Premium Content / Subscriptions: introduce Paid Newsletter functionality

projects/plugins/jetpack/changelog/add-post-visibility-setting

@@ -0,0 +1,10 @@
+Significance: major
+Type: enhancement
+
+Entire posts can now be restricted to either paid subscribers, or email subscribers. This will enable site owners to:
+- reward their paying subscribers with secret Lasagna recipes
+- create paid-only issues of their newsletters
+- create incentives and landing pages to gain subscribers
+- create paid courses, and pursue other subscriber-only models
+- support themselves financially without sacrificing creative freedom
+- buy literal jetpacks from all the money they make on their sites (outcome not guaranteed)

projects/plugins/jetpack/changelog/fix-premium-jwt-encode

@@ -0,0 +1,4 @@
+Significance: patch
+Type: bugfix
+
+Premium-content block is shipped with a JWT lib that had a bug in its encode() method

projects/plugins/jetpack/changelog/subscriptions-paid-newsletter

@@ -0,0 +1,6 @@
+Significance: major
+Type: enhancement
+
+Paid Newsletter functionality:
+If the site owner creates one or more "newsletter" paid plans available for purchase, subscribers will be given an option to pay while subscribing through the subscribe block.
+This change goes together with ./add-post-visibility-setting to create a paid newsletter functionality.

projects/plugins/jetpack/extensions/blocks/premium-content/_inc/subscription-service/class-jwt.php

@@ -193,12 +193,12 @@ public static function encode( $payload, $key, $alg = 'HS256', $key_id = null, $
 		}
 
 		$segments      = array();
-		$segments[]    = static::urlsafe_b64_decode( static::json_encode( $header ) );
-		$segments[]    = static::urlsafe_b64_decode( static::json_encode( $payload ) );
+		$segments[]    = static::urlsafe_b64_encode( static::json_encode( $header ) );
+		$segments[]    = static::urlsafe_b64_encode( static::json_encode( $payload ) );
 		$signing_input = implode( '.', $segments );
 
 		$signature  = static::sign( $signing_input, $key, $alg );
-		$segments[] = static::urlsafe_b64_decode( $signature );
+		$segments[] = static::urlsafe_b64_encode( $signature );
 
 		return implode( '.', $segments );
 	}

projects/plugins/jetpack/extensions/blocks/premium-content/_inc/subscription-service/class-subscription-service.php

@@ -41,11 +41,12 @@ public function initialize();
 	 * Given a token (this could be from a cookie, a querystring, or some other means)
 	 * can the visitor see the premium content?
 	 *
-	 * @param array $valid_plan_ids .
+	 * @param array  $valid_plan_ids .
+	 * @param string $access_level   .
 	 *
 	 * @return boolean
 	 */
-	public function visitor_can_view_content( $valid_plan_ids );
+	public function visitor_can_view_content( $valid_plan_ids, $access_level );
 
 	/**
 	 * The current visitor would like to obtain access. Where do they go?

projects/plugins/jetpack/extensions/blocks/premium-content/_inc/subscription-service/class-token-subscription-service.php

@@ -17,10 +17,13 @@
  */
 abstract class Token_Subscription_Service implements Subscription_Service {
 
-	const JWT_AUTH_TOKEN_COOKIE_NAME = 'jp-premium-content-session';
-	const DECODE_EXCEPTION_FEATURE   = 'memberships';
-	const DECODE_EXCEPTION_MESSAGE   = 'Problem decoding provided token';
-	const REST_URL_ORIGIN            = 'https://subscribe.wordpress.com/';
+	const JWT_AUTH_TOKEN_COOKIE_NAME    = 'jp-premium-content-session';
+	const DECODE_EXCEPTION_FEATURE      = 'memberships';
+	const DECODE_EXCEPTION_MESSAGE      = 'Problem decoding provided token';
+	const REST_URL_ORIGIN               = 'https://subscribe.wordpress.com/';
+	const BLOG_SUB_ACTIVE               = 'active';
+	const BLOG_SUB_PENDING              = 'pending';
+	const POST_ACCESS_LEVEL_SUBSCRIBERS = 'subscribers';
 
