => 'none',
            'language' => $language,
            'metadata' => ['wp_user_id' => (string) get_current_user_id()],
        ]);
    } catch (Constaia\Exception\ConstaiaException $e) {
        error_log('[constaia] ' . $e->getMessage() . ' request_id=' . $e->requestId);

        return constaia_rest_error('analysis_failed', __('The document could not be analysed. Please try again.', 'constaia'), 502);
    }

    do_action('constaia_analysis', $analysis, get_current_user_id());

    return rest_ensure_response([
        'id' => $analysis->id,
        'object' => 'analysis',
        'status' => $analysis->status,
        'document' => $analysis->document?->toArray(),
        'verdict' => $analysis->verdict?->toArray(),
        'warnings' => $analysis->warnings ?? [],
    ]);
}

function constaia_rest_error(string $code, string $message, int $status): WP_REST_Response
{
    return new WP_REST_Response(['error' => ['code' => $code, 'message' => $message]], $status);
}

add_shortcode('constaia_upload', static function ($atts): string {
    $atts = shortcode_atts(['profile' => 'dni'], $atts, 'constaia_upload');
    if (!is_user_logged_in()) {
        return '<p>' . esc_html__('Log in to upload your document.', 'constaia') . '</p>';
    }
    if (!isset(constaia_profiles()[$atts['profile']])) {
        return '';
    }

    wp_enqueue_script(
        'constaia-widget',
        'https://cdn.jsdelivr.net/npm/@constaia/widget@0.1/dist/cdn/constaia-widget.iife.min.js',
        [],
        '0.1.0',
        true
    );

    $endpoint = add_query_arg(
        ['profile' => $atts['profile']],
        rest_url('constaia/v1/analyze')
    );
    $headers = wp_json_encode(['X-WP-Nonce' => wp_create_nonce('wp_rest')]);

    return sprintf(
        '<constaia-upload endpoint="%s" headers="%s" lang="%s"></constaia-upload>',
        esc_url($endpoint),
        esc_attr((string) $headers),
        esc_attr(substr(get_locale(), 0, 2))
    );
});

<?php

add_filter('constaia_profiles', static function (array $profiles): array {
    $user = wp_get_current_user();

    $profiles['dni'] = [
        'expect' => ['es_dni', 'es_nie', 'passport'],
        'checks' => [
            'not_expired' => true,
            'min_age_years' => 18,
            'holder' => ['full_name' => $user->display_name],
        ],
    ];

    $profiles['lopivi'] = [
        'expect' => 'es_sexual_offences_certificate',
        'checks' => [
            'max_age_days' => 90,
            'holder' => ['full_name' => $user->display_name],
        ],
    ];

    $profiles['receipt'] = [
        'expect' => 'payment_receipt',
        'checks' => [
            'expected_amount' => 45,
            'expected_iban' => 'ES7921000813610123456789',
            'expected_reference' => 'INSCRIPCION ' . $user->ID,
        ],
    ];

    return $profiles;
});

<?php

add_action('constaia_analysis', static function (Constaia\Analysis $analysis, int $userId): void {
    update_user_meta($userId, 'constaia_analysis_id', $analysis->id);
    update_user_meta($userId, 'constaia_verdict', $analysis->verdictStatus() ?? $analysis->status);

    if ($analysis->needsReview()) {
        wp_mail(get_option('admin_email'), 'Document pending review', "Analysis {$analysis->id} for user {$userId}.");
    }
}, 10, 2);

<?php

use Constaia\Exception\SignatureVerificationException;
use Constaia\Webhook;

add_action('rest_api_init', static function (): void {
    register_rest_route('constaia/v1', '/webhook', [
        'methods' => 'POST',
        'permission_callback' => '__return_true', // the signature is the authentication
        'callback' => static function (WP_REST_Request $request) {
            try {
                $event = Webhook::verify($request->get_body(), $request->get_headers(), CONSTAIA_WEBHOOK_SECRET);
            } catch (SignatureVerificationException $e) {
                return new WP_REST_Response(['error' => 'invalid signature'], 400);
            }

            $webhookId = (string) $request->get_header('webhook-id');
            if (get_transient('constaia_wh_' . md5($webhookId))) {
                return new WP_REST_Response(null, 204);
            }
            set_transient('constaia_wh_' . md5($webhookId), 1, 4 * DAY_IN_SECONDS);

            if (in_array($event['type'], ['analysis.completed', 'analysis.review_required', 'analysis.failed'], true)) {
                $analysis = $event['data'];
                $userId = (int) ($analysis['metadata']['wp_user_id'] ?? 0);
                if ($userId > 0) {
                    update_user_meta($userId, 'constaia_verdict', $analysis['verdict']['status'] ?? $analysis['status']);
                }
            }

            return new WP_REST_Response(null, 204);
        },
    ]);
});