feat: Authenticated API requests by dcalhoun · Pull Request #14 · wordpress-mobile/GutenbergKit

dcalhoun · 2024-08-13T18:48:03Z

Enable authenticated API requests to a site URL via the basic authentication
scheme with application passwords.

Testing Instructions

Manually set siteURL and authToken values within the
EditorViewController constructor.
Build and run the demo app.
Inspect the network traffic and verify the preloaded requests succeed.

Provide the editor with context managed by the host application.

Simplify retrieval of configuration values provided by the host app.

Improve performance by reducing local storage read frequency.

Communicate CORS support and avoid incorrect presumptions in third-party responses (e.g., Jetpack adds custom header values).

Improve code comprehension.

`@wordpress/api-fetch` manages this header for us as long as we rely upon the default fetcher. https://github.com/WordPress/gutenberg/blob/5dae25b15e82a59d28c6c065b5a3745f3f83980f/packages/api-fetch/src/index.js#L96-L100

geriux · 2024-08-14T12:11:03Z

 export function initializeApiFetch() {
-	apiFetch.use(apiFetch.createRootURLMiddleware(''));
+	const { siteURL, authToken } = getGBKit();
+	const rootURL = siteURL ? `${siteURL}/wp-json/` : undefined;


I've just realized that for WordPress.com sites, we'll need to use https://public-api.wordpress.com/ instead. This means we'll need to remove the wp-json path and include it in the siteURL parameter. I suggest we address this in a separate PR, as I encountered some issues with the endpoint paths when attempting to connect to https://public-api.wordpress.com/.

For now this will work perfectly for self-hosted sites.

Interesting. I make successful requests with this approach for an Atomic WPCOM site. Is the use of https://public-api.wordpress.com/ merely a recommendation and/or potentially required for Simple sites?

I was trying with a simple site yeah. For Atomic, it's the same as self-hosted using the site's URL, but for Simple sites I think we'll need to go through the WordPress.com API 🤔

I ended up trying this because I checked the editor's Web view source code and for Simple sites, it sets https://public-api.wordpress.com/ for the createRootURLMiddleware middleware and for Atomic, it just uses the site's URL e.g. https://geriuxxtestingbusiness123.wpcomstaging.com/wp-json/

Makes sense. When we address this, we might consider renaming siteURL to something like siteAPIURL.

Addressed here

geriux

LGTM! I've tested it using the host app and I was able to pass the data successfully. 🚀

Nice work!

…script The trailing `"done";` dates from #14, when the configuration was injected with `evaluateJavaScript`, which needed a serializable trailing expression. #15 moved the script to a document-start `WKUserScript`, whose completion value WebKit discards, and the line has been inert since. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016zAv5Tqtqr1bcYWVDJHGAh

* refactor: read the editor configuration from the injected global only `getGBKit` fell back to a copy of the configuration in `localStorage`. Boot waits for `window.GBKit` before anything reads the configuration, and outside `?dev_mode` aborts when it never arrives, so the fallback could only ever serve a previous session's values to a dev-mode page with no host. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JsMCoa3jNEuvnhxicDVRBV * fix(ios): stop persisting the editor configuration `GBKit` carries the site credential and the local server's port and tokens, all valid only for the load that injected them, and iOS mirrored it into `localStorage`, which the default website data store keeps on disk across launches. The document-start user script replays the global on every navigation, including the reload after a WebContent process termination, so the copy had no reader. Remove the key as the configuration is injected so devices upgraded from an earlier version are scrubbed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JsMCoa3jNEuvnhxicDVRBV * fix(android): stop persisting the editor configuration `GBKit` carries the site credential and the local server's port and token, all valid only for the load that injected them. The view re-injects the global on every page start and wipes web storage before each load, so the `localStorage` copy had no reader and nothing left to clear on detach. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JsMCoa3jNEuvnhxicDVRBV * docs: describe where the local server's token lives The CORS rationale on both platforms named `localStorage` alongside `window.GBKit` as where the editor holds the per-session bearer token. The token now lives in the injected global only. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JsMCoa3jNEuvnhxicDVRBV * docs(android): correct the CORS rationale's origin premise The comment justified `*` partly by claiming the editor loads from file:// (Origin null) and so can't be allowlisted. That holds on iOS, but the Android editor has loaded from the site's own origin since #181, where echoing the origin would be perfectly possible. Name the document, not the origin, as what scopes the token: same-origin site pages exist on Android, and it is the per-document JS global that keeps them from reading it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016zAv5Tqtqr1bcYWVDJHGAh * refactor(ios): drop the dead completion value from the configuration script The trailing `"done";` dates from #14, when the configuration was injected with `evaluateJavaScript`, which needed a serializable trailing expression. #15 moved the script to a document-start `WKUserScript`, whose completion value WebKit discards, and the line has been inert since. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016zAv5Tqtqr1bcYWVDJHGAh * test: cover getGBKit's injected-global-only contract `getGBKit` now ignores any persisted copy, but nothing held that contract in place: the suite only ever exercised it through `window.GBKit`, so restoring the storage fallback would have left every test green. Verified as a tripwire — reinstating the fallback fails the second case. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016zAv5Tqtqr1bcYWVDJHGAh * docs: say when the configuration scrub runs The iOS comment promised that an upgraded device "is scrubbed" without saying this only happens on the next editor load, and left no signal for when the migration can be dropped. Document `clearConfig` as teardown-only: with the storage fallback gone, `window.GBKit` is the editor's only source of configuration, so clearing it under a live editor now leaves that editor unusable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016zAv5Tqtqr1bcYWVDJHGAh * docs: rest the CORS rationale on the token alone Both comments claimed no other document can read the editor's global, which overstated the guarantee and disagreed across platforms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEok5vK3cCWGfcQp8zEGWW --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

