PluginAdminbolt.php

<?php

use Composer\CaBundle\CaBundle;

require_once 'modules/admin/models/ServerPlugin.php';

class PluginAdminbolt extends ServerPlugin
{
    public $features = [
        'packageName' => true,
        'testConnection' => true,
        'showNameservers' => false,
        'directlink' => true,
        'upgrades' => true
    ];

    private const ACCOUNT_ID_FIELD = 'Server Acct Properties';
    private const DEFAULT_PORT = '8443';
    private const MAX_RETRIES = 2;
    private const MAX_RETRY_WAIT = 30;

    private ?int $lastStatus = null;
    private array $lastResponse = [];

    public function getVariables(): array
    {
        $variables = [
            'Name' => [
                'type' => 'hidden',
                'description' => 'Used by CE to show plugin',
                'value' => 'AdminBolt'
            ],
            'Description' => [
                'type' => 'hidden',
                'description' => 'Description viewable by admin in server settings',
                'value' => 'AdminBolt control panel integration'
            ],
            'API Key' => [
                'type' => 'text',
                'description' => 'API key from Security > API Keys in the AdminBolt admin panel (or the reseller panel when using the reseller API).',
                'value' => ''
            ],
            'API Secret' => [
                'type' => 'password',
                'description' => 'API secret shown once when the key pair was created.',
                'value' => '',
                'encryptable' => true
            ],
            'Port' => [
                'type' => 'text',
                'description' => 'AdminBolt panel port. Defaults to 8443.',
                'value' => self::DEFAULT_PORT
            ],
            'Use Reseller API' => [
                'type' => 'yesno',
                'description' => 'Enable when the key pair above is a reseller key. Accounts are then created under that reseller and only its own plans can be used.',
                'value' => '0'
            ],
            'Verify SSL Certificate' => [
                'type' => 'yesno',
                'description' => 'Verify the panel SSL certificate. Only disable this for panels using a self-signed certificate.',
                'value' => '1'
            ],
            'Actions' => [
                'type' => 'hidden',
                'description' => 'Current actions that are active for this plugin per server',
                'value' => 'Create,Delete,Suspend,UnSuspend'
            ],
            'Registered Actions For Customer' => [
                'type' => 'hidden',
                'description' => 'Current actions that are active for this plugin per server for customers',
                'value' => ''
            ],
            'package_addons' => [
                'type' => 'hidden',
                'description' => 'Supported signup addons variables',
                'value' => []
            ],
            'package_vars' => [
                'type' => 'hidden',
                'description' => 'Whether package settings are set',
                'value' => '0'
            ],
            'package_vars_values' => [
                'type' => 'hidden',
                'description' => 'Package Settings',
                'value' => []
            ]
        ];

        return $variables;
    }

    public function validateCredentials($args)
    {
    }

    public function doCreate($args): string
    {
        $userPackage = new UserPackage($args['userPackageId']);
        $args = $this->buildParams($userPackage);
        $this->create($args);

        return sprintf('%s has been created.', $userPackage->getCustomField('Domain Name'));
    }

    public function doDelete($args): string
    {
        $userPackage = new UserPackage($args['userPackageId']);
        $args = $this->buildParams($userPackage);
        $this->delete($args);

        return sprintf('%s has been deleted.', $userPackage->getCustomField('Domain Name'));
    }

    public function doUpdate($args): string
    {
        $userPackage = new UserPackage($args['userPackageId']);
        $args = $this->buildParams($userPackage, $args);
        $this->update($args);

        return sprintf('%s has been updated.', $userPackage->getCustomField('Domain Name'));
    }

    public function doSuspend($args): string
    {
        $userPackage = new UserPackage($args['userPackageId']);
        $args = $this->buildParams($userPackage);
        $this->suspend($args);

        return sprintf('%s has been suspended.', $userPackage->getCustomField('Domain Name'));
    }

    public function doUnSuspend($args): string
    {
        $userPackage = new UserPackage($args['userPackageId']);
        $args = $this->buildParams($userPackage);
        $this->unsuspend($args);

        return sprintf('%s has been unsuspended.', $userPackage->getCustomField('Domain Name'));
    }

    public function create($args): void
    {
        $userPackage = new UserPackage($args['package']['id']);
        $domain = trim((string) $args['package']['domain_name']);
        if ($domain === '') {
            throw new CE_Exception('A domain name is required to create an AdminBolt account.');
        }

        $username = trim((string) $args['package']['username']);
        $password = (string) $args['package']['password'];

