Skip to content

feat: Add WordPress.com OAuth support to iOS and Android demo apps#339

Draft
jkmassel wants to merge 5 commits intotrunkfrom
jkmassel/wordpress-com-support
Draft

feat: Add WordPress.com OAuth support to iOS and Android demo apps#339
jkmassel wants to merge 5 commits intotrunkfrom
jkmassel/wordpress-com-support

Conversation

@jkmassel
Copy link
Contributor

@jkmassel jkmassel commented Feb 25, 2026

What?

Add WordPress.com OAuth2 authentication support to both the Android and iOS demo apps, alongside the existing Application Passwords flow for self-hosted sites.

Why?

The demo apps previously only supported self-hosted WordPress sites via Application Passwords. This PR adds OAuth2 support so the apps can also connect to WordPress.com sites, and upgrades credential storage to use encrypted repositories on both platforms.

How?

Android

  • Branch on DiscoveredAuthenticationMechanism to launch the appropriate auth flow (Application Passwords or OAuth2)
  • Store WP.com accounts as Account.WpCom so auth type is determined by pattern matching
  • Replace SharedPreferences with encrypted AccountRepository from wordpress-rs, backed by Android Keystore
  • Add WP.com site namespace handling in SitePreparationViewModel

iOS

  • Add AuthenticationManager with async/throws API supporting both Application Passwords and OAuth2 flows
  • Replace UserDefaults-based ConfigurationStorage with encrypted AccountRepository from wordpress-rs (SecureEnclavePasswordTransformer)
  • Use WpComDotOrgApiUrlResolver for correct WP.com API URL routing
  • Propagate errors from ConfigurationStorage instead of swallowing them

Shared (JS/Web)

  • Replace fetch-based editor asset loading with config injection via window.GBKit.editorAssets
  • Guard against duplicate site namespace insertion in the API path modifier middleware
  • Move shared OAuth credentials file to project root, referenced by both platforms

Testing Instructions

  1. Self-hosted (Android or iOS): Tap "Add WordPress site", enter a self-hosted site URL → Application Passwords flow → verify editor loads
  2. WordPress.com (Android or iOS): Copy wp_com_oauth_credentials.json.example to wp_com_oauth_credentials.json in the project root, fill in client_id/secret → enter a WP.com site URL → OAuth browser flow → verify editor loads with plugins and theme styles
  3. Verify sites persist across app restarts
  4. Verify site deletion works (iOS: swipe to delete, Android: long-press)

🤖 Generated with Claude Code

@jkmassel jkmassel added the [Type] Enhancement A suggestion for improvement. label Feb 25, 2026
@jkmassel jkmassel force-pushed the jkmassel/wordpress-com-support branch from 5eeb6cc to 0b13e7f Compare February 25, 2026 21:12
@jkmassel jkmassel force-pushed the jkmassel/wordpress-com-support branch 2 times, most recently from 8681b6b to 6bc5e33 Compare February 25, 2026 22:36
jkmassel and others added 5 commits March 18, 2026 14:53
Add OAuth2 authentication for WordPress.com sites alongside the
existing Application Passwords flow for self-hosted sites.

- Branch on DiscoveredAuthenticationMechanism to launch the appropriate
  auth flow (Application Passwords or OAuth2)
- Store WP.com accounts as Account.WpCom so auth type is determined by
  pattern matching rather than URL sniffing
- Replace SharedPreferences with encrypted AccountRepository from
  wordpress-rs, backed by Android Keystore
- Load OAuth client credentials from a shared project-root JSON file
- Add WP.com site namespace handling in SitePreparationViewModel

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace fetch-based editor asset loading with config injection via
  window.GBKit.editorAssets, removing the manifest message handler from
  EditorAssetBundleProvider
- Add editorAssets support to GBKitGlobal on both iOS and Android
- Guard against duplicate site namespace insertion in the API path
  modifier middleware
- Remove fetchEditorAssets from the JS bridge exports

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The block inserter shows Paragraph in both "Most Used" and "Text"
sections, causing `app.buttons["Paragraph"]` to match multiple
elements. Use `.firstMatch` to select the first one.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add OAuth2 authentication for WordPress.com sites to the iOS demo app,
with encrypted credential storage and proper WP.com API routing.

- Add AuthenticationManager with async/throws API supporting both
  Application Passwords and OAuth2 flows
- Replace UserDefaults-based ConfigurationStorage with encrypted
  AccountRepository from wordpress-rs (SecureEnclavePasswordTransformer)
- Use WpComDotOrgApiUrlResolver for correct WP.com API URL routing
- Propagate errors from ConfigurationStorage instead of swallowing them
- Move shared OAuth credentials file to project root, referenced by
  both platforms via relative paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@jkmassel jkmassel changed the title feat: Add WordPress.com OAuth support to Android demo app feat: Add WordPress.com OAuth support to iOS and Android demo apps Mar 18, 2026
@jkmassel jkmassel force-pushed the jkmassel/wordpress-com-support branch from 33d52c7 to 22384d6 Compare March 18, 2026 20:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

[Type] Enhancement A suggestion for improvement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant