add-showcase-submission.php

add_action('graphql_register_types', function() {
	register_graphql_mutation('submitShowcaseSiteFromPublicUser', [
		'description' => __('Allow unauthenticated users to submit sites to the showcase, with limited fields.'),
		'inputFields' => [
			'title' => [
				'type' => ['non_null' => 'String'],
			],
			'mainUrl' => [
				'type' => ['non_null' => 'String'],
			],
			'description' => [
				'type' => 'String',
			],
			'categoryIds' => [
				'type' => ['list_of' => 'Int'],
			],
			'builtByUrl' => [
				'type' => 'String',
			],
			'builtBy' => [
				'type' => 'String',
			],
			'sourceUrl' => [
				'type' => 'String',
			],
			'contactEmail' => [
				'type' => 'String',
			],
		],
		'outputFields' => [
			'success' => [
				'type' => 'Boolean',
				'description' => __('Whether or not the submission succeeded.'),
			],
			'messages' => [
				'type' => ['list_of' => 'String'],
				'description' => __('Messages or errors upon submission.')
			]
		],
		'mutateAndGetPayload' => function( $input, $context, $info ) {
			$success = false;
			$messages = [];
			// Do any logic here to sanitize the input, check user capabilities, etc
			if ( empty( $input['title'] ) ) {
				$messages[] = 'Title is empty';
			}
			// more validations...
			// TODO
			
			// check if there were no error messages
			if (empty($messages)) {
				$success = true;
			}
			
			// create post if successful
			if ($success == true) {
				$post_id = wp_insert_post([
					'post_type' => 'sites',
					'post_title' => sanitize_text_field($input['title']),
					'post_status' => 'pending',
					'tax_input' => isset($input['categoryIds']) ? ['category', $input['categoryIds']] : [],
				]);
				// put all ACF fields here, they aren't included above
				update_field('title', sanitize_text_field($input['title']), $post_id);
				update_field('main_url', sanitize_text_field($input['mainUrl']), $post_id);
				update_field('description', sanitize_text_field($input['description']), $post_id);
				update_field('built_by_url', sanitize_text_field($input['builtByUrl']), $post_id);
				update_field('built_by', sanitize_text_field($input['builtBy']), $post_id);
				update_field('source_url', sanitize_text_field($input['sourceUrl']), $post_id);
				update_field('contact_email', sanitize_text_field($input['contactEmail']), $post_id);
			}
			
			return [
				'success' => $success,
				'messages' => $messages
			];
		}
	]);
});