        $data = [
            'domain' => $domain,
            'hosting_plan' => $this->getPlanName($args)
        ];

        if ($username !== '') {
            $data['username'] = $username;
        }

        if ($password !== '') {
            $data['password'] = $password;
        }

        try {
            $response = $this->request($args, 'POST', 'hosting-accounts', $data);
        } catch (CE_Exception $e) {
            if (!isset($data['username']) || !$this->isUsernameFormatError()) {
                throw $e;
            }

            // AdminBolt rolls back a failed create, so resend without the username and let the panel derive one from the domain
            CE_Lib::log(4, 'AdminBolt rejected username "' . $username . '" as an invalid format, retrying with a panel generated username');
            unset($data['username']);
            $response = $this->request($args, 'POST', 'hosting-accounts', $data);
        }

        $accountId = $response['id'] ?? ($response['hostingAccount']['id'] ?? null);
        if (empty($accountId)) {
            throw new CE_Exception(sprintf('AdminBolt created the account for %s but did not return an account id.', $domain));
        }

        $userPackage->setCustomField(self::ACCOUNT_ID_FIELD, (string) $accountId);

        $panelUsername = (string) ($response['username'] ?? ($response['hostingAccount']['username'] ?? ''));
        if ($panelUsername !== '' && $panelUsername !== $username) {
            $userPackage->setCustomField('User Name', $panelUsername);
        }

        if ($password === '' && !empty($response['password'])) {
            $userPackage->setCustomField('Password', (string) $response['password']);
        }
    }

    public function delete($args): void
    {
        $userPackage = new UserPackage($args['package']['id']);
        $accountId = $this->findAccountId($args);
        if ($accountId === null) {
            CE_Lib::log(4, 'AdminBolt: no account found for package ' . $args['package']['id'] . ', treating as already terminated');
            $userPackage->setCustomField(self::ACCOUNT_ID_FIELD, '');
            return;
        }

        // A 404 means the account is already gone on the panel, so let the cancellation complete
        $this->request($args, 'DELETE', 'hosting-accounts/' . $accountId, [], [], [404]);
        $userPackage->setCustomField(self::ACCOUNT_ID_FIELD, '');
    }

    public function suspend($args): void
    {
        $accountId = $this->getAccountId($args);
        $this->request($args, 'POST', 'hosting-accounts/' . $accountId . '/suspend');
    }

    public function unsuspend($args): void
    {
        $accountId = $this->getAccountId($args);
        $this->request($args, 'POST', 'hosting-accounts/' . $accountId . '/unsuspend');
    }

    public function update($args): void
    {
        $accountId = $this->getAccountId($args);
        $unsupported = [];

        foreach ($args['changes'] as $key => $value) {
            switch ($key) {
                case 'password':
                    $this->request($args, 'POST', 'hosting-accounts/' . $accountId . '/change-password', [
                        'password' => (string) $value
                    ]);
                    break;
                case 'package':
                    $this->request($args, 'PUT', 'hosting-accounts/' . $accountId, [
                        'hosting_plan' => $this->getPlanName($args)
                    ]);
                    break;
                case 'domain':
                    $unsupported[] = 'AdminBolt does not allow changing the main domain of an account.';
                    break;
                case 'username':
                    $unsupported[] = 'AdminBolt does not allow changing the username of an account.';
                    break;
            }
        }

        if (!empty($unsupported)) {
            throw new CE_Exception(implode("\n", $unsupported));
        }
    }

    public function getAvailableActions($userPackage): array
    {
        $args = $this->buildParams($userPackage);
        $account = $this->lookupAccount($args);
        if ($account === null) {
            return ['Create'];
        }

        if (!empty($account['id']) && $userPackage->getCustomField(self::ACCOUNT_ID_FIELD) != $account['id']) {
            $userPackage->setCustomField(self::ACCOUNT_ID_FIELD, (string) $account['id']);
        }

        $actions = [];
        $suspended = $this->isSuspended($account);

        if ($suspended === null) {
            // Suspend and unsuspend are idempotent on AdminBolt, so offering both is safe when the state is unknown
            $actions[] = 'Suspend';
            $actions[] = 'UnSuspend';
        } elseif ($suspended) {
            $actions[] = 'UnSuspend';
        } else {
            $actions[] = 'Suspend';
        }

        $actions[] = 'Delete';

        return $actions;
    }

    public function testConnection($args): void
    {
        CE_Lib::log(4, 'Testing connection to AdminBolt');

        $response = $this->request($args, 'GET', 'health');
        if (($response['status'] ?? '') !== 'ok') {
            throw new CE_Exception('AdminBolt health check did not return an ok status.');
        }
    }

    public function getDirectLink($userPackage, $getRealLink = true, $fromAdmin = false, $isReseller = false): array
    {
        $linkText = 'Login to AdminBolt';

        if ($fromAdmin) {
            return [
                'cmd' => 'panellogin',
                'label' => $linkText
            ];
        }

        if (!$getRealLink) {
            $link = 'index.php?fuse=clients&controller=products&action=openpackagedirectlink&packageId=' . $userPackage->getId() . '&sessionHash=' . CE_Lib::getSessionHash();

            return [
                'fa' => 'fa fa-user fa-fw',
                'link' => $link,
                'text' => $linkText,
                'form' => ''
            ];
        }

        $args = $this->buildParams($userPackage);
        $accountId = $this->getAccountId($args);
        $response = $this->request($args, 'POST', 'hosting-accounts/' . $accountId . '/generate-sso-token');
        if (empty($response['sso_url'])) {
            throw new CE_Exception('AdminBolt did not return a login URL.');
        }

        return [
            'fa' => 'fa fa-user fa-fw',
            'link' => $response['sso_url'],
            'text' => $linkText,
            'form' => ''
        ];
    }

    public function dopanellogin($args): string
    {
        $userPackage = new UserPackage($args['userPackageId']);
        $response = $this->getDirectLink($userPackage);

        return $response['link'];
    }

    private function getAccountId(array $args): int
    {
        $accountId = $this->findAccountId($args);
        if ($accountId === null) {
            throw new CE_Exception(sprintf('Unable to find the account for %s on AdminBolt.', $args['package']['domain_name']));
        }

        return $accountId;
    }

    private function findAccountId(array $args): ?int
    {
        $userPackage = new UserPackage($args['package']['id']);
        $storedId = $userPackage->getCustomField(self::ACCOUNT_ID_FIELD);
        if (is_numeric($storedId) && (int) $storedId > 0) {
            return (int) $storedId;
        }

        // Nothing stored yet (imported or older service), so re-link on the unique username
        $account = $this->lookupAccount($args);
        if ($account === null || empty($account['id'])) {
            return null;
        }

        $userPackage->setCustomField(self::ACCOUNT_ID_FIELD, (string) $account['id']);

        return (int) $account['id'];
    }

    private function lookupAccount(array $args): ?array
    {
        $username = trim((string) $args['package']['username']);
        if ($username === '') {
            return null;
        }

        $response = $this->request($args, 'GET', 'hosting-accounts', [], ['username' => $username]);

        foreach ($this->extractList($response) as $account) {
            if (is_array($account) && ($account['username'] ?? '') === $username) {
                return $account;
            }
        }

        return null;
    }

    private function extractList(?array $response): array
    {
        if (empty($response)) {
            return [];
        }

        if (isset($response['data']) && is_array($response['data'])) {
            return $response['data'];
        }

        return array_is_list($response) ? $response : [];
    }

    private function isSuspended(array $account): ?bool
    {
        foreach (['suspended', 'is_suspended'] as $field) {
            if (array_key_exists($field, $account)) {
                return filter_var($account[$field], FILTER_VALIDATE_BOOLEAN);
            }
        }

        if (isset($account['status']) && is_string($account['status'])) {
            return mb_strtolower($account['status']) === 'suspended';
        }

        return null;
    }

    private function isUsernameFormatError(): bool
    {
        if ($this->lastStatus !== 422) {
            return false;
        }

        $texts = [(string) ($this->lastResponse['message'] ?? '')];
        $errors = $this->lastResponse['errors'] ?? [];

        if (is_array($errors)) {
            foreach ($errors as $fieldErrors) {
                foreach ((array) $fieldErrors as $fieldError) {
                    $texts[] = (string) $fieldError;
                }
            }
        }

        foreach ($texts as $text) {
            if (mb_stripos($text, 'invalid username format') !== false) {
                return true;
            }
        }

        return false;
    }

    private function getPlanName(array $args): string
    {
        $plan = trim((string) $args['package']['name_on_server']);
        if ($plan === '') {
            throw new CE_Exception('No package name on server is set. Enter the AdminBolt hosting plan name on the package.');
        }

        return $plan;
    }

    private function getBaseUrl(array $args): string
    {
        $host = trim((string) $args['server']['variables']['ServerHostName']);
        $host = preg_replace('#^https?://#iu', '', $host);
        $host = preg_replace('#/.*$#u', '', $host);
        if ($host === '') {
            throw new CE_Exception('The server hostname is not set.');
        }

