Integrate with WordPress

define( 'MIGHTY_NETWORK_SUBDOMAIN', 'my-community' );
define( 'MIGHTY_CLIENT_ID', 'YOUR_CLIENT_ID' );
define( 'MIGHTY_CLIENT_SECRET', 'YOUR_CLIENT_SECRET' );
define( 'MIGHTY_ENCRYPTION_KEY', 'OUTPUT_OF_THE_FIRST_COMMAND' );
define( 'MIGHTY_WEBHOOK_SECRET', 'OUTPUT_OF_THE_SECOND_COMMAND' );

// Only set this if your Network uses a custom domain and its SSL certificate is
// live. See the Note under "Handle the callback".
// define( 'MIGHTY_NETWORK_CUSTOM_DOMAIN', 'https://community.example.com' );

<?php
/**
 * Plugin Name: Mighty Networks Connect
 * Description: Shows events and posts from a Mighty Network with the Mighty API.
 * Version:     0.1.0
 * Requires PHP: 8.0
 */

defined( 'ABSPATH' ) || exit;

function mighty_base64url( string $bytes ): string {
	return rtrim( strtr( base64_encode( $bytes ), '+/', '-_' ), '=' );
}

// OAuth endpoints live on the Network's community host, not on api.mn.co.
function mighty_oauth_url( string $path = '' ): string {
	return 'https://' . MIGHTY_NETWORK_SUBDOMAIN . '.mn.co' . $path;
}

function mighty_redirect_uri(): string {
	return rest_url( 'mighty/v1/oauth/callback' );
}

// The host that shows the consent screen and sends back `iss`. It's the
// subdomain above, unless your Network has a custom domain with its SSL
// certificate live, in which case /oauth/authorize redirects there first. See
// the Note under "Handle the callback".
function mighty_issuer(): string {
	return defined( 'MIGHTY_NETWORK_CUSTOM_DOMAIN' ) ? MIGHTY_NETWORK_CUSTOM_DOMAIN : mighty_oauth_url();
}

function mighty_user_agent(): string {
	return 'mighty-networks-connect/0.1.0 (+' . home_url() . ')';
}

function mighty_encrypt( string $plaintext ): string {
	$key   = base64_decode( MIGHTY_ENCRYPTION_KEY );
	$nonce = random_bytes( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
	return base64_encode( $nonce . sodium_crypto_secretbox( $plaintext, $nonce, $key ) );
}

function mighty_decrypt( string $ciphertext ): ?string {
	$raw   = base64_decode( $ciphertext );
	$key   = base64_decode( MIGHTY_ENCRYPTION_KEY );
	$nonce = substr( $raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
	$plain = sodium_crypto_secretbox_open( substr( $raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ), $nonce, $key );
	return false === $plain ? null : $plain;
}

function mighty_save_tokens( array $tokens ): void {
	$record = [
		'access_token'  => $tokens['access_token'],
		'refresh_token' => $tokens['refresh_token'],
		'expires_at'    => time() + (int) $tokens['expires_in'],
	];
	update_option( 'mighty_tokens', mighty_encrypt( wp_json_encode( $record ) ), false );
}

function mighty_load_tokens(): ?array {
	$stored = get_option( 'mighty_tokens' );
	if ( ! $stored ) {
		return null;
	}
	$json = mighty_decrypt( $stored );
	return $json ? json_decode( $json, true ) : null;
}

add_action( 'admin_menu', function () {
	add_options_page( 'Mighty Networks', 'Mighty Networks', 'manage_options', 'mighty-networks', 'mighty_render_settings_page' );
} );

function mighty_render_settings_page(): void {
	$connected = null !== mighty_load_tokens();
	?>
	<div class="wrap">
		<h1>Mighty Networks</h1>
		<p><?php echo $connected ? 'Connected to ' . esc_html( MIGHTY_NETWORK_SUBDOMAIN ) . '.' : 'Not connected.'; ?></p>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="mighty_connect">
			<?php wp_nonce_field( 'mighty_connect' ); ?>
			<?php submit_button( $connected ? 'Reconnect' : 'Connect to Mighty Networks', 'primary', 'submit', false ); ?>
		</form>
		<?php if ( $connected ) : ?>
			<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" style="margin-top: 1em;">
				<input type="hidden" name="action" value="mighty_disconnect">
				<?php wp_nonce_field( 'mighty_disconnect' ); ?>
				<?php submit_button( 'Disconnect', 'secondary', 'submit', false ); ?>
			</form>
		<?php endif; ?>
	</div>
	<?php
}

add_action( 'admin_post_mighty_connect', function () {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( 'You do not have permission to do this.', 403 );
	}
	check_admin_referer( 'mighty_connect' );

	$state    = mighty_base64url( random_bytes( 32 ) );
	$verifier = mighty_base64url( random_bytes( 32 ) );

	set_transient( 'mighty_oauth_' . $state, [
		'verifier' => $verifier,
		'user_id'  => get_current_user_id(),
	], 10 * MINUTE_IN_SECONDS );

	setcookie( 'mighty_oauth_state', $state, [
		'expires'  => time() + 10 * MINUTE_IN_SECONDS,
		'path'     => '/',
		'secure'   => true,
		'httponly' => true,
		'samesite' => 'Lax',
	] );

	$params = [
		'response_type'         => 'code',
		'client_id'             => MIGHTY_CLIENT_ID,
		'redirect_uri'          => mighty_redirect_uri(),
		'scope'                 => 'read:network',
		'state'                 => $state,
		'code_challenge'        => mighty_base64url( hash( 'sha256', $verifier, true ) ),
		'code_challenge_method' => 'S256',
	];

	wp_redirect( mighty_oauth_url( '/oauth/authorize' ) . '?' . http_build_query( $params, '', '&', PHP_QUERY_RFC3986 ) );
	exit;
} );

add_action( 'rest_api_init', function () {
	register_rest_route( 'mighty/v1', '/oauth/callback', [
		'methods'             => 'GET',
		'callback'            => 'mighty_oauth_callback',
		'permission_callback' => '__return_true', // Checked against state below.
	] );
} );

function mighty_oauth_callback( WP_REST_Request $request ) {
	$state  = (string) $request->get_param( 'state' );
	$cookie = (string) ( $_COOKIE['mighty_oauth_state'] ?? '' );
	$saved  = '' !== $state ? get_transient( 'mighty_oauth_' . $state ) : false;

	if ( ! $saved || ! hash_equals( $cookie, $state ) || ! user_can( $saved['user_id'], 'manage_options' ) ) {
		return new WP_Error( 'mighty_invalid_state', 'This sign-in link is invalid or expired. Start again from Settings.', [ 'status' => 400 ] );
	}

	// state is single use.
	delete_transient( 'mighty_oauth_' . $state );
	setcookie( 'mighty_oauth_state', '', [ 'expires' => time() - HOUR_IN_SECONDS, 'path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'Lax' ] );

	if ( $request->get_param( 'error' ) ) {
		return new WP_Error( 'mighty_denied', 'The connection was not approved.', [ 'status' => 400 ] );
	}
	if ( $request->get_param( 'iss' ) !== mighty_issuer() ) {
		return new WP_Error( 'mighty_invalid_issuer', 'Unexpected authorization server.', [ 'status' => 400 ] );
	}

	$response = wp_remote_post( mighty_oauth_url( '/oauth/token' ), [
		'headers' => [ 'User-Agent' => mighty_user_agent() ],
		'body'    => [
			'grant_type'    => 'authorization_code',
			'code'          => (string) $request->get_param( 'code' ),
			'redirect_uri'  => mighty_redirect_uri(),
			'client_id'     => MIGHTY_CLIENT_ID,
			'client_secret' => MIGHTY_CLIENT_SECRET,
			'code_verifier' => $saved['verifier'],
		],
	] );

	if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
		return new WP_Error( 'mighty_token_exchange_failed', 'Could not complete the connection.', [ 'status' => 502 ] );
	}

	mighty_save_tokens( json_decode( wp_remote_retrieve_body( $response ), true ) );

	return new WP_REST_Response( null, 302, [ 'Location' => admin_url( 'options-general.php?page=mighty-networks' ) ] );
}

function mighty_access_token(): ?string {
	$tokens = mighty_load_tokens();
	if ( ! $tokens ) {
		return null;
	}
	if ( $tokens['expires_at'] > time() + 60 ) {
		return $tokens['access_token'];
	}

	global $wpdb;

	// Each attempt gets its own lock value, so releasing the lock later can confirm
	// this process still owns it instead of deleting someone else's live lock.
	$lock = time() . ':' . wp_generate_password( 12, false );

	// INSERT IGNORE only inserts when no row exists yet, so exactly one request wins the lock.
	$acquired = $wpdb->query( $wpdb->prepare(
		"INSERT IGNORE INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')",
		'mighty_refresh_lock',
		$lock
	) );

	if ( 1 !== $acquired ) {
		$current_lock = get_option( 'mighty_refresh_lock' );
		if ( $current_lock && time() - (int) strtok( $current_lock, ':' ) < 30 ) {
			return null; // Another request is refreshing.
		}

		// The lock is stale. Delete it only if it's still the same stale row, then retry once.
		$wpdb->query( $wpdb->prepare(
			"DELETE FROM {$wpdb->options} WHERE option_name = %s AND CAST( SUBSTRING_INDEX( option_value, ':', 1 ) AS UNSIGNED ) < %d",
			'mighty_refresh_lock',
			time() - 30
		) );
		wp_cache_delete( 'mighty_refresh_lock', 'options' );

		$lock     = time() . ':' . wp_generate_password( 12, false );
		$acquired = $wpdb->query( $wpdb->prepare(
			"INSERT IGNORE INTO {$wpdb->options} (option_name, option_value, autoload) VALUES (%s, %s, 'no')",
			'mighty_refresh_lock',
			$lock
		) );
		if ( 1 !== $acquired ) {
			return null; // Lost the retry to another request.
		}
	}

	try {
		// Another request may have refreshed while this one waited for the lock.
		wp_cache_delete( 'mighty_tokens', 'options' );
		$tokens = mighty_load_tokens();
		if ( ! $tokens ) {
			return null;
		}
		if ( $tokens['expires_at'] > time() + 60 ) {
			return $tokens['access_token'];
		}

		$response = wp_remote_post( mighty_oauth_url( '/oauth/token' ), [
			'timeout' => 10,
			'headers' => [ 'User-Agent' => mighty_user_agent() ],
			'body'    => [
				'grant_type'    => 'refresh_token',
				'refresh_token' => $tokens['refresh_token'],
				'client_id'     => MIGHTY_CLIENT_ID,
				'client_secret' => MIGHTY_CLIENT_SECRET,
			],
		] );
		if ( is_wp_error( $response ) ) {
			return null;
		}

		$body = json_decode( wp_remote_retrieve_body( $response ), true );
		if ( 200 === wp_remote_retrieve_response_code( $response ) ) {
			$body['refresh_token'] = $body['refresh_token'] ?? $tokens['refresh_token'];
			mighty_save_tokens( $body );
			return $body['access_token'];
		}
		if ( 'invalid_grant' === ( $body['error'] ?? '' ) ) {
			// Another request may have already refreshed with this same refresh token.
			wp_cache_delete( 'mighty_tokens', 'options' );
			$current = mighty_load_tokens();
			if ( $current && $current['refresh_token'] === $tokens['refresh_token'] ) {
				delete_option( 'mighty_tokens' ); // An administrator must connect again.
			}
		}
		return null;
	} finally {
		// Match on the exact lock value this process inserted, so a refresh that outlives
		// the stale window releases only its own lock, never one a later request took over.
		if ( $acquired ) {
			$wpdb->query( $wpdb->prepare(
				"DELETE FROM {$wpdb->options} WHERE option_name = %s AND option_value = %s",
				'mighty_refresh_lock',
				$lock
			) );
			wp_cache_delete( 'mighty_refresh_lock', 'options' );
		}
	}
}

add_action( 'admin_post_mighty_disconnect', function () {
	if ( ! current_user_can( 'manage_options' ) ) {
		wp_die( 'You do not have permission to do this.', 403 );
	}
	check_admin_referer( 'mighty_disconnect' );

	$tokens = mighty_load_tokens();
	if ( $tokens ) {
		wp_remote_post( mighty_oauth_url( '/oauth/revoke' ), [
			'headers' => [ 'User-Agent' => mighty_user_agent() ],
			'body'    => [
				'token'         => $tokens['refresh_token'],
				'client_id'     => MIGHTY_CLIENT_ID,
				'client_secret' => MIGHTY_CLIENT_SECRET,
			],
		] );
	}
	delete_option( 'mighty_tokens' );

	wp_redirect( admin_url( 'options-general.php?page=mighty-networks' ) );
	exit;
} );

function mighty_graphql( string $query, array $variables = [] ): ?array {
	$token = mighty_access_token();
	if ( ! $token ) {
		return null;
	}

	$response = wp_remote_post( 'https://api.mn.co/networks/' . MIGHTY_NETWORK_SUBDOMAIN . '/graphql', [
		'timeout' => 10,
		'headers' => [
			'Authorization' => 'Bearer ' . $token,
			'Content-Type'  => 'application/json',
			'User-Agent'    => mighty_user_agent(),
		],
		'body'    => wp_json_encode( [ 'query' => $query, 'variables' => (object) $variables ] ),
	] );

	if ( is_wp_error( $response ) ) {
		error_log( 'Mighty API request failed: ' . $response->get_error_message() );
		return null;
	}

	$status = wp_remote_retrieve_response_code( $response );
	if ( 200 !== $status ) {
		error_log( 'Mighty API request failed with status ' . $status );
		return null;
	}

	$payload = json_decode( wp_remote_retrieve_body( $response ), true );
	if ( ! empty( $payload['errors'] ) ) {
		error_log( 'Mighty API errors: ' . wp_json_encode( $payload['errors'] ) );
		return null;
	}
	return $payload['data'] ?? null;
}

function mighty_cached_query( string $query, array $variables = [] ): ?array {
	$version    = (int) get_option( 'mighty_cache_version', 1 );
	$query_key  = md5( $query . wp_json_encode( $variables ) );
	$cache_key  = 'mighty_' . $version . '_' . $query_key;
	$last_good  = 'mighty_last_good_' . $query_key;

	$cached = get_transient( $cache_key );
	if ( false !== $cached ) {
		return $cached;
	}

	$data = mighty_graphql( $query, $variables );
	if ( null === $data ) {
		// Serve the last successful result, however old, rather than showing nothing.
		$fallback = get_option( $last_good );
		return false !== $fallback ? $fallback : null;
	}

	set_transient( $cache_key, $data, 15 * MINUTE_IN_SECONDS );
	update_option( $last_good, $data, false );
	return $data;
}

const MIGHTY_EVENTS_QUERY = <<<'GRAPHQL'
query UpcomingEvents($spaceId: ID, $perPage: Int) {
  network {
    events(direction: UPCOMING, spaceId: $spaceId, perPage: $perPage) {
      id
      title
      startsAt
      url
    }
  }
}
GRAPHQL;

add_shortcode( 'mighty_events', function ( $atts ) {
	$atts = shortcode_atts( [ 'space' => '', 'limit' => 5 ], $atts );
	$data = mighty_cached_query( MIGHTY_EVENTS_QUERY, [
		'spaceId' => $atts['space'] ?: null,
		'perPage' => min( 50, max( 1, (int) $atts['limit'] ) ),
	] );

	if ( null === $data ) {
		return ''; // The API call failed and no cached copy exists.
	}

	$events = $data['network']['events'] ?? [];
	if ( ! $events ) {
		return '<p>No upcoming events.</p>';
	}

	$format = get_option( 'date_format' ) . ' ' . get_option( 'time_format' );
	$html   = '<ul class="mighty-events">';
	foreach ( $events as $event ) {
		$when  = $event['startsAt'] ? wp_date( $format, strtotime( $event['startsAt'] ) ) : '';
		$html .= sprintf(
			'<li><a href="%s">%s</a> <time datetime="%s">%s</time></li>',
			esc_url( $event['url'] ),
			esc_html( $event['title'] ?: 'Untitled event' ),
			esc_attr( $event['startsAt'] ?? '' ),
			esc_html( $when )
		);
	}
	return $html . '</ul>';
} );

const MIGHTY_POSTS_QUERY = <<<'GRAPHQL'
query RecentPosts($spaceId: ID, $first: Int) {
  network {
    posts(spaceId: $spaceId, first: $first, postTypes: [POST, ARTICLE]) {
      nodes {
        ... on Post {
          id
          title
          bodyText
          imageUrl
          publishedAt
          url
          creator {
            name
          }
        }
      }
    }
  }
}
GRAPHQL;

add_shortcode( 'mighty_posts', function ( $atts ) {
	$atts = shortcode_atts( [ 'space' => '', 'limit' => 5 ], $atts );
	$data = mighty_cached_query( MIGHTY_POSTS_QUERY, [
		'spaceId' => $atts['space'] ?: null,
		'first'   => min( 50, max( 1, (int) $atts['limit'] ) ),
	] );

	if ( null === $data ) {
		return ''; // The API call failed and no cached copy exists.
	}

	$posts = array_filter( $data['network']['posts']['nodes'] ?? [] );
	if ( ! $posts ) {
		return '<p>No posts yet.</p>';
	}

	$html = '<div class="mighty-posts">';
	foreach ( $posts as $post ) {
		$html .= '<article class="mighty-post">';
		if ( ! empty( $post['imageUrl'] ) ) {
			$html .= sprintf( '<img src="%s" alt="" loading="lazy">', esc_url( $post['imageUrl'] ) );
		}
		$html .= sprintf(
			'<h3><a href="%s">%s</a></h3><p class="mighty-post-meta">%s</p><p>%s</p>',
			esc_url( $post['url'] ),
			esc_html( $post['title'] ?: 'Untitled post' ),
			esc_html( $post['creator']['name'] ?? '' ),
			esc_html( wp_trim_words( $post['bodyText'] ?? '', 40 ) )
		);
		$html .= '</article>';
	}
	return $html . '</div>';
} );

add_action( 'rest_api_init', function () {
	register_rest_route( 'mighty/v1', '/webhook', [
		'methods'             => 'POST',
		'callback'            => function () {
			update_option( 'mighty_cache_version', (int) get_option( 'mighty_cache_version', 1 ) + 1, false );
			return new WP_REST_Response( null, 204 );
		},
		'permission_callback' => function ( WP_REST_Request $request ) {
			$header = (string) $request->get_header( 'authorization' );
			return hash_equals( 'Bearer ' . MIGHTY_WEBHOOK_SECRET, $header );
		},
	] );
} );