Add WP.com OAuth login support by jkmassel · Pull Request #1190 · Automattic/wordpress-rs

jkmassel · 2026-02-24T23:00:57Z

Summary

Add WordPress.com OAuth login alongside the existing self-hosted Application Passwords flow.

Migrate iOS/macOS and Kotlin example apps to AccountRepository with encrypted credential storage
Add WP.com-specific screens to the Kotlin example app (Me, Site, Bot Conversations, Support Conversations)
Add OAuth configuration discovery during site login
Add WP.com login flow for the Swift example app
Support WP.com OAuth login for sites discovered via the self-hosted flow
Add swipe-to-delete for saved sites on the welcome screen
Remove hardcoded site URL from login screen

Depends on #1189.

Test plan

Self-hosted Application Passwords login still works on both iOS and Android
WP.com OAuth login works on both iOS and Android
Sites persist across app launches
Swipe-to-delete removes saved sites

🤖 Generated with Claude Code

* CMM-1260 Add stats devices screensize endpoint Add the /stats/devices/screensize WP.com REST API endpoint with shared device stats types (params, response, period enum) and JSON test fixtures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CMM-1260 Add stats devices browser endpoint Add the /stats/devices/browser WP.com REST API endpoint, reusing shared device stats types, with JSON test fixtures for browser usage data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CMM-1260 Add stats devices platform endpoint Add the /stats/devices/platform WP.com REST API endpoint, reusing shared device stats types, with JSON test fixtures for platform usage data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Handle empty array response in stats devices top_values Use deserialize_empty_array_or_hashmap for top_values since the API returns [] instead of {} when there is no data. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* CMM-1258 Add stats clicks endpoint for Traffic tab Add the /stats/clicks WP.com REST API endpoint with support for summarize=1 (summary) and summarize=0 (days) response modes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CMM-1258 Add stats search terms endpoint for Traffic tab Add the /stats/search-terms WP.com REST API endpoint with support for summarize=1 (summary) and summarize=0 (days) response modes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CMM-1258 Add stats video plays endpoint for Traffic tab Add the /stats/video-plays WP.com REST API endpoint. This endpoint has a unique response structure where data is always inside days.summary. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CMM-1258 add stats file-downloads endpoint Add the /rest/v1.1/sites/{site_id}/stats/file-downloads endpoint following the same pattern as other stats endpoints. Includes types, endpoint definition, JSON test fixtures, and client wiring. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CMM-1258 Change skip_archives from Option<bool> to bool with default true Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

The `interceptors` parameter in the secondary constructors of `WpLoginClient` and `WpRequestExecutor` was the only parameter without a default value, requiring callers to always pass it explicitly. This adds `= listOf()` as the default to match the pattern of the other parameters. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* Parse custom taxonomy terms in SparseAnyPost * Remove a redundant unit test in Kotlin * Run `cargo fmt`

Bumps [fastlane-plugin-wpmreleasetoolkit](https://github.com/wordpress-mobile/release-toolkit) from 14.0.0 to 14.1.0. - [Release notes](https://github.com/wordpress-mobile/release-toolkit/releases) - [Changelog](https://github.com/wordpress-mobile/release-toolkit/blob/trunk/CHANGELOG.md) - [Commits](wordpress-mobile/release-toolkit@14.0.0...14.1.0) --- updated-dependencies: - dependency-name: fastlane-plugin-wpmreleasetoolkit dependency-version: 14.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add test cases to reproduce an issue * Add another integration test * Refresh the metadata collection list locally to bring in post updates * Update integration tests * Add another integration test * Remove refresh_post * Log errors * Add a couple more integration tests * Check categories and tags in loosely_matches_post

Introduces `AccountRepository` for encrypted credential storage and `AesGcmPasswordTransformer`, a pure-Rust AES-256-GCM password encryption implementation exposed via UniFFI. The `PasswordTransformer` trait uses `#[uniffi::export(with_foreign)]` so platforms can provide their own implementations (e.g. hardware- backed encryption) while the Rust one serves as a cross-platform fallback — particularly for Linux where platform keystores are unavailable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Exports persistence types (AccountRepository, PasswordTransformer, etc.) to the public Swift API. Conditionally re-exports AesGcmPasswordTransformer on Linux via #if os(Linux) so third-party clients can use it through `import WordPressAPI` without reaching into WordPressAPIInternal. Adds AesGcmPasswordTransformerTests exercising the Rust-backed UniFFI transformer — guarded with #if os(Linux) since the type is only available there (the Apple xcframework is built with --no-default-features which excludes aes-gcm-encryption). On Apple platforms, SecureEnclavePasswordTransformer fills this role instead. Fixes the testRoot() test on Linux by gating it with there, and adds request timeouts to prevent hangs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@suite

…tion Hardware-backed PasswordTransformer for Apple platforms using ECIES (P-256 ECDH + HKDF-SHA256 + AES-256-GCM). Falls back to software keys on simulators. Guarded with #if canImport(CryptoKit) so it compiles out cleanly on Linux. All Secure Enclave tests run under a single @suite(.serialized) to prevent cooperative thread pool deadlocks — SE key creation blocks the calling thread, and Swift Testing's fixed-size cooperative pool deadlocks when all threads block simultaneously. See: https://forums.swift.org/t/cooperative-pool-deadlock-when-calling-into-an-opaque-subsystem/70685 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Hardware-backed PasswordTransformer for Android using the Android Keystore with AES-256-GCM. Prefers StrongBox (API 28+) and falls back to TEE. Exposes isHardwareBacked property for callers to check the security level. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add OAuth2 configuration discovery during site login, WP.com OAuth login improvements, and support for WP.com OAuth login for sites discovered via the self-hosted flow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Migrate iOS/macOS example app to AccountRepository with SecureEnclavePasswordTransformer. Add WP.com OAuth login flow and credential bundle support. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jkmassel mentioned this pull request Feb 24, 2026

Add data type screens to Android example app #1191

Draft

5 tasks

jkmassel force-pushed the add/wpcom-oauth-login branch from 9d527ca to 8cc368f Compare February 24, 2026 23:39

Fix a crash after using a higher versioned database (#1178)

684a519

jkmassel force-pushed the add/password-encryption branch from 867fb66 to 0aa9929 Compare February 24, 2026 23:47

jkmassel force-pushed the add/wpcom-oauth-login branch from 8cc368f to 52a0ea4 Compare February 25, 2026 06:57

adalpari and others added 2 commits February 25, 2026 16:10

jkmassel force-pushed the add/wpcom-oauth-login branch 2 times, most recently from 7a5a5dd to e9012f6 Compare February 25, 2026 16:29

jkmassel mentioned this pull request Feb 25, 2026

feat: Add WordPress.com OAuth support to Android demo app wordpress-mobile/GutenbergKit#339

Draft

crazytonyli and others added 2 commits February 26, 2026 10:02

Parse custom taxonomy terms in SparseAnyPost (#1177)

a055f1b

* Parse custom taxonomy terms in SparseAnyPost * Remove a redundant unit test in Kotlin * Run `cargo fmt`

jkmassel mentioned this pull request Feb 25, 2026

Add helper APIs for authentication callback handling #1198

Open

jkmassel force-pushed the add/password-encryption branch 4 times, most recently from 7f822ed to d77cc25 Compare February 25, 2026 21:41

crazytonyli added 2 commits February 26, 2026 11:20

Move creating new endpoints to a skill (#1193)

83f78ba

jkmassel force-pushed the add/password-encryption branch 9 times, most recently from a8684c9 to 115e7db Compare February 25, 2026 23:41

Add a step to enable mutability on certain structs (#1197)

efb7f56

jkmassel force-pushed the add/password-encryption branch 6 times, most recently from 2648ac7 to 0dc3eff Compare February 26, 2026 00:26

jkmassel force-pushed the add/wpcom-oauth-login branch from c2b404d to 0bdba53 Compare February 26, 2026 00:38

jkmassel force-pushed the add/password-encryption branch from 0dc3eff to 58196fc Compare February 26, 2026 01:19

jkmassel and others added 4 commits February 25, 2026 18:19

jkmassel force-pushed the add/password-encryption branch from 58196fc to 22fbd5d Compare February 26, 2026 01:19

jkmassel mentioned this pull request Feb 26, 2026

Add PasswordTransformer trait with platform implementations #1189

Open

5 tasks

jkmassel force-pushed the add/wpcom-oauth-login branch 3 times, most recently from 4121579 to c0c5a51 Compare February 26, 2026 02:01

Add WP.com OAuth login and configuration discovery

3cb89fa

Add OAuth2 configuration discovery during site login, WP.com OAuth login improvements, and support for WP.com OAuth login for sites discovered via the self-hosted flow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jkmassel force-pushed the add/wpcom-oauth-login branch 3 times, most recently from 68fc01e to 9c77848 Compare February 26, 2026 17:12

Adopt WP.com OAuth in Swift example app

bf781f0

Migrate iOS/macOS example app to AccountRepository with SecureEnclavePasswordTransformer. Add WP.com OAuth login flow and credential bundle support. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jkmassel force-pushed the add/wpcom-oauth-login branch from 9c77848 to bf781f0 Compare February 26, 2026 18:26

jkmassel force-pushed the add/password-encryption branch from 22fbd5d to 6a0b82d Compare February 28, 2026 00:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add WP.com OAuth login support#1190

Add WP.com OAuth login support#1190
jkmassel wants to merge 15 commits intoadd/password-encryptionfrom
add/wpcom-oauth-login

jkmassel commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jkmassel commented Feb 24, 2026

Summary

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants