[Blueprints] Login step – handle passwordless autologin via a PHP mu-plugin #1789
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…op-level declarations
It confused me to see a type like: true | 'not-available' | 'origin-mismatch' All values are truthy so you have to know to compare directly with true. And at that point, it's clearer to use the string literal "available" instead.
Initially, we do this by writing one file at a time in Safari, but we can try doing Safari writes in batches in a subsequent commit.
adamziel
force-pushed
the
trunk
branch
3 times, most recently
from
680cd19 to
2e376d2
Compare
|
I got all the blueprint unit tests to pass locally, but I still need to figure out what's happening with the rest. |
bgrgicak
changed the base branch from
trunk
to
setup-sqlite-integration-without-creating-db-php
bgrgicak
changed the base branch from
setup-sqlite-integration-without-creating-db-php
to
trunk
|
I'm closing this PR in favour of #1856. Because of some recent force pushing to trunk and me merging trunk into this branch, it picked up 300 extra commits. |
bgrgicak
added a commit
that referenced
this pull request
Oct 8, 2024
…plugin (#1856) **This PR was [originally implemented in this branch](#1789 Fixes #1706 ## Motivation for the change, related issues Handles auto login, e.g. in the `login` Blueprint step, using a platform-provided mu-plugin. This enables using the `login` step across all Playground runtimes without any of the issues with the previous implementation. Before this PR, the `login` worked by making HTTP requests to the `/wp-login.php` endpoint. That approach had significant downsides: * It only worked in web browsers * It didn't support custom login mechanisms * It required storing plaintext passwords in the Blueprint files * It broke after a content import if the admin password changed * It broke if WordPress displayed the [Site Admin Email Verification Screen](https://make.wordpress.org/core/2019/10/17/wordpress-5-3-admin-email-verification-screen/). ## Implementation details To fix it and make the login step more robust login now uses a login PHP file that logs in the user with their credentials. The new script only requires a username, the password is now deprecated. There are two ways to trigger the auto-login: ### The `PLAYGROUND_AUTO_LOGIN_AS_USER` constant Used by the `login` Blueprint step does. When the `PLAYGROUND_AUTO_LOGIN_AS_USER` constant is defined, this mu-plugin will automatically log the user in on their first visit. The username is the value of the constant. On subsequent visits, the `playground_auto_login_happened` cookie will be detected and the user will not be logged in. This means the "logout" feature will work as expected. ### The `playground_force_auto_login_as_user` GET parameter Used by the "login" button in various Playground runtimes. When the `playground_force_auto_login_as_user` GET parameter is present, this mu-plugin will automatically log in any logged out visitor. This will happen every time they visit, not just on their first visit. ## Testing Instructions (or ideally a Blueprint) - [Open this blueprint and confirm that login works](http://127.0.0.1:5400/website-server/?import-site=http%3A%2F%2F127.0.0.1%3A5400%2Fwebsite-server%2Ftest-fixtures%2Fsite-with-unpatched-gutenberg.zip&login=yes&url=%2Fwp-admin%2Fpost-new.php) - Open Playground, log out, then navigate to `/?playground_force_auto_login_as_user=admin&` and confirm you were logged in again. cc @brandonpayton – the `/?playground_force_auto_login_as_user=admin` triggers a redirect to add the trailing slash, as in `/?playground_force_auto_login_as_user=admin/`. Let's track that separately.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1706
Motivation for the change, related issues
Handles auto login, e.g. in the
loginBlueprint step, using a platform-provided mu-plugin. This enables using theloginstep across all Playground runtimes without any of the issues with the previous implementation.Before this PR, the
loginworked by making HTTP requests to the/wp-login.phpendpoint. That approach had significant downsides:Implementation details
To fix it and make the login step more robust login now uses a login PHP file that logs in the user with their credentials.
The new script only requires a username, the password is now deprecated.
There are two ways to trigger the auto-login:
The
PLAYGROUND_AUTO_LOGIN_AS_USERconstantUsed by the
loginBlueprint step does.When the
PLAYGROUND_AUTO_LOGIN_AS_USERconstant is defined, this mu-pluginwill automatically log the user in on their first visit. The username is
the value of the constant.
On subsequent visits, the
playground_auto_login_happenedcookie will bedetected and the user will not be logged in. This means the "logout" feature
will work as expected.
The
playground_force_auto_login_as_userGET parameterUsed by the "login" button in various Playground runtimes.
When the
playground_force_auto_login_as_userGET parameter is present,this mu-plugin will automatically log in any logged out visitor. This will
happen every time they visit, not just on their first visit.
Testing Instructions (or ideally a Blueprint)
/?playground_force_auto_login_as_user=admin&and confirm you were logged in again.cc @brandonpayton – the
/?playground_force_auto_login_as_user=admintriggers a redirect to add the trailing slash, as in/?playground_force_auto_login_as_user=admin/. Let's track that separately.