        $port = trim((string) ($args['server']['variables']['plugin_adminbolt_Port'] ?? ''));
        if (!ctype_digit($port)) {
            $port = self::DEFAULT_PORT;
        }

        if (!preg_match('/:\d+$/u', $host)) {
            $host .= ':' . $port;
        }

        $prefix = !empty($args['server']['variables']['plugin_adminbolt_Use_Reseller_API']) ? '/api/reseller' : '/api';

        return 'https://' . $host . $prefix;
    }

    private function request(array $args, string $method, string $endpoint, array $data = [], array $query = [], array $passStatuses = []): ?array
    {
        $url = $this->getBaseUrl($args) . '/' . $endpoint;
        if (!empty($query)) {
            $url .= '?' . http_build_query($query);
        }

        $headers = [
            'Accept: application/json',
            'Content-Type: application/json',
            'X-API-Key: ' . $args['server']['variables']['plugin_adminbolt_API_Key'],
            'X-API-Secret: ' . $args['server']['variables']['plugin_adminbolt_API_Secret']
        ];

        $verifySsl = ($args['server']['variables']['plugin_adminbolt_Verify_SSL_Certificate'] ?? '1') == '1';
        $attempt = 0;
        $this->lastStatus = null;
        $this->lastResponse = [];

        while (true) {
            $retryAfter = 0;
            $ch = curl_init($url);

            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_CUSTOMREQUEST => $method,
                CURLOPT_HTTPHEADER => $headers,
                CURLOPT_FOLLOWLOCATION => false,
                CURLOPT_CONNECTTIMEOUT => 15,
                CURLOPT_TIMEOUT => 180,
                CURLOPT_HEADERFUNCTION => function ($ch, string $header) use (&$retryAfter): int {
                    if (preg_match('/^Retry-After:\s*(\d+)/iu', $header, $matches)) {
                        $retryAfter = (int) $matches[1];
                    }

                    return mb_strlen($header, '8bit');
                }
            ]);

            if (in_array($method, ['POST', 'PUT'], true)) {
                curl_setopt($ch, CURLOPT_POSTFIELDS, empty($data) ? '{}' : json_encode($data));
            }

            if ($verifySsl) {
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
                curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
                curl_setopt($ch, CURLOPT_CAINFO, CaBundle::getSystemCaRootBundlePath());
            } else {
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
                curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
            }

            $body = curl_exec($ch);
            if ($body === false) {
                throw new CE_Exception(sprintf('Unable to connect to AdminBolt: %s', curl_error($ch)));
            }

            $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

            // Never log bodies here: create responses can contain the account password
            CE_Lib::log(4, 'AdminBolt ' . $method . ' /' . $endpoint . ' returned HTTP ' . $status);

            if ($status === 429 && $attempt < self::MAX_RETRIES) {
                $attempt++;
                sleep(min(max($retryAfter, 1), self::MAX_RETRY_WAIT));
                continue;
            }

            break;
        }

        $decoded = json_decode((string) $body, true);
        $this->lastStatus = $status;
        $this->lastResponse = is_array($decoded) ? $decoded : [];

        if (in_array($status, $passStatuses, true)) {
            return null;
        }

        if ($status >= 200 && $status < 300) {
            return $this->lastResponse;
        }

        throw new CE_Exception($this->buildErrorMessage($status, $this->lastResponse));
    }

    private function buildErrorMessage(int $status, array $decoded): string
    {
        $message = (string) ($decoded['message'] ?? ($decoded['error'] ?? ''));

        if (!empty($decoded['errors']) && is_array($decoded['errors'])) {
            $details = [];
            foreach ($decoded['errors'] as $fieldErrors) {
                foreach ((array) $fieldErrors as $fieldError) {
                    $details[] = (string) $fieldError;
                }
            }

            if (!empty($details)) {
                $message = implode(' ', array_unique(array_merge([$message], $details)));
            }
        }

        $message = trim($message);

        if ($status >= 300 && $status < 400) {
            return sprintf('AdminBolt redirected the request (HTTP %d). Check the hostname and port.', $status);
        }

        if ($status === 401 || $status === 403) {
            return sprintf('AdminBolt rejected the API credentials (HTTP %d): %s', $status, $message);
        }

        if ($status === 404) {
            return 'The account was not found on AdminBolt (HTTP 404). It may have been removed directly in the panel.';
        }

        if ($status === 429) {
            return 'AdminBolt rate limit reached. Please try again in a minute.';
        }

        if ($message === '') {
            return sprintf('AdminBolt returned HTTP %d with no error message.', $status);
        }

        return sprintf('AdminBolt returned HTTP %d: %s', $status, $message);
    }
}