@loopress/cli 0.13.0 → 0.15.0

package/dist/lib/wp-authorize-flow.d.ts

@@ -3,8 +3,20 @@ export type AuthorizeResult = {
     userLogin: string;
 };
 /**
- * Runs WordPress's native "authorize application" flow: opens a local callback server,
- * sends the user to `<siteUrl>/wp-admin/authorize-application.php`, and resolves with the
- * generated Application Password once WordPress redirects back.
+ * Relays the authorization through the Loopress API so that WordPress's
+ * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
+ * redirect from WordPress and forwards the credentials back to a local callback
+ * server via a form POST (keeping them out of the browser's address bar).
+ *
+ * Flow:
+ *   1. Start a local HTTP server on `127.0.0.1`.
+ *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
+ *      callback URL and the target WordPress site as query params.
+ *   3. That page redirects the user to WordPress's authorize-application.php,
+ *      passing the API's callback endpoint as `success_url` (HTTPS).
+ *   4. After the user approves, WordPress redirects to the API callback.
+ *   5. The API callback returns an HTML page that POSTs a form with the
+ *      Application Password to the local callback server.
+ *   6. The local server extracts the credentials and resolves the promise.
  */
 export declare function authorizeWithBrowser(siteUrl: string, log: (message: string) => void): Promise<AuthorizeResult>;

package/dist/lib/wp-authorize-flow.js

@@ -1,53 +1,60 @@
-import { randomBytes } from 'node:crypto';
 import { renderResultPage, waitForLocalCallback } from './local-callback-server.js';
-const APP_NAME = 'Loopress';
 /**
- * Runs WordPress's native "authorize application" flow: opens a local callback server,
- * sends the user to `<siteUrl>/wp-admin/authorize-application.php`, and resolves with the
- * generated Application Password once WordPress redirects back.
+ * Relays the authorization through the Loopress API so that WordPress's
+ * `success_url` / `reject_url` can be valid HTTPS URLs.  The API receives the
+ * redirect from WordPress and forwards the credentials back to a local callback
+ * server via a form POST (keeping them out of the browser's address bar).
+ *
+ * Flow:
+ *   1. Start a local HTTP server on `127.0.0.1`.
+ *   2. Open the browser to `https://api.loopress.dev/auth/wp-authorize` with the local
+ *      callback URL and the target WordPress site as query params.
+ *   3. That page redirects the user to WordPress's authorize-application.php,
+ *      passing the API's callback endpoint as `success_url` (HTTPS).
+ *   4. After the user approves, WordPress redirects to the API callback.
+ *   5. The API callback returns an HTML page that POSTs a form with the
+ *      Application Password to the local callback server.
+ *   6. The local server extracts the credentials and resolves the promise.
  */
 export function authorizeWithBrowser(siteUrl, log) {
-    const state = randomBytes(32).toString('hex');
     return waitForLocalCallback({
         buildUrl(callbackBaseUrl) {
-            const successUrl = `${callbackBaseUrl}/callback?state=${state}`;
-            const rejectUrl = `${callbackBaseUrl}/reject?state=${state}`;
-            return (`${siteUrl}/wp-admin/authorize-application.php?app_name=${encodeURIComponent(APP_NAME)}` +
-                `&success_url=${encodeURIComponent(successUrl)}&reject_url=${encodeURIComponent(rejectUrl)}`);
+            const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
+            const params = new URLSearchParams({
+                callbackUrl: callbackBaseUrl,
+                wpUrl: siteUrl,
+            });
+            return `${relayUrl}?${params}`;
         },
-        handleRequest(url, { rejectWithPage, resolveWithPage, respondBadRequest }) {
-            if (url.searchParams.get('state') !== state) {
-                respondBadRequest('Invalid or missing state');
+        handleRequest(url, { resolveWithPage, rejectWithPage, respondBadRequest, body }) {
+            if (url.searchParams.has('cancelled') || body.cancelled) {
+                rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
-            if (url.pathname === '/reject') {
-                rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress. You can enter credentials manually instead.'));
-                return;
-            }
-            const userLogin = url.searchParams.get('user_login');
-            const password = url.searchParams.get('password');
-            if (!userLogin || !password) {
-                respondBadRequest('Missing user_login or password');
+            const password = body.password || url.searchParams.get('password') || '';
+            const userLogin = body.user_login || url.searchParams.get('user_login') || '';
+            if (!password || !userLogin) {
+                respondBadRequest('Missing password or user_login');
                 return;
             }
             resolveWithPage(SUCCESS_PAGE, { password, userLogin });
         },
         log,
         openingMessage: 'Opening WordPress in your browser to authorize Loopress...',
-        timeoutMessage: 'Authorization timed out after 5 minutes. You can enter credentials manually instead.',
+        timeoutMessage: 'Authorization timed out after 5 minutes.',
     });
 }
 const SUCCESS_PAGE = renderResultPage({
     background: '#f0fdf4',
     heading: 'Authorization successful!',
     headingColor: '#15803d',
-    icon: '✅',
+    icon: '&#10003;',
     tabTitle: 'Authorized',
 });
 const REJECTED_PAGE = renderResultPage({
     background: '#fef2f2',
     heading: 'Authorization rejected',
     headingColor: '#b91c1c',
-    icon: '✕',
+    icon: '&#10007;',
     tabTitle: 'Authorization rejected',
 });

package/dist/lib/wp-client.d.ts

@@ -1,7 +1,7 @@
 export declare const REQUEST_TIMEOUT_MS = 30000;
 /**
  * HTTP client for a WordPress site's REST API.
- * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/plugins`.
+ * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
  */
 export declare class WpClient {
     private readonly siteUrl;

package/dist/lib/wp-client.js

@@ -2,7 +2,7 @@ import got from 'got';
 export const REQUEST_TIMEOUT_MS = 30_000;
 /**
  * HTTP client for a WordPress site's REST API.
- * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/plugins`.
+ * Paths are relative to `<site>/wp-json/`, e.g. `loopress/v1/snippets` or `wp/v2/plugins`.
  */
 export class WpClient {
     siteUrl;

package/dist/types/config.d.ts

@@ -1 +1 @@
-export type { CurrentProjectPointer, EnvironmentConfig, LoopressGlobalConfiguration as LoopressConfig, ProjectConfig, } from './global-config.generated.js';
+export type { CurrentProjectPointer, EnvironmentConfig, LoopressGlobalConfiguration as LoopressConfig, ProjectConfig, TelemetryConfig, } from './global-config.generated.js';

package/dist/types/global-config.generated.d.ts

@@ -1,5 +1,5 @@
 /**
- * Global CLI state stored at ~/.loopress/config.json: known projects, their environments, and which one is currently active.
+ * Global CLI state stored at $XDG_CONFIG_HOME/loopress/config.json (or ~/.config/loopress/config.json): known projects, their environments, and which one is currently active.
  */
 export interface LoopressGlobalConfiguration {
     /**
@@ -12,6 +12,7 @@ export interface LoopressGlobalConfiguration {
     projects: {
         [k: string]: ProjectConfig;
     };
+    telemetry?: TelemetryConfig;
 }
 export interface CurrentProjectPointer {
     /**
@@ -29,7 +30,7 @@ export interface ProjectConfig {
      */
     addedAt: string;
     /**
-     * Id of the matching project on the Loopress API, once synced via `lps project sync`.
+     * Id of the matching project on the Loopress API, once pushed via `lps project push`.
      */
     apiProjectId?: string;
     /**
@@ -49,7 +50,7 @@ export interface EnvironmentConfig {
      */
     addedAt: string;
     /**
-     * Id of the matching environment on the Loopress API, once synced via `lps project sync`.
+     * Id of the matching environment on the Loopress API, once pushed via `lps project push`.
      */
     apiEnvironmentId?: string;
     /**
@@ -65,3 +66,12 @@ export interface EnvironmentConfig {
      */
     url: string;
 }
+/**
+ * User preferences for error reporting, set via `lps telemetry disable`/`lps telemetry enable`.
+ */
+export interface TelemetryConfig {
+    /**
+     * Whether error reporting to Sentry is disabled.
+     */
+    disabled: boolean;
+}

package/dist/types/plugin.d.ts

@@ -5,11 +5,10 @@ export interface InstalledPlugin {
     slug: string;
     version: string;
 }
-export interface InstallResult {
-    message: string;
+export interface WpNativePlugin {
+    name: string;
+    plugin: string;
+    status: 'active' | 'inactive' | 'network-active';
     version: string;
 }
-export interface ActivateResult {
-    message: string;
-}
 export type PluginManifest = Record<string, string>;

package/dist/types/project-config.generated.d.ts

@@ -16,12 +16,9 @@ export interface LoopressProjectConfiguration {
      */
     projectId?: string;
     /**
-     * Pinned plugin versions. Keys are WordPress.org plugin slugs, values are version constraints.
+     * WordPress.org plugins managed by Loopress. Keys are plugin slugs; values are written as "latest" since installs go through WordPress's native plugin API, which only installs the current version. Older files may still have a pinned version string here from before this was the case; it is read but no longer acted on.
      */
     plugins?: {
-        /**
-         * Version to pin. Use an exact version (e.g. "8.9.1") or "latest".
-         */
         [k: string]: string;
     };
 }

package/dist/utils/plugins.d.ts

@@ -1,16 +1,11 @@
-import { InstalledPlugin, PluginManifest } from '../types/plugin.js';
+import { InstalledPlugin, PluginManifest, WpNativePlugin } from '../types/plugin.js';
 export interface PluginDiff {
-    drifted: Array<{
-        currentVersion: string;
-        slug: string;
-        targetVersion: string;
-    }>;
     toActivate: Array<{
+        file: string;
         slug: string;
     }>;
     toInstall: Array<{
         slug: string;
-        targetVersion: string;
     }>;
     upToDate: string[];
 }
@@ -24,4 +19,5 @@ export interface MergeResult {
     }>;
 }
 export declare function mergePluginManifest(existing: PluginManifest, incoming: PluginManifest): MergeResult;
+export declare function parseInstalledPlugins(raw: WpNativePlugin[]): InstalledPlugin[];
 export declare function diffPlugins(manifest: PluginManifest, installed: InstalledPlugin[]): PluginDiff;

package/dist/utils/plugins.js

@@ -1,3 +1,7 @@
+// Loopress must never manage itself: pulling it into loopress.json would make a later
+// `plugin push` try to reinstall it from WordPress.org, where it doesn't exist, potentially
+// clobbering the plugin's own directory in the process.
+const LOOPRESS_PLUGIN_SLUG = 'loopress';
 export function mergePluginManifest(existing, incoming) {
     const merged = { ...existing, ...incoming };
     const added = Object.keys(incoming).filter((s) => !(s in existing));
@@ -6,29 +10,39 @@ export function mergePluginManifest(existing, incoming) {
         .map((s) => ({ from: existing[s], slug: s, to: incoming[s] }));
     return { added, merged, updated };
 }
+// WordPress core identifies each plugin by a `<folder>/<file>` id (or a bare `<file>` for a
+// single-file plugin) with the `.php` extension stripped; the WordPress.org slug is just the
+// folder name (or the bare id itself for a single-file plugin).
+function slugFromPluginFile(file) {
+    return file.split('/')[0];
+}
+export function parseInstalledPlugins(raw) {
+    return raw
+        .map((item) => ({
+        active: item.status !== 'inactive',
+        file: item.plugin,
+        name: item.name,
+        slug: slugFromPluginFile(item.plugin),
+        version: item.version,
+    }))
+        .filter((plugin) => plugin.slug !== LOOPRESS_PLUGIN_SLUG);
+}
 export function diffPlugins(manifest, installed) {
     const installedMap = new Map(installed.map((p) => [p.slug, p]));
     const toInstall = [];
     const toActivate = [];
-    const drifted = [];
     const upToDate = [];
-    for (const [slug, targetVersion] of Object.entries(manifest)) {
+    for (const slug of Object.keys(manifest)) {
         const live = installedMap.get(slug);
         if (!live) {
-            toInstall.push({ slug, targetVersion });
-            continue;
+            toInstall.push({ slug });
         }
-        if (live.version === targetVersion) {
-            if (live.active) {
-                upToDate.push(slug);
-            }
-            else {
-                toActivate.push({ slug });
-            }
+        else if (live.active) {
+            upToDate.push(slug);
         }
         else {
-            drifted.push({ currentVersion: live.version, slug, targetVersion });
+            toActivate.push({ file: live.file, slug });
         }
     }
-    return { drifted, toActivate, toInstall, upToDate };
+    return { toActivate, toInstall, upToDate };
 }