← All changes | includes/abilities/auth/wdesignkit-login.php +47 -26 2.5.5 → 2.7.0 View file →

		@@ -9,12 +9,12 @@
9	9	exit();
10	10	}
11	11
12	12	wp_register_ability('wdesignkit/login', [
13		- 'label' => __('Login to WDesignKit Cloud', 'sprout-mcp'),
	13	+ 'label' => __('Login to WDesignKit Cloud', 'wdesignkit'),
14	14	'description' => __(
15	15	'Authenticates the user against the WDesignKit cloud using email and password, and stores the session token locally. Use remember_me: true for a 90-day session; false (default) for a 1-day session.',
16		- 'sprout-mcp',
	16	+ 'wdesignkit',
17	17	),
18	18	'category' => 'wdesignkit',
19	19	'input_schema' => [
20	20	'type' => 'object',
		@@ -43,10 +43,11 @@
43	43	'email' => ['type' => ['string', 'null']],
44	44	],
45	45	],
46	46	'execute_callback' => 'wdesignkit_mcp_login',
47		- 'permission_callback' => 'sprout_mcp_permission_callback',
	47	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
48	48	'meta' => [
	49	+ 'public' => true,
49	50	'show_in_rest' => true,
50	51	'mcp' => ['public' => true],
51	52	'annotations' => [
52	53	'instructions' => implode("\n", [
		@@ -62,12 +63,12 @@
62	63	],
63	64	]);
64	65
65	66	wp_register_ability('wdesignkit/login-api-key', [
66		- 'label' => __('Login to WDesignKit Cloud with API Key', 'sprout-mcp'),
	67	+ 'label' => __('Login to WDesignKit Cloud with API Key', 'wdesignkit'),
67	68	'description' => __(
68	69	'Authenticates the user against the WDesignKit cloud using a personal API token (instead of email and password), and stores the session locally. Useful for automation and CI workflows.',
69		- 'sprout-mcp',
	70	+ 'wdesignkit',
70	71	),
71	72	'category' => 'wdesignkit',
72	73	'input_schema' => [
73	74	'type' => 'object',
		@@ -88,10 +89,11 @@
88	89	'email' => ['type' => ['string', 'null']],
89	90	],
90	91	],
91	92	'execute_callback' => 'wdesignkit_mcp_login_api_key',
92		- 'permission_callback' => 'sprout_mcp_permission_callback',
	93	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
93	94	'meta' => [
	95	+ 'public' => true,
94	96	'show_in_rest' => true,
95	97	'mcp' => ['public' => true],
96	98	'annotations' => [
97	99	'instructions' => implode("\n", [
		@@ -107,12 +109,12 @@
107	109	],
108	110	]);
109	111
110	112	wp_register_ability('wdesignkit/social-login', [
111		- 'label' => __('Login / Sign Up to WDesignKit Cloud via Google or Facebook', 'sprout-mcp'),
	113	+ 'label' => __('Login / Sign Up to WDesignKit Cloud via Google or Facebook', 'wdesignkit'),
112	114	'description' => __(
113	115	'Completes a WDesignKit Google or Facebook OAuth login/signup using the state code produced after the user authorises in the OAuth browser popup. Covers Login with Google, Login with Facebook, Sign Up with Google, and Sign Up with Facebook — all share the same backend endpoint.',
114		- 'sprout-mcp',
	116	+ 'wdesignkit',
115	117	),
116	118	'category' => 'wdesignkit',
117	119	'input_schema' => [
118	120	'type' => 'object',
		@@ -134,10 +136,11 @@
134	136	'response' => ['type' => ['object', 'array']],
135	137	],
136	138	],
137	139	'execute_callback' => 'wdesignkit_mcp_social_login',
138		- 'permission_callback' => 'sprout_mcp_permission_callback',
	140	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
139	141	'meta' => [
	142	+ 'public' => true,
140	143	'show_in_rest' => true,
141	144	'mcp' => ['public' => true],
142	145	'annotations' => [
143	146	'instructions' => implode("\n", [
		@@ -154,12 +157,12 @@
154	157	],
155	158	]);
156	159
157	160	wp_register_ability('wdesignkit/signup', [
158		- 'label' => __('Sign Up for WDesignKit Cloud', 'sprout-mcp'),
	161	+ 'label' => __('Sign Up for WDesignKit Cloud', 'wdesignkit'),
159	162	'description' => __(
160	163	'Creates a new WDesignKit cloud account with a full name, email address, and password, then stores the session token locally so cloud features are immediately available.',
161		- 'sprout-mcp',
	164	+ 'wdesignkit',
162	165	),
163	166	'category' => 'wdesignkit',
164	167	'input_schema' => [
165	168	'type' => 'object',
		@@ -188,10 +191,11 @@
188	191	'email' => ['type' => ['string', 'null']],
189	192	],
190	193	],
191	194	'execute_callback' => 'wdesignkit_mcp_signup',
192		- 'permission_callback' => 'sprout_mcp_permission_callback',
	195	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
