uukidev

<p><strong>YUI Preview Token</strong> solves the authentication problem in decoupled (headless) WordPress architectures. Application Passwords are a great built-in WordPress feature for this purpose, but they require managing long-lived secrets on the frontend side. This plugin instead issues per-post tokens that grant read access for a configurable period — no persistent secrets required.</p>
<p>The frontend (Astro, Next.js, Nuxt, etc.) receives a preview URL and can fetch the draft content directly via the REST API.</p>
<h4>How it works</h4>
<ol>
<li>An authorized WordPress user generates a token from the Gutenberg sidebar, Quick Edit panel, or Classic Editor meta box.</li>
<li>The token is embedded in a preview URL pointing to your external frontend.</li>
<li>The frontend calls <code>/wp-json/yui-preview-token/v1/preview?token=…</code> to retrieve the draft content.</li>
<li>The token expires automatically; no manual cleanup needed.</li>
</ol>
<h4>Key Features</h4>
<p><strong>Token Management</strong></p>
<ul>
<li>Generate tokens with expiry presets: 1 hour, 24 hours, 30 days, custom date/time, or no expiry.</li>
<li>One token per post — issuing a new token invalidates the previous one.</li>
<li>Tokens are generated with <code>bin2hex(random_bytes(32))</code> (256-bit CSPRNG). The lookup key stored in <code>wp_options</code> is the SHA-256 hash of the raw token, not the token itself — so a database leak does not expose usable tokens directly.</li>
<li>Automatic cleanup of expired tokens via WP Cron (daily).</li>
</ul>
<p><strong>Editor Integration</strong></p>
<ul>
<li><strong>Gutenberg</strong>: dedicated panel in the Document Settings sidebar.</li>
<li><strong>Quick Edit</strong>: token controls directly in the post list.</li>
<li><strong>Classic Editor</strong>: meta box in the editor sidebar.</li>
<li>Copy preview URL to clipboard with one click.</li>
<li>Update expiry without invalidating the current token.</li>
</ul>
<p><strong>Admin Settings</strong></p>
<ul>
<li>Set the external frontend URL (clicking “Open external preview” navigates directly to this URL).</li>
<li>Configure allowed CORS origins (multiple, with wildcard support — <code>https://*.example.com</code>).</li>
<li>Choose the minimum WordPress role required to issue tokens (Subscriber <span aria-hidden="true" class="wp-exclude-emoji">→</span> Administrator).</li>
<li>Tune rate limiting (requests per time window).</li>
<li>Optionally permit no-expiry tokens.</li>
</ul>
<p><strong>Issued Tokens List</strong></p>
<ul>
<li>View all active and expired tokens with post title, status, expiry, and issuer.</li>
<li>Revoke individual tokens or bulk-delete expired ones — all from the Settings screen.</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>HTTPS required for the preview endpoint (overridable for local development).</li>
<li>Per-IP rate limiting with configurable thresholds (default: 30 req / 60 s).</li>
<li>Role-based access control for token issuance.</li>
<li>CORS headers only sent for explicitly configured origins; WP core’s permissive echo-back is suppressed.</li>
<li><code>Referrer-Policy: no-referrer</code> prevents token leakage via referer headers.</li>
<li>Tokens are only valid for <code>draft</code>, <code>pending</code>, and <code>future</code> post statuses.</li>
<li>Admin-only settings page with defence-in-depth capability checks.</li>
<li>CSRF protection on all admin actions (nonce verification).</li>
</ul>
<p><strong>Audit Logging</strong></p>
<ul>
<li>Logs token issuance and usage events (post ID, user ID, client IP).</li>
<li>Logs security events: invalid token attempts, rate-limit violations, capability denials.</li>
<li>Output goes to <code>WP_DEBUG_LOG</code> by default; point to a dedicated file with <code>PVT_LOG_FILE</code>.</li>
</ul>
<p><strong>Internationalisation</strong></p>
<ul>
<li>Ships with Japanese (ja) and Simplified Chinese (zh_CN) translations.</li>
<li>All admin UI strings are translation-ready.</li>
</ul>
<h4>Developer Hooks</h4>
<p><strong>Filter</strong></p>
<ul>
<li><code>yuipt_preview_response_data</code> — Modify the REST API response data before it is sent.</li>
</ul>
<p><strong>Actions</strong></p>
<ul>
<li><code>yuipt_token_issued( int $post_id, int $user_id )</code> — Fires after a token is issued.</li>
<li><code>yuipt_token_used( int $post_id, int $user_id )</code> — Fires when a token is used successfully.</li>
<li><code>yuipt_invalid_token( string $ip )</code> — Fires on an invalid/expired token attempt.</li>
<li><code>yuipt_rate_limit_exceeded( string $ip, string $endpoint )</code> — Fires when rate limit is hit.</li>
<li><code>yuipt_capability_denied( int $user_id, int $post_id )</code> — Fires on a capability denial.</li>
</ul>
<p><strong>Constants (wp-config.php)</strong></p>
<ul>
<li><code>PVT_SKIP_HTTPS_CHECK</code> — Set to <code>true</code> to disable the HTTPS requirement (development only).</li>
<li><code>PVT_LOG_FILE</code> — Absolute path to a dedicated audit log file.</li>
</ul>
<h4>Use Case</h4>
<p>This plugin is designed for <strong>headless WordPress</strong> setups where a decoupled frontend (e.g. Astro, Next.js, Nuxt, SvelteKit) renders content from the WordPress REST API. It gives content editors a simple, secure way to share draft previews with stakeholders without granting them WordPress accounts or exposing long-lived API credentials.</p>


YUI Preview Token

Issue time-limited preview tokens for headless WordPress setups. Open drafts directly in your frontend URL without long-lived credentials.

sakurainternet

<p><strong>Auto Login for Sakura Rental Server</strong> allows administrators to issue one-time, time-limited auto-login URLs using HMAC signatures.<br />
This is useful for secure temporary access or system integration.</p>
<p>Features:<br />
– Secure auto-login with one-time tokens<br />
– Tokens are HMAC-signed and invalidated after use<br />
– Token issuance and usage history (up to 100 entries per user)<br />
– Records IP address and username of the issuer<br />
– Rate limiting: 1 request per second per IP<br />
– WP-CLI commands for token generation and history inspection</p>
<p>Example use cases:<br />
– Temporarily granting admin access<br />
– Safe automatic login from external systems<br />
– Keeping an audit log of who issued a token and from where</p>
<h3>Usage</h3>
<h3>Generate a token via CLI</h3>
<pre><code>wp auto-login-for-sakura-rental-server generate <user_id> [–expires=] [–remote_addr=] [–username=]
</code></pre>
<p>Example:</p>
<ul>
<li>Default expiration time: 300 seconds  </li>
<li><code>--expires</code> and <code>--username</code> are optional</li>
</ul>
<h3>Check issue history</h3>
<p>Token history is stored in the user meta key <code>sakura_auto_login_history</code>.<br />
You can check it via WP-CLI:</p>
<p>wp user meta get  sakura_auto_login_history</p>
<h3>Auto-login URL format</h3>
<pre><code>https://example.com/?rs_auto_login_token=<64-character HMAC token>
</code></pre>
<p>Visiting the URL will log in as the corresponding user and redirect to the admin dashboard.</p>
<h3>Security Notes</h3>
<ul>
<li>Tokens are invalidated immediately after use (one-time only)</li>
<li>Issue and usage history includes IP address, issuer username, and timestamps</li>
<li>Stored using <code>update_option()</code> for caching compatibility</li>
<li>HTTPS is strongly recommended</li>
</ul>


Auto Login for Sakura Rental Server

Provides one-time auto-login URLs with HMAC signatures and time limits.

YUI Preview Token vs Auto Login for Sakura Rental Server