 	/**
 	 * Initialize the token subscription service.
@@ -46,8 +49,9 @@ public function initialize() {
 	 * @inheritDoc
 	 *
 	 * @param array $valid_plan_ids List of valid plan IDs.
+	 * @param array $access_level Access level for content.
 	 */
-	public function visitor_can_view_content( $valid_plan_ids ) {
+	public function visitor_can_view_content( $valid_plan_ids, $access_level ) {
 
 		// URL token always has a precedence, so it can overwrite the cookie when new data available.
 		$token = $this->token_from_request();
@@ -70,40 +74,63 @@ public function visitor_can_view_content( $valid_plan_ids ) {
 		}
 
 		if ( $is_valid_token ) {
-			$subscriptions = (array) $payload['subscriptions'];
-		} elseif ( is_user_logged_in() ) {
-			/*
-			 * If there is no token, but the user is logged in,
-			 * get current subscriptions and determine if the user has
-			 * a valid subscription to match the plan ID.
-			 */
-
 			/**
-			 * Filter the subscriptions attached to a specific user on a given site.
-			 *
-			 * @since 9.4.0
+			 * Allow access to the content if:
 			 *
-			 * @param array $subscriptions Array of subscriptions.
-			 * @param int   $user_id The user's ID.
-			 * @param int   $site_id ID of the current site.
+			 * Active: user has a valid subscription
+			 * Pending: user has subscribed to a free plan
 			 */
-			$subscriptions = apply_filters(
-				'earn_get_user_subscriptions_for_site_id',
-				array(),
-				wp_get_current_user()->ID,
-				$this->get_site_id()
+			$is_blog_subscriber = in_array(
+				$payload['blog_sub'],
+				array(
+					self::BLOG_SUB_ACTIVE,
+					self::BLOG_SUB_PENDING,
+				),
+				true
 			);
-
-			if ( empty( $subscriptions ) ) {
-				return false;
-			}
-			// format the subscriptions so that they can be validated.
-			$subscriptions = self::abbreviate_subscriptions( $subscriptions );
+			$subscriptions      = (array) $payload['subscriptions'];
+			$is_paid_subscriber = $this->validate_subscriptions( $valid_plan_ids, $subscriptions );
 		} else {
-			return false;
+			// Token not valid. We bail even unless the post can be accessed publicly.
+			return $this->user_has_access( $access_level, false, false, get_the_ID() );
 		}
 
-		return $this->validate_subscriptions( $valid_plan_ids, $subscriptions );
+		return $this->user_has_access( $access_level, $is_blog_subscriber, $is_paid_subscriber, get_the_ID() );
+	}
+
+	/**
+	 * Return if the user has access to the content depending on the access level and the user rights
+	 *
+	 * @param string $access_level Post or blog access level.
+	 * @param bool   $is_blog_subscriber Is user a subscriber of the blog.
+	 * @param bool   $is_paid_subscriber Is user a paid subscriber of the blog.
+	 * @param int    $post_id Post ID.
+	 *
+	 * @return bool does the user have access to the post/blog.
+	 */
+	protected function user_has_access( $access_level, $is_blog_subscriber, $is_paid_subscriber, $post_id ) {
+
+		if ( is_user_logged_in() && current_user_can( 'edit_post', $post_id ) ) {
+			// Admin has access
+			return true;
+		}
+
+		if ( empty( $access_level ) || $access_level === 'everybody' ) {
+			// empty level means the post is not gated for paid users
+			return true;
+		}
+
+		if ( $access_level === 'subscribers' ) {
+			return $is_blog_subscriber || $is_paid_subscriber;
+		}
+
+		if ( $access_level === 'paid_subscribers' ) {
+			return $is_paid_subscriber;
+		}
+
+		// This should not be a use case
+		return false;
+
 	}
 
