Implement wp-login.php based cookie authentication

Cargo.toml

@@ -34,6 +34,7 @@ rstest = "0.21"
 rstest_reuse = "0.7.0"
 serde = "1.0"
 serde_json = "1.0"
+serde_urlencoded = "0.7"
 serial_test = "3.1"
 strum = "0.26"
 strum_macros = "0.26"

wp_api/Cargo.toml

@@ -22,6 +22,7 @@ paste = { workspace = true }
 regex = { workspace = true }
 serde = { workspace = true, features = [ "derive" ] }
 serde_json = { workspace = true }
+serde_urlencoded = { workspace = true }
 thiserror = { workspace = true }
 uniffi = { workspace = true }
 uuid = { workspace = true, features = [ "v4" ] }

wp_api/src/lib.rs

@@ -45,9 +45,17 @@ impl WpContext {
     }
 }
 
+/// WordPress site user account which is used to login from wp-login.php.
+#[derive(Debug, Clone, uniffi::Record)]
+pub struct WpLoginCredentials {
+    pub username: String,
+    pub password: String,
+}
+
 #[derive(Debug, Clone, uniffi::Enum)]
 pub enum WpAuthentication {
     AuthorizationHeader { token: String },
+    UserAccount { login: WpLoginCredentials },
     None,
 }
 

wp_api/src/login/login_client.rs

@@ -1,11 +1,14 @@
 use std::str;
 use std::sync::Arc;
 
-use crate::request::endpoint::WpEndpointUrl;
+use url::Url;
+
+use crate::request::endpoint::{ApiBaseUrl, WpEndpointUrl};
 use crate::request::{
-    RequestExecutor, RequestMethod, WpNetworkHeaderMap, WpNetworkRequest, WpNetworkResponse,
+    RequestExecutor, RequestMethod, WpNetworkHeaderMap, WpNetworkRequest, WpNetworkRequestBody,
+    WpNetworkResponse,
 };
-use crate::ParsedUrl;
+use crate::{ParsedUrl, WpLoginCredentials};
 
 use super::url_discovery::{
     self, FetchApiDetailsError, FetchApiRootUrlError, StateInitial, UrlDiscoveryAttemptError,
@@ -156,4 +159,92 @@ impl WpLoginClient {
             .await
             .map_err(FetchApiDetailsError::from)
     }
+
+    pub(crate) async fn insert_rest_nonce(
+        &self,
+        request: &WpNetworkRequest,
+        api_base_url: &ApiBaseUrl,
+        login: &WpLoginCredentials,
+    ) -> Option<WpNetworkRequest> {
+        // Only attempt login if the request is to the WordPress site.
+        if Url::parse(api_base_url.as_str()).ok()?.host_str()
+            != Url::parse(request.url.0.as_str()).ok()?.host_str()
+        {
+            return None;
+        }
+
+        let nonce = self.get_rest_nonce(api_base_url, login).await?;
+
+        let mut request = request.clone();
+        let mut headers = request.header_map.as_header_map();
+        headers.insert(
+            http::header::HeaderName::from_bytes("X-WP-Nonce".as_bytes())
+                .expect("This conversion should never fail"),
+            nonce.try_into().expect("This conversion should never fail"),
+        );
+        request.header_map = WpNetworkHeaderMap::new(headers).into();
+
+        Some(request)
+    }
+
+    async fn get_rest_nonce(
+        &self,
+        api_base_url: &ApiBaseUrl,
+        login: &WpLoginCredentials,
+    ) -> Option<String> {
+        let rest_nonce_url = api_base_url.derived_rest_nonce_url();
+        let rest_nonce_url_clone = rest_nonce_url.clone();
+        let nonce_request = WpNetworkRequest {
+            method: RequestMethod::GET,
+            url: rest_nonce_url.into(),
+            header_map: WpNetworkHeaderMap::new(http::HeaderMap::new()).into(),
+            body: None,
+        };
+
+        let nonce_from_request = |request: WpNetworkRequest| async move {
+            self.request_executor
+                .execute(request.into())
+                .await
+                .ok()
+                .and_then(|response| {
+                    // A 200 OK response from the `rest_nonce_url` (a.k.a `wp-admin/admin-ajax.php`)
+                    // should be the nonce value. However, just in case the site is configured to
+                    // return a 200 OK response with other content (for example redirection to
+                    // other webpage), here we check the body length here for a light validation of
+                    // the nonce value.
+                    if response.status_code == 200 {
+                        let body = response.body_as_string();
+                        if body.len() < 50 {
+                            return Some(body);
+                        }
+                    }
+                    None
+                })
+        };
+
+        if let Some(nonce) = nonce_from_request(nonce_request).await {
+            return Some(nonce);
+        }
+
+        let mut headers = http::HeaderMap::new();
+        headers.insert(
+            http::header::CONTENT_TYPE,
+            "application/x-www-form-urlencoded".parse().unwrap(),
+        );
+        let body = serde_urlencoded::to_string([
+            ["log", login.username.as_str()],
+            ["pwd", login.password.as_str()],
+            ["rememberme", "true"],
+            ["redirect_to", rest_nonce_url_clone.to_string().as_str()],
+        ])
+        .unwrap();
+        let login_request = WpNetworkRequest {
+            method: RequestMethod::POST,
+            url: api_base_url.derived_wp_login_url().into(),
+            header_map: WpNetworkHeaderMap::new(headers).into(),
+            body: Some(WpNetworkRequestBody::new(body.into_bytes()).into()),
+        };
+
+        nonce_from_request(login_request).await
+    }
 }

wp_api/src/request.rs

@@ -67,6 +67,7 @@ impl InnerRequestBuilder {
         );
         match self.authentication {
             WpAuthentication::None => (),
+            WpAuthentication::UserAccount { ref login } => (),
             WpAuthentication::AuthorizationHeader { ref token } => {
                 let hv = HeaderValue::from_str(&format!("Basic {}", token));
                 let hv = hv.expect("It shouldn't be possible to build WpAuthentication::AuthorizationHeader with an invalid token");
@@ -101,7 +102,7 @@ pub struct WpNetworkRequestBody {
 }
 
 impl WpNetworkRequestBody {
-    fn new(body: Vec<u8>) -> Self {
+    pub fn new(body: Vec<u8>) -> Self {
         Self { inner: body }
     }
 }
@@ -114,7 +115,7 @@ impl WpNetworkRequestBody {
 }
 
 // Has custom `Debug` trait implementation
-#[derive(uniffi::Object)]
+#[derive(Clone, uniffi::Object)]
 pub struct WpNetworkRequest {
     pub(crate) method: RequestMethod,
     pub(crate) url: WpEndpointUrl,

wp_api/src/request/endpoint.rs

@@ -80,6 +80,39 @@ impl ApiBaseUrl {
         site_base_url.try_into()
     }
 
+    pub(crate) fn derived_wp_login_url(&self) -> Url {
+        let mut url = self.url.clone();
+
+        if let Some(segments) = url.path_segments() {
+            if segments.last() == Some("") {
+                url.path_segments_mut()
+                    .expect("ApiBaseUrl is a full HTTP URL")
+                    .pop();
+            }
+        }
+
+        url.path_segments_mut()
+            .expect("ApiBaseUrl is a full HTTP URL")
+            .pop()
+            .push("wp-login.php");
+
+        url
+    }
+
+    pub(crate) fn derived_rest_nonce_url(&self) -> Url {
+        let mut url = self.derived_wp_login_url();
+
+        url.path_segments_mut()
+            .expect("login url is a full HTTP URL")
+            .pop()
+            .push("wp-admin")
+            .push("admin-ajax.php");
+
+        url.query_pairs_mut().append_pair("action", "rest-nonce");
+
+        url
+    }
+
     fn by_appending(&self, segment: &str) -> Url {
         self.url
             .clone()
@@ -106,7 +139,7 @@ impl ApiBaseUrl {
             .expect("ApiBaseUrl is already parsed, so this can't result in an error")
     }
 
-    fn as_str(&self) -> &str {
+    pub fn as_str(&self) -> &str {
         self.url.as_str()
     }
 }

wp_api_integration_tests/Cargo.toml

@@ -13,7 +13,7 @@ async-trait = { workspace = true }
 clap = { workspace = true, features = ["derive"] }
 futures = { workspace = true }
 http = { workspace = true }
-reqwest = { workspace = true, features = [ "json" ] }
+reqwest = { workspace = true, features = [ "json", "cookies" ] }
 serde = { workspace = true, features = [ "derive" ] }
 serde_json = { workspace = true }
 tokio = { workspace = true, features = [ "full" ] }

wp_api_integration_tests/src/lib.rs

@@ -134,6 +134,15 @@ impl Default for AsyncWpNetworking {
 }
 
 impl AsyncWpNetworking {
+    pub fn with_cookie_store() -> Self {
+        Self {
+            client: reqwest::ClientBuilder::new()
+                .cookie_store(true)
+                .build()
+                .unwrap(),
+        }
+    }
+
     pub async fn async_request(
         &self,
         wp_request: Arc<WpNetworkRequest>,

wp_derive_request_builder/src/generate.rs

@@ -64,7 +64,23 @@ fn generate_async_request_executor(config: &Config, parsed_enum: &ParsedEnum) ->
             quote! {
                 pub async #fn_signature -> Result<#output_type, #static_wp_api_error_type> {
                     #request_from_request_builder
-                    self.request_executor.execute(std::sync::Arc::new(request)).await?.parse()
+
+                    let cloned_request = request.clone();
+                    let result = self.request_executor.execute(request.into()).await;
+
+                    if let Ok(response) = &result {
+                        if response.status_code == 401 {
+                            if let crate::WpAuthentication::UserAccount { ref login } = self.request_builder.inner.authentication {
+                                let client = crate::login::WpLoginClient::new(self.request_executor.clone());
+                                let api_base_url = self.request_builder.endpoint.api_base_url.clone();
+                                if let Some(request) = client.insert_rest_nonce(&cloned_request, &api_base_url, login).await {
+                                    return self.request_executor.execute(request.into()).await?.parse();
+                                }
+                            }
+                        }
+                    }
+
+                    result?.parse()
                }
             }
         })