Access Denied Redirect

The AAM_Framework_Service_AccessDeniedRedirect service manages how AAM responds when access to a protected resource is denied.

This service allows developers to define custom behaviors for different application areas:

• Frontend
• WordPress backend
• REST/API requests

Typical use cases include:

• Redirecting unauthorized users to a login page
• Redirecting users to a custom URL
• Showing a custom message
• Executing a callback
• Returning default WordPress behavior

# Definition

class AAM_Framework_Service_AccessDeniedRedirect {

    public set_redirect(string $area, array $redirect) : bool
    public get_redirect(string $area = null) : array
    public reset(string $area = null) : bool

}

# Supported Areas

The service supports the following areas:

# Supported Redirect Types

The following redirect types are supported:

# Service Methods

# set_redirect

Configure access denied behavior for a specific area.

public function set_redirect(string $area, array $redirect) : bool

# Parameters

# $area

Target application area.

Allowed values:

frontend
backend
api

# $redirect

Redirect configuration array.

The incoming array may contain the following fields:

[
    'type'             => 'string',
    'page_slug'        => 'string',
    'page_id'          => 'numeric',
    'url'              => 'string',
    'callback'         => 'string',
    'message'          => 'string',
    'http_status_code' => 'numeric'
]

# Return Value

# Exceptions

Internally, the service throws an InvalidArgumentException if the $area argument is empty.

# get_redirect

Retrieve configured redirect settings.

public function get_redirect(string $area = null) : array

# Parameters

# $area

Optional target area. If omitted, all configured areas are returned.

# Return Value

# Return Single Area

[
    'type' => 'default'
]

# Return All Areas

[
    'frontend' => [
        'type' => 'default'
    ],
    'backend' => [
        'type' => 'default'
    ],
    'api' => [
        'type' => 'default'
    ]
]

# Default Behavior

If no redirect is configured for a specific area, the service automatically returns:

[
    'type' => 'default'
]

# reset

Reset redirect configuration.

public function reset(string $area = null) : bool

# Parameters

# $area

Optional target area. If omitted, all redirect settings are removed.

# Return Value

# Redirect Configuration Models

# Default Redirect

Use standard AAM/WordPress access denied handling.

[
    'type' => 'default'
]

# Custom Message

Display a custom access denied message.

[
    'type' => 'custom_message',
    'message' => 'You are not allowed to access this resource.'
]

# Internal Page Redirect

Redirect users to a WordPress page.

# Using Page ID

[
    'type' => 'page_redirect',
    'page_id' => 42
]

# Using Page Slug

[
    'type' => 'page_redirect',
    'page_slug' => 'membership-required'
]

# URL Redirect

Redirect users to a custom URL.

[
    'type' => 'url_redirect',
    'url' => 'https://example.com/upgrade-account'
]

Optional HTTP status code:

[
    'type' => 'url_redirect',
    'url' => 'https://example.com/login',
    'http_status_code' => 302
]

# Callback Trigger

Execute a custom PHP callback.

[
    'type' => 'trigger_callback',
    'callback' => 'my_custom_access_denied_handler'
]

Example callback:

function my_custom_access_denied_handler() {
    wp_die('Custom access denied response');
}

# Login Redirect

Redirect unauthorized users to the WordPress login page.

[
    'type' => 'login_redirect'
]

# Usage Examples

# Configure Frontend Redirect

$service = AAM::api()->access_denied_redirect();

$service->set_redirect('frontend', [
    'type' => 'login_redirect'
]);

# Configure Backend Redirect

$service = AAM::api()->access_denied_redirect();

$service->set_redirect('backend', [
    'type' => 'custom_message',
    'message' => 'Administrator access required.'
]);

# Configure API Redirect

$service = AAM::api()->access_denied_redirect();

$service->set_redirect('api', [
    'type' => 'url_redirect',
    'url'  => 'https://example.com/api-access-required'
]);

# Retrieve All Redirect Rules

$service = AAM::api()->access_denied_redirect();

$rules = $service->get_redirect();

# Retrieve Frontend Rule

$frontend = $service->get_redirect('frontend');

# Reset Frontend Redirect

$service->reset('frontend');

# Reset All Redirects

$service->reset();

# Internal Sanitization

The service sanitizes incoming redirect data through:

$this->redirect->sanitize_redirect(...)

Only redirect types listed in ALLOWED_REDIRECT_TYPES are accepted.

# Notes

# Area Validation

Although the class defines allowed areas internally:

frontend
backend
api

the set_redirect() method does not explicitly validate them. Developers should ensure valid area names are used.

# Redirect Model Validation

The service sanitizes redirect data but does not fully validate all fields or field combinations.

For example:

• page_redirect should contain either page_id or page_slug
• url_redirect should contain a valid URL
• trigger_callback should reference a valid callable

Developers are responsible for providing valid configurations.