 	/**
@@ -129,13 +156,6 @@ public function decode_token( $token ) {
 	 */
 	abstract public function get_key();
 
-	/**
-	 * Get the ID of the current site.
-	 *
-	 * @return int
-	 */
-	abstract public function get_site_id();
-
 	// phpcs:disable
 	/**
 	 * Get the URL to access the protected content.
@@ -173,6 +193,10 @@ private function token_from_cookie() {
 	 * @return void
 	 */
 	private function set_token_cookie( $token ) {
+		if ( defined( 'TESTING_IN_JETPACK' ) && TESTING_IN_JETPACK ) {
+			return;
+		}
+
 		if ( ! empty( $token ) ) {
 			setcookie( self::JWT_AUTH_TOKEN_COOKIE_NAME, $token, 0, '/', COOKIE_DOMAIN, is_ssl(), true ); // httponly -- used by visitor_can_view_content() within the PHP context.
 		}
@@ -205,7 +229,7 @@ private function token_from_request() {
 	 *
 	 * @return bool
 	 */
-	protected function validate_subscriptions( $valid_plan_ids, $token_subscriptions ) {
+	public static function validate_subscriptions( $valid_plan_ids, $token_subscriptions ) {
 		// Create a list of product_ids to compare against.
 		$product_ids = array();
 		foreach ( $valid_plan_ids as $plan_id ) {
@@ -214,9 +238,8 @@ protected function validate_subscriptions( $valid_plan_ids, $token_subscriptions
 				$product_ids[] = $product_id;
 			}
 		}
-
 		foreach ( $token_subscriptions as $product_id => $token_subscription ) {
-			if ( in_array( $product_id, $product_ids, true ) ) {
+			if ( in_array( intval( $product_id ), $product_ids, true ) ) {
 				$end = is_int( $token_subscription->end_date ) ? $token_subscription->end_date : strtotime( $token_subscription->end_date );
 				if ( $end > time() ) {
 					return true;
@@ -247,6 +270,11 @@ private function get_rest_api_token_url( $site_id, $redirect_url ) {
 	 * @return array<int, array>
 	 */
 	public static function abbreviate_subscriptions( $subscriptions_from_bd ) {
+
+		if ( empty( $subscriptions_from_bd ) ) {
+			return array();
+		}
+
 		$subscriptions = array();
 		foreach ( $subscriptions_from_bd as $subscription ) {
 			// We are picking the expiry date that is the most in the future.

projects/plugins/jetpack/extensions/blocks/premium-content/_inc/subscription-service/class-unconfigured-subscription-service.php

@@ -39,9 +39,10 @@ public function initialize() {
 	/**
 	 * No subscription service available, no users can see this content.
 	 *
-	 * @param array $valid_plan_ids .
+	 * @param array  $valid_plan_ids .
+	 * @param string $access_level   .
 	 */
-	public function visitor_can_view_content( $valid_plan_ids ) {
+	public function visitor_can_view_content( $valid_plan_ids, $access_level ) {
 		return false;
 	}
 

projects/plugins/jetpack/extensions/blocks/premium-content/_inc/subscription-service/class-wpcom-offline-subscription-service.php

@@ -1,10 +1,6 @@
 <?php
 /**
- * This subscription service is used when a subscriber is offline and a token is not available.
- * This subscription service will be used when rendering content in email and reader on WPCOM only.
- * When content is being rendered, the current user and site are set.
- * This allows us to lookup a users subscriptions and determine if the
- * offline visitor can view content that has been deemed "Premium content".
+ * This subscription service is used when a subscriber is online
  *
  * @package Automattic\Jetpack\Extensions\Premium_Content
  */
@@ -13,65 +9,50 @@
 
 /**
  * Class WPCOM_Offline_Subscription_Service
+ * This subscription service is used when a subscriber is offline and a token is not available.
+ * This subscription service will be used when sending emails to subscribers
  *
  * @package Automattic\Jetpack\Extensions\Premium_Content\Subscription_Service
  */
-class WPCOM_Offline_Subscription_Service extends WPCOM_Token_Subscription_Service {
+class WPCOM_Offline_Subscription_Service extends WPCOM_Online_Subscription_Service {
 
