aurora-wordpress-admin/admin/src/Pages/SubApps.php

<?php
namespace AuroraAdmin\Pages;

use AuroraAdmin\Utility\Assets;

defined("ABSPATH") || exit();

/**
 * Registers Aurora's secondary full-page apps (Menu Creator, Admin Notices,
 * Role Editor, Activity Log, Database Explorer, Plugins, Comments). Each is
 * a real WP admin page (proper capability check, working URL, its own
 * hook_suffix for asset gating) registered as a submenu of "aurora-admin"
 * (or "plugins.php" for the Plugins page).
 *
 * These stay registered in WordPress's own $submenu — they are NOT hidden
 * via remove_submenu_page(). An earlier version did call it (the standard
 * "register but hide" trick), but that turned out to corrupt WP core's own
 * access-control bookkeeping: user_can_access_admin_page() partly relies on
 * $submenu still containing the entry to resolve the page's required
 * capability, so removing it caused every user (including admins) to be
 * denied with "Sorry, you are not allowed to access this page" — confirmed
 * by reproducing the bug, disabling the remove_submenu_page() call, and
 * watching it resolve immediately. Since Aurora already hides WordPress's
 * entire native admin menu chrome (replaced by its own Vue sidebar), a
 * still-registered-but-native-menu-invisible entry has no visible effect on
 * its own — MenuSerializer::serialize() is what keeps these out of the
 * sidebar's own WP-native-menu section (skips slugs prefixed
 * "aurora-admin-", plus the "aurora-admin" top-level slug itself), so they
 * aren't duplicated there. They're presented instead in the sidebar's
 * dedicated Aurora nav section (see Shell::aurora_nav()).
 */
class SubApps
{
  const PAGES = [
    "aurora-admin-menu-creator" => ["title" => "Menu Creator", "entry" => "menu-creator"],
    "aurora-admin-notices" => ["title" => "Admin Notices", "entry" => "admin-notices"],
    "aurora-admin-roles" => ["title" => "Role Editor", "entry" => "role-editor"],
    "aurora-admin-activity-log" => ["title" => "Activity Log", "entry" => "activity-log"],
    "aurora-admin-database" => ["title" => "Database Explorer", "entry" => "database-explorer"],
    "aurora-admin-plugins" => ["title" => "Installed Plugins", "entry" => "plugins"],
    "aurora-admin-comments" => ["title" => "Comments", "entry" => "comments"],
  ];

  private static $hook_suffixes = [];

  public function __construct()
  {
    add_action("admin_menu", [self::class, "register_menus"]);
    add_action("admin_enqueue_scripts", [self::class, "maybe_enqueue"]);
    add_action("admin_init", [self::class, "redirect_native_pages"]);
  }

  public static function register_menus()
  {
    foreach (self::PAGES as $slug => $page) {
      $parent = self::parent_slug($slug);
      $hook = add_submenu_page(
        $parent,
        __($page["title"], "aurora-admin"),
        __($page["title"], "aurora-admin"),
        self::capability($slug),
        $slug,
        [self::class, "render"]
      );
      self::$hook_suffixes[$slug] = $hook;
    }
  }

  private static function parent_slug($slug)
  {
    if ($slug === "aurora-admin-plugins") {
      return "plugins.php";
    }
    return "aurora-admin";
  }

  private static function capability($slug)
  {
    if ($slug === "aurora-admin-plugins") {
      return "activate_plugins";
    }
    if ($slug === "aurora-admin-comments") {
      return "edit_posts";
    }
    return "manage_options";
  }

  public static function maybe_enqueue($hook_suffix)
  {
    $slug = array_search($hook_suffix, self::$hook_suffixes, true);
    if ($slug === false || !isset(self::PAGES[$slug])) {
      return;
    }

    Assets::enqueue("aurora-admin-" . self::PAGES[$slug]["entry"], "entries/" . self::PAGES[$slug]["entry"] . ".js");
  }

  public static function redirect_native_pages()
  {
    global $pagenow;

    if ($pagenow !== "edit-comments.php" || !current_user_can("edit_posts")) {
      return;
    }

    if (isset($_GET["page"]) || wp_doing_ajax()) {
      return;
    }

    wp_safe_redirect(admin_url("admin.php?page=aurora-admin-comments"));
    exit;
  }

  public static function render()
  {
    $page = isset($_GET["page"]) ? sanitize_text_field(wp_unslash($_GET["page"])) : "";
    if (!isset(self::PAGES[$page])) {
      return;
    }

    $roles = [];
    foreach (wp_roles()->roles as $slug => $info) {
      $roles[] = ["value" => $slug, "label" => translate_user_role($info["name"])];
    }

    global $wpdb;

    $data = [
      "restUrl" => esc_url_raw(get_rest_url()),
      "restNonce" => wp_create_nonce("wp_rest"),
      "userName" => wp_get_current_user()->display_name,
      "roles" => $roles,
      "tablePrefix" => $wpdb->prefix,
    ];
    $root_id = "aurora-admin-" . self::PAGES[$page]["entry"] . "-root";
    ?>
    <div
      id="<?php echo esc_attr($root_id); ?>"
      data-aurora-admin="<?php echo esc_attr(wp_json_encode($data)); ?>"
    ></div>
    <?php
  }
}