Add RFC 8414 OAuth2 discovery endpoint - #17
Open
roborourke wants to merge 5 commits into
Open
roborourke wants to merge 5 commits into
roborourke wants to merge 5 commits into
Conversation
Adds two OAuth2 discovery endpoints so clients can find this plugin's endpoints and capabilities without hardcoding them: - /.well-known/oauth-authorization-server (RFC 8414) exposes the plugin's authorization and token endpoints, and the grant types it supports. - /.well-known/oauth-protected-resource (RFC 9728) advertises protected-resource metadata for this site. Any 401 REST response now also gets a `WWW-Authenticate: Bearer resource_metadata="..."` header, not scoped to a particular route, so any bearer-protected endpoint benefits rather than just one integration. This was ported and generalized from hm-rest-ability, where it didn't belong (that plugin's copy is being removed in humanmade/hm-rest-ability#42). One HM-specific behaviour was deliberately dropped in the port: the original defaulted its login-wall exemption to Human Made's own Require Login plugin. This plugin is meant to stay generic and potentially go upstream, so that default doesn't belong here. The exemption mechanism itself is kept as a filter, `oauth2.well_known_login_wall_exemptions`, but now defaults to empty. `code_challenge_methods_supported` (PKCE, RFC 8414) is intentionally left out for now, since PKCE support isn't merged into this repo's main yet (tracked in a separate open PR). Add it once that lands. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Composer dependencies and PHPUnit's cache file were getting installed locally but weren't ignored, risking an accidental commit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drop the RFC 9728 protected-resource metadata document and the WWW-Authenticate header that pointed to it. Both describe protecting a resource server, not this plugin's own OAuth2 authorization and token endpoints, so they don't belong here. That behaviour may return in a different plugin instead, most likely hm-rest-ability, but where it lives is still to be decided. RFC 8414 stays: the authorization-server metadata document at /.well-known/oauth-authorization-server only describes endpoints this plugin itself implements. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
roborourke
changed the title
The oauth2.well_known_login_wall_exemptions filter let sites remove arbitrary init hooks via remove_action() before serving .well-known/ documents. That's a fragile pattern: it depends on knowing the exact hook, callback, and priority another plugin used, and breaks silently if any of those change. It also solved a problem nobody has hit yet. Drop it until there's a real need, and design for that need directly rather than guessing at a generic mechanism. With that hook gone, Well_Known only registers one action (parse_request), so its own bootstrap() wrapper added nothing. Bind that hook directly in inc/namespace.php's bootstrap(), matching how Endpoints\register is already bound there. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The identifier 'oauth-authorization-server' appeared three times as a literal string: as the returned document name, inside the /.well-known/ path, and in the equality check in maybe_serve_document(). Replace these with two constants, AUTHORIZATION_SERVER_DOCUMENT and AUTHORIZATION_SERVER_PATH, with the path derived from the document constant so they can't drift apart. tests/test-well-known.php deliberately keeps asserting the literal strings rather than the constants, so a typo in either constant still fails the tests instead of passing silently. Addresses review feedback from joehoyle on upstream PR WP-API#82. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a standard OAuth2 discovery endpoint, so clients can find this plugin's OAuth2 setup without hardcoding it.
/.well-known/oauth-authorization-server(RFC 8414) exposes the plugin's authorization and token endpoints, and the grant types it supports.This mirrors work removed from
hm-rest-ability, where it didn't belong (see humanmade/hm-rest-ability#42). One thing was deliberately left out of the port: the original exempted.well-known/requests from Human Made's own Require Login plugin, via a login-wall exemption filter. That filter usedremove_action()to strip out another plugin's hook, which is a fragile pattern, and it solved a problem this plugin hasn't hit yet. It's left out entirely here.RFC 9728 protected-resource metadata and a
WWW-Authenticateheader are not part of this PR. They describe protecting a resource, not this OAuth2 server, so they belong in a different plugin. Where that lives, likelyhm-rest-ability, is still to be decided.PKCE support (
code_challenge_methods_supported) isn't included yet, since PKCE isn't merged into this repo'smainyet. It should be added once that lands.This targets the fork only for now. Once settled, the plan is to propose a version of this upstream to
WP-API/OAuth2.🤖 Generated with Claude Code