 	/**
 	 * Is available()
 	 *
 	 * @return bool
 	 */
 	public static function available() {
-		// Return available if the user is logged in and either
-		// running a job (sending email subscription) OR
-		// handling API request on WPCOM (reader).
-		return (
-			( defined( 'WPCOM_JOBS' ) && WPCOM_JOBS ) ||
-			( defined( 'IS_WPCOM' ) && IS_WPCOM === true && ( defined( 'REST_API_REQUEST' ) && REST_API_REQUEST ) )
-			) && is_user_logged_in();
+		// Return available if the user is logged in and we are on WPCOM.
+		return false;
 	}
 
 	/**
-	 * Lookup users subscriptions for a site and determine if the user has a valid subscription to match the plan ID
+	 * Check if the subscriber can receive the newsletter.
+	 * This is the only method where is user does not need to be logged in.
+	 *
+	 * @param int $user_id User id.
+	 * @param int $post_id Post id.
 	 *
-	 * @param array $valid_plan_ids .
 	 * @return bool
+	 * @throws \Exception Throws an exception when used outside of WPCOM.
 	 */
-	public function visitor_can_view_content( $valid_plan_ids ) {
-		/** This filter is already documented in projects/plugins/jetpack/extensions/blocks/premium-content/_inc/subscription-service/class-token-subscription-service.php */
-		$subscriptions = apply_filters( 'earn_get_user_subscriptions_for_site_id', array(), wp_get_current_user()->ID, $this->get_site_id() );
-		if ( empty( $subscriptions ) ) {
+	public function subscriber_can_receive_post_by_mail( $user_id, $post_id ) {
+
+		if ( 0 === $user_id || empty( $user_id ) ) {
+			// Email cannot be sent to non-users
 			return false;
 		}
-		// format the subscriptions so that they can be validated.
-		$subscriptions = self::abbreviate_subscriptions( $subscriptions );
-		return $this->validate_subscriptions( $valid_plan_ids, $subscriptions );
-	}
 
-	/**
-	 * Report the subscriptions as an ID => [ 'end_date' => ]. mapping
-	 *
-	 * @param array $subscriptions_from_bd .
-	 *
-	 * @return array<int, array>
-	 */
-	public static function abbreviate_subscriptions( $subscriptions_from_bd ) {
-		$subscriptions = array();
-		foreach ( $subscriptions_from_bd as $subscription ) {
-			// We are picking the expiry date that is the most in the future.
-			if (
-				'active' === $subscription['status'] && (
-					! isset( $subscriptions[ $subscription['product_id'] ] ) ||
-					empty( $subscription['end_date'] ) || // Special condition when subscription has no expiry date - we will default to a year from now for the purposes of the token.
-					strtotime( $subscription['end_date'] ) > strtotime( (string) $subscriptions[ $subscription['product_id'] ]->end_date )
-				)
-			) {
-				$subscriptions[ $subscription['product_id'] ]           = new \stdClass();
-				$subscriptions[ $subscription['product_id'] ]->end_date = empty( $subscription['end_date'] ) ? ( time() + 365 * 24 * 3600 ) : $subscription['end_date'];
-			}
-		}
-		return $subscriptions;
+		$previous_user = wp_get_current_user();
+		wp_set_current_user( $user_id );
+
+		$access_level       = get_post_meta( $post_id, '_jetpack_newsletter_access', true );
+		$valid_plan_ids     = \Jetpack_Memberships::get_all_plans_id_jetpack_recurring_payments();
+		$is_blog_subscriber = true; // it is a subscriber as this is used in async when lopping through subscribers...
+		$allowed            = $this->user_can_view_content( $valid_plan_ids, $access_level, $is_blog_subscriber, $post_id );
+
+		wp_set_current_user( $previous_user->ID );
+
+		return $allowed;
 	}
 }