Change download URL for ACF Pro

[mcaskill]

This pull request supersedes:

• Change the ACF downloads API and add support for add-ons  junaidbhura/composer-wp-pro-plugins#22 by @mcaskill
• Change download URL for ACFPro junaidbhura/composer-wp-pro-plugins#70 by @Spidlace

Checklist:

• I've read the Contributing page.
• Spidlace created an issue: Download URL for ACFPro change junaidbhura/composer-wp-pro-plugins#71
• My code is tested.
• My code follows the WordPress code style.
• My code has proper inline documentation.

Description

The current API URI, ?p=pro&a=download&k=%ACF_PRO_KEY%&t=%version%, has recently been abandoned in favour of: /v2/plugins/download?p=pro&k=%ACF_PRO_KEY%&t=%version%.

How has this been tested?

Independently tested by @Spidlace and I.

[mcaskill]

@Spidlace Does the new URL work for you through Composer?

I'm getting the following error every time:

The "https://connect.advancedcustomfields.com/v2/plugins/download?p=pro&k=***&t=6.3.3" file could not be downloaded (HTTP/2 400)

❯ composer diagnose
Composer version: 2.7.7
PHP version: 7.4.33
PHP binary path: …/[email protected]/7.4.33_6/bin/php
OpenSSL version: OpenSSL 3.2.1 30 Jan 2024
curl version: 8.8.0 libz 1.2.12 ssl (SecureTransport) OpenSSL/3.3.1

❯ curl --version
curl 8.8.0 (aarch64-apple-darwin23.4.0) libcurl/8.8.0 (SecureTransport) OpenSSL/3.3.1

When using cURL directly, it works fine.

This was not an issue for me when I originally introduced the pull request in 2020.

[mcaskill]

The issue is caused by the User-Agent used by Composer:

❯ curl -I -A 'Composer/2.7.7' 'https://connect.advancedcustomfields.com/v2/plugins/download?p=pro&k=***&t=6.3.3'
HTTP/2 400
date: Fri, 12 Jul 2024 14:41:03 GMT
content-type: text/html
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
set-cookie: __cf_bm=***; path=/; expires=***; domain=.advancedcustomfields.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: ***

It's expecting one is using their Composer repository which requires HTTP Authentication.

Furthermore, even if you provide authentication as per ACF's API credentials, that download URL will not work.

curl -I -A 'Composer/2.7.7' -u '***:https://…' --basic 'https://connect.advancedcustomfields.com/v2/plugins/download?p=pro&k=***&t=6.3.3'

It will work if you provide authentication with their Composer repository URL:

curl -I -A 'Composer/2.7.7' -u '***:https://…' --basic 'https://connect.advancedcustomfields.com/v2/plugins/composer_download?p=pro&t=6.3.3'
HTTP/2 200

~~I have submitted a support ticket with ACF/WPEngine to see if this can be fixed.

If the new URL is no longer available for our usage, we could change the URL to the latter and instruct users to add auth.json. In such a case, I would rather recommend deprecating ACF Pro support and instruct users move to ACF's official Composer repository.~~

See comment on junaidbhura/composer-wp-pro-plugins#71:

I recently contacted ACF Pro's vendor (WPEngine, at the time of writing). Important changes have occurred and more are in the works:

1. The URL for the ACF Pro example (/index.php?p=pro&a=download&k=***&t=X.Y.Z) is obsolete.
2. The new URL (/v2/plugins/download?p=pro&k=***&t=X.Y.Z) does not work with Composer (because the server checks the User-Agent for Composer for its Composer repository).
3. In the coming months, the vendor is changing its API to use server generated single-use URLs.
4. Even the URLs from the official Composer repository (/v2/plugins/composer_download?p=pro&t=X.Y.Z) will eventually adopt single-use URLs.