Repository navigation
feat: connect Faust.js to WordPress with an Application Password - #2676
Merged
Merged
Conversation
The token exchange, health check and telemetry routes accept an Application Password whose user can faustwp_exchange_tokens, which administrators have by default. The blockset route needs faustwp_upload_blocks, which maps to manage_options, or manage_network_options on Multisite. The secret key header keeps working.
When FAUST_APPLICATION_USER and FAUST_APPLICATION_PASSWORD are set, the token exchange authenticates with them instead of FAUST_SECRET_KEY.
blockset, generatePossibleTypes, the health checks and telemetry send Basic auth when FAUST_APPLICATION_USER and FAUST_APPLICATION_PASSWORD are set, and fall back to FAUST_SECRET_KEY otherwise.
josephfusco
marked this pull request as ready for review
October 20, 2026 14:48
josephfusco
added
[Type] Feature
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Default CLI health checks block schema generation for valid Application Password users without token-exchange permission.
1 open issue
What changed in this PR
Adds Application Password authentication to Faust core and CLI, with capability checks in FaustWP, while preserving shared-secret authentication and token encryption.
Changes:
- Prefer configured Application Passwords for server and CLI requests.
- Separate token-exchange and block-upload permissions.
- Add authentication tests and setup documentation.
| File | Description |
|---|---|
| plugins/faustwp/tests/integration/ApplicationPasswordAuthTests.php | Tests authentication and capability restrictions. |
| plugins/faustwp/includes/rest/callbacks.php | Accepts capability-checked Application Passwords. |
| plugins/faustwp/includes/auth/functions.php | Adds Application Password authentication helpers. |
| plugins/faustwp/includes/auth/callbacks.php | Defines capability mappings and defaults. |
| packages/faustwp-core/tests/server/auth/token.test.ts | Tests Application Password token exchanges. |
| packages/faustwp-core/src/server/auth/token.ts | Supports Application Passwords for token requests. |
| packages/faustwp-core/src/lib/getWpApplicationPassword.ts | Builds the authorization header. |
| packages/faustwp-cli/tests/utils/getWpAuthHeaders.test.ts | Tests credential selection. |
| packages/faustwp-cli/tests/healthCheck/validateFaustEnvVars.test.ts | Tests credential validation and diagnostics. |
| packages/faustwp-cli/src/utils/index.ts | Exports credential helpers. |
| packages/faustwp-cli/src/utils/getWpAuthHeaders.ts | Centralizes CLI authentication headers. |
| packages/faustwp-cli/src/telemetry/sendTelemetryData.ts | Supports either credential type. |
| packages/faustwp-cli/src/index.ts | Enables telemetry with either credential type. |
| packages/faustwp-cli/src/healthCheck/validateNextWordPressUrl.ts | Uses shared authentication headers. |
| packages/faustwp-cli/src/healthCheck/validateFaustEnvVars.ts | Validates credentials and reports authorization failures. |
| packages/faustwp-cli/src/generatePossibleTypes.ts | Authenticates introspection with selected credentials. |
| packages/faustwp-cli/src/blockset.ts | Supports authenticated block uploads. |
| docs/how-to/authentication/index.md | Documents setup, permissions, and limitations. |
Review effort: Balanced
…ssword that can't exchange tokens The health check rejected a 403 from validate_secret_key for every command. generatePossibleTypes, generateGlobalStylesheet and blockset call WordPress with their own permissions, so for them a user without faustwp_exchange_tokens now gets a warning instead of an exit.
…ssword The logout handler only sent FAUST_SECRET_KEY to FaustWP's logout route, so with an Application Password and no secret key, logging out skipped ending the WordPress session.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2678
Related: #2673, #2561, #2564, #1512, #1850, #2312
This is additive:
FAUST_SECRET_KEYkeeps working unchanged and still encrypts tokens, so nobody is logged out; whenFAUST_APPLICATION_USERandFAUST_APPLICATION_PASSWORDare set, core and the CLI use them instead, and FaustWP checks the newfaustwp_exchange_tokensandfaustwp_upload_blockscapabilities. Tested end to end in the getting-started example against WordPress 7.0 with only an Application Password and no secret key: previews, logout (including ending the WordPress session from #2684) andfaust generatePossibleTypeswork for a user with justreadandfaustwp_exchange_tokens, removing that capability gets a 403 and a clearfaust devwarning, and PHPUnit passes on single-site and Multisite; deprecating the secret key would be a separate, later change.Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Assisting with the capability checks, the core and CLI credential handling, tests, docs, and verifying against a local WordPress.