dcalhoun added 7 commits August 13, 2024 14:31

feat: Inject editor configuration

3606c6d

Provide the editor with context managed by the host application.

feat: Add getGBKit utility for retrieving host app configuration

dac6f96

Simplify retrieval of configuration values provided by the host app.

perf: Cache GBKit configuration as global

e2ade92

Improve performance by reducing local storage read frequency.

feat: Support authenticated API requests

446f026

feat: Enable fetch CORS mode

e587436

Communicate CORS support and avoid incorrect presumptions in third-party responses (e.g., Jetpack adds custom header values).

refactor: Follow the single responsibility principle

cd069e4

Improve code comprehension.

refactor: Remove redundant Content-Type header

fdd7f5b

`@wordpress/api-fetch` manages this header for us as long as we rely upon the default fetcher. https://github.com/WordPress/gutenberg/blob/5dae25b15e82a59d28c6c065b5a3745f3f83980f/packages/api-fetch/src/index.js#L96-L100

dcalhoun commented Aug 13, 2024

View reviewed changes

Comment thread ReactApp/src/misc/api-fetch-setup.js

dcalhoun marked this pull request as ready for review August 13, 2024 19:06

dcalhoun requested a review from geriux August 13, 2024 19:06

dcalhoun enabled auto-merge (squash) August 13, 2024 19:07

geriux reviewed Aug 14, 2024

View reviewed changes

geriux approved these changes Aug 14, 2024

View reviewed changes

dcalhoun merged commit 6353bb3 into trunk Aug 14, 2024

dcalhoun deleted the feat/authenticated-api-requests branch August 14, 2024 12:11

dcalhoun mentioned this pull request Sep 1, 2026

fix: stop persisting the editor configuration in localStorage #613

Merged

Navigation Menu

Repository navigation

feat: Authenticated API requests - #14

feat: Authenticated API requests#14
dcalhoun merged 7 commits into
trunkfrom
feat/authenticated-api-requests

dcalhoun commented Aug 13, 2024 •

edited

Loading

Uh oh!

Uh oh!

geriux Aug 14, 2024

Uh oh!

dcalhoun Aug 14, 2024

Uh oh!

geriux Aug 14, 2024

Uh oh!

dcalhoun Aug 14, 2024

Uh oh!

geriux Aug 16, 2024

Uh oh!

geriux left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dcalhoun commented Aug 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing Instructions

Uh oh!

Uh oh!

geriux Aug 14, 2024

Choose a reason for hiding this comment

Uh oh!

dcalhoun Aug 14, 2024

Choose a reason for hiding this comment

Uh oh!

geriux Aug 14, 2024

Choose a reason for hiding this comment

Uh oh!

dcalhoun Aug 14, 2024

Choose a reason for hiding this comment

Uh oh!

geriux Aug 16, 2024

Choose a reason for hiding this comment

Uh oh!

geriux left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dcalhoun commented Aug 13, 2024 •

edited

Loading