193	196	'meta' => [
	197	+ 'public' => true,
194	198	'show_in_rest' => true,
195	199	'mcp' => ['public' => true],
196	200	'annotations' => [
197	201	'instructions' => implode("\n", [
		@@ -206,12 +210,12 @@
206	210	],
207	211	]);
208	212
209	213	wp_register_ability('wdesignkit/forgot-password', [
210		- 'label' => __('WDesignKit Cloud Forgot Password', 'sprout-mcp'),
	214	+ 'label' => __('WDesignKit Cloud Forgot Password', 'wdesignkit'),
211	215	'description' => __(
212	216	'Sends a password reset email to the specified WDesignKit cloud account address. This is a read-only operation — no local session is modified.',
213		- 'sprout-mcp',
	217	+ 'wdesignkit',
214	218	),
215	219	'category' => 'wdesignkit',
216	220	'input_schema' => [
217	221	'type' => 'object',
		@@ -231,10 +235,11 @@
231	235	'message' => ['type' => 'string'],
232	236	],
233	237	],
234	238	'execute_callback' => 'wdesignkit_mcp_forgot_password',
235		- 'permission_callback' => 'sprout_mcp_permission_callback',
	239	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
236	240	'meta' => [
	241	+ 'public' => true,
237	242	'show_in_rest' => true,
238	243	'mcp' => ['public' => true],
239	244	'annotations' => [
240	245	'instructions' => implode("\n", [
		@@ -249,12 +254,12 @@
249	254	],
250	255	]);
251	256
252	257	wp_register_ability('wdesignkit/logout', [
253		- 'label' => __('Logout from WDesignKit Cloud', 'sprout-mcp'),
	258	+ 'label' => __('Logout from WDesignKit Cloud', 'wdesignkit'),
254	259	'description' => __(
255	260	'Logs the currently authenticated user out of WDesignKit cloud. Deletes the local session transient, calls the cloud logout endpoint to invalidate the token, and clears the cached licence data.',
256		- 'sprout-mcp',
	261	+ 'wdesignkit',
257	262	),
258	263	'category' => 'wdesignkit',
259	264	'input_schema' => [
260	265	'type' => 'object',
		@@ -266,10 +271,11 @@
266	271	'message' => ['type' => 'string'],
267	272	],
268	273	],
269	274	'execute_callback' => 'wdesignkit_mcp_logout',
270		- 'permission_callback' => 'sprout_mcp_permission_callback',
	275	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
271	276	'meta' => [
	277	+ 'public' => true,
272	278	'show_in_rest' => true,
273	279	'mcp' => ['public' => true],
274	280	'annotations' => [
275	281	'instructions' => implode("\n", [
		@@ -285,12 +291,12 @@
285	291	],
286	292	]);
287	293
288	294	wp_register_ability('wdesignkit/get-social-login-url', [
289		- 'label' => __('Get WDesignKit Social Login URL', 'sprout-mcp'),
	295	+ 'label' => __('Get WDesignKit Social Login URL', 'wdesignkit'),
290	296	'description' => __(
291	297	'Generates a Google or Facebook OAuth authorisation URL and a unique state token. Step 1 of social login: open the returned auth_url in a browser popup for the user to authorise, then pass the state to wdesignkit/social-login (Step 2) once the popup closes.',
292		- 'sprout-mcp',
	298	+ 'wdesignkit',
293	299	),
294	300	'category' => 'wdesignkit',
295	301	'input_schema' => [
296	302	'type' => 'object',
		@@ -315,10 +321,11 @@
315	321	'expires_in' => ['type' => 'integer'],
316	322	],
317	323	],
318	324	'execute_callback' => 'wdesignkit_mcp_get_social_login_url',
319		- 'permission_callback' => 'sprout_mcp_permission_callback',
	325	+ 'permission_callback' => 'wdesignkit_mcp_permission_callback',
320	326	'meta' => [
	327	+ 'public' => true,
321	328	'show_in_rest' => true,
322	329	'mcp' => ['public' => true],
323	330	'annotations' => [
324	331	'instructions' => implode("\n", [
		@@ -349,9 +356,9 @@
349	356	if ($email === '' || $password === '') {
350	357	return ['success' => false, 'message' => 'email and password are required.'];
351	358	}
352	359
353		- $user_key = strstr($email, '@', true);
	360	+ $user_key = wdesignkit_cloud_session_key($email);
354	361
355	362	// Clear any existing session for this user
356	363	delete_transient('wdkit_auth_' . $user_key);
357	364
		@@ -387,8 +394,13 @@
387	394	'token' => $token,
388	395	'user_id' => $cloud_user_id,
389	396	], $expiry);
390	397
	398	+ // Point every later cloud call at THIS account. The transient is keyed off the
	399	+ // cloud email, which rarely matches the WP user's email, so without the pointer
	400	+ // the session can only be found by scanning wp_options.
	401	+ wdesignkit_mcp_remember_session($user_key);
	402	+
391	403	return [
392	404	'success' => true,
393	405	'message' => $response['message'] ?? 'Logged in successfully.',
394	406	'email' => $email,
		@@ -423,9 +435,9 @@
423	435
424	436	// Response data: user->user_email
425	437	$user_data = $response['user'] ?? [];
426	438	$user_email = strtolower(sanitize_email((string) ($user_data['user_email'] ?? '')));
427		- $user_key = $user_email !== '' ? strstr($user_email, '@', true) : '';
	439	+ $user_key = $user_email !== '' ? wdesignkit_cloud_session_key($user_email) : '';
428	440
429	441	if ($user_key !== '') {
430	442	// $user_data already extracted above: $response['user'] ?? []
431	443	$cloud_user_id_api = (string) ($user_data['id'] ?? $user_data['user_id'] ?? $response['user_id'] ?? $response['id'] ?? '');
		@@ -433,8 +445,10 @@
433	445	'user_email' => $user_email,
434	446	'token' => $api_key,
435	447	'user_id' => $cloud_user_id_api,
436	448	], 7776000); // 90 days
	449	+
	450	+ wdesignkit_mcp_remember_session($user_key);
437	451	}
438	452
439	453	return [
440	454	'success' => true,
		@@ -471,9 +485,9 @@
471	485	// Response contains user->user_email and token at top level
472	486	$user_data = $response['user'] ?? [];
473	487	$user_email = strtolower(sanitize_email((string) ($user_data['user_email'] ?? '')));
474	488	$token = sanitize_text_field((string) ($response['token'] ?? ''));
475		- $user_key = $user_email !== '' ? strstr($user_email, '@', true) : '';
	489	+ $user_key = $user_email !== '' ? wdesignkit_cloud_session_key($user_email) : '';
476	490
477	491	if ($user_key !== '' && $token !== '') {
478	492	$cloud_user_id_social = (string) ($user_data['id'] ?? $user_data['user_id'] ?? $response['user_id'] ?? $response['id'] ?? '');
479	493	set_transient('wdkit_auth_' . $user_key, [
		@@ -480,8 +494,10 @@
480	494	'user_email' => $user_email,
481	495	'token' => $token,
482	496	'user_id' => $cloud_user_id_social,
483	497	], 7776000); // 90 days
	498	+
	499	+ wdesignkit_mcp_remember_session($user_key);
484	500	}
485	501
486	502	return [
487	503	'success' => true,
		@@ -510,9 +526,9 @@
510	526	return ['success' => false, 'message' => 'Invalid email address.', 'email' => null];
511	527	}
512	528
513	529	$email = strtolower(sanitize_email($raw_email));
514		- $user_key = strstr($email, '@', true);
	530	+ $user_key = wdesignkit_cloud_session_key($email);
515	531
516	532	// Clear any existing session before signup
517	533	delete_transient('wdkit_auth_' . $user_key);
518	534
		@@ -539,8 +555,10 @@
539	555	'user_email' => $email,
540	556	'token' => $token,
541	557	'user_id' => $cloud_user_id_sig,
542	558	], 86400); // 1-day session after signup
	559	+
	560	+ wdesignkit_mcp_remember_session($user_key);
543	561	}
544	562
545	563	return [
546	564	'success' => true,
		@@ -636,11 +654,14 @@
636	654	$email = $auth['email'] ?? '';
637	655
638	656	// Delete local session transient
639	657	if ($email !== '') {
640		- $user_key = strstr($email, '@', true);
	658	+ $user_key = wdesignkit_cloud_session_key($email);
641	659	delete_transient('wdkit_auth_' . $user_key);
642	660	}
	661	+
	662	+ // Drop the active-session pointer so no later call resolves the dead session
	663	+ wdesignkit_mcp_forget_session();
643	664
644	665	// Clear cached licence data
645	666	delete_option('wdkit_licence_data');
646	667