Initial commit: Aurora Admin plugin

2026-07-03 02:53:29 -05:00
commit 03cabe2fe4
73 changed files with 9591 additions and 0 deletions
@@ -0,0 +1,96 @@
+<?php
+namespace AuroraAdmin\Options;
+
+defined("ABSPATH") || exit();
+
+/**
+ * Single source of truth for the aurora_admin_settings option.
+ * Deliberately simple — no request-lifetime caching layer, no schema
+ * ceremony beyond what register_setting requires. Add fields as pages
+ * actually need them.
+ */
+class Settings
+{
+  const OPTION_NAME = "aurora_admin_settings";
+
+  public function __construct()
+  {
+    add_action("init", [self::class, "register"]);
+  }
+
+  public static function register()
+  {
+    register_setting("aurora-admin", self::OPTION_NAME, [
+      "type" => "object",
+      "default" => [],
+      "capability" => "manage_options",
+      // Merge incoming payloads into the stored value instead of replacing
+      // it wholesale. This lets pages save just the keys they own (e.g. the
+      // dashboard sends only dashboard_card_order, the shell only dark_mode)
+      // without wiping settings they never received — which matters because
+      // most pages get a sanitized copy with secrets stripped (see
+      // get_safe()) and must never write that stripped copy back.
+      "sanitize_callback" => [self::class, "merge_on_save"],
+      "show_in_rest" => [
+        "schema" => [
+          "type" => "object",
+          "properties" => [
+            "dark_mode" => ["type" => "string"],
+            "dashboard_card_order" => ["type" => "object"],
+          ],
+          "additionalProperties" => true,
+        ],
+      ],
+    ]);
+  }
+
+  public static function merge_on_save($value)
+  {
+    $existing = get_option(self::OPTION_NAME, []);
+    if (!is_array($existing)) {
+      $existing = [];
+    }
+    if (!is_array($value)) {
+      return $existing;
+    }
+    return array_merge($existing, $value);
+  }
+
+  public static function get($key = null, $default = null)
+  {
+    $settings = get_option(self::OPTION_NAME, []);
+    if (!is_array($settings)) {
+      $settings = [];
+    }
+
+    if ($key === null) {
+      return $settings;
+    }
+
+    return isset($settings[$key]) ? $settings[$key] : $default;
+  }
+
+  /**
+   * Settings safe to expose on every admin page (the shell serializes this
+   * for all logged-in users). Strips secrets: the license key and remote
+   * site application passwords. The settings page itself (manage_options
+   * only) uses get() and receives the full value.
+   */
+  public static function get_safe()
+  {
+    $settings = self::get();
+
+    unset($settings["license_key"]);
+
+    if (isset($settings["remote_sites"]) && is_array($settings["remote_sites"])) {
+      $settings["remote_sites"] = array_values(array_map(function ($site) {
+        return [
+          "url" => isset($site["url"]) ? $site["url"] : "",
+          "username" => