Publish to WordPress - #76
Merged
Merged
Conversation
Add Results > Publish to WordPress..., which creates or updates a page on a WordPress site through its REST API, authenticated with an Application Password over HTTPS. - rivercrossing.wordpress: wx-free REST client (discover, find_page_by_slug, publish_page) built on the stdlib only, HTTPS-only, with typed errors. - htmlexport.render_wordpress plus a selector-scoped compiled_css_wp artifact: it emits only an inner body fragment wrapped in .rc-results, so publishing cannot restyle the site theme. Cascade layers are flattened so the fragment's rules win on specificity against a theme's unlayered CSS, keeping the app's own layout. - publish_wordpress_dlg and mi_publish_wordpress, the pure presenter and the wx view, and the off-loop publish wiring in the app (errors surfaced via the status bar or a native dialog). - Five wp_* settings persisted in the settings file (the Application Password is stored there for now). - Unit tests cover the client (100% branch), presenter, renderer and settings; the frozen-name registry and CHANGELOG are updated. Verified against a live local WordPress (Podman): discover, create-then-update, and the rendered page.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 37542209 | Triggered | Username Password | da00f1f | tests/unit/test_wordpress.py | View secret |
| 37542208 | Triggered | Username Password | da00f1f | tests/unit/ui/test_settings_contract.py | View secret |
| 37542206 | Triggered | Username Password | da00f1f | tests/unit/presenters/test_publish_wordpress.py | View secret |
| 37542207 | Triggered | Base64 Basic Authentication | da00f1f | tests/unit/test_wordpress.py | View secret |
| 37542208 | Triggered | Username Password | da00f1f | tests/unit/presenters/test_settings.py | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
compiled_css_wp was missing from .gitattributes, so Windows autocrlf rewrote it to CRLF on checkout while the generator emits LF, failing css_drift and the test_gen_css byte compare on windows-latest. Add the same eol=lf contract the sibling compiled_css/fonts_css artifacts carry.
GitGuardian flagged three 'Username Password' literals and one 'Base64 Basic Authentication' literal on the branch. All four were test fixtures, not real credentials: a fabricated application password ('hunter2') in the settings tests, and a precomputed base64 Basic header for a fabricated user:password in the client tests.
Replace them with clearly synthetic placeholders (example-user / example-value) and compute the expected Basic header from the fixture with stdlib base64 instead of embedding the encoded credential. No behaviour or test intent changes; the production docstring's illustration is updated too.
…ords Wordfence disables WordPress Application Passwords by default and the option is not obvious to find, so the publish flow fails until it is re-enabled. Document the prerequisite in the Publishing results section and add a troubleshooting entry: the setting is on Wordfence - Firewall - All Firewall Options, in the Brute Force Protection section under 'Additional Options' (the inverted 'Disable WordPress application passwords' checkbox), and the fastest way to reach it is the search box at the top of that page. docs/user-guide.html regenerated with tools/gen_userguide.py (userguide_drift green).
The Application Password used to test Results > Publish to WordPress against gorca.ca lives in .wp-password.txt at the repo root. Ignore it so it can never be committed.
Union-resolve the conflicts with the zero-lap/DNS work (5b80858): keep both features' settings fields (wp_* + show_dns_riders), Results menu items (mi_publish_wordpress + mi_show_dns_riders), spec/user-guide sections and test pins, and recompute the merged menu/id counts. Regenerated ids.py (gen_ids) and user-guide.html (gen_userguide). render_wordpress now forwards the unique-rider count so a published page keeps master's header tally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds Results ▸ Publish to WordPress…, which creates or updates a page on a WordPress site
through its REST API, authenticated with an Application Password over HTTPS.
The dialog collects the site URL, username, Application Password, page title and slug, an optional
parent "section" page, and the publish status. The connection and page defaults persist in
settings.json(first cut; planned to move onto the ride later). The page is looked up by slug andupdated if it exists, created if it does not.
Why
Operators currently export the results page and upload it by hand. This publishes a finished ride's
results straight to the club site.
How it is built
rivercrossing.wordpress— a wx-free REST client on the stdlib only (discover,find_page_by_slug,publish_page), HTTPS-only for every request, with typed errors. No newdependency.
htmlexport.render_wordpress— emits only an inner body fragment wrapped in.rc-results(no
<!DOCTYPE>/<html>/<head>/<body>, norace-datascript). A selector-scopedcompiled_css_wpartifact scopes the app's CSS under.rc-results, so publishing cannot restylethe site theme; the cascade layers are flattened so the fragment's own layout wins on specificity
against a theme's unlayered CSS.
menu; categories and tags are Post-only.
publish_wordpress_dlg, itswp_*controls,mi_publish_wordpress) areregistered in
design/docs-md/xrc-windows.mdandspec.md§15/§15b.The site owner still places the page on a menu in wp-admin — WordPress core REST has no menus
endpoint.
Verification
lint · typecheck · importlint · ids_drift · css_drift · assets_drift · unitall green —6847 passed, coverage 99.86% (
wordpress.py100% branch).tests/functional/test_app_menu_quit.py) passes.discoverreportswp/v2andapplication-passwords;publish_pagecreated a page and then updated the same page;the published page keeps its inline
<style>through kses and renders in the app's own layout.Notes
is to the ride, and eventually the OS keychain).
<style>survives for an account withunfiltered_html(single-site Editor orAdministrator); a lower role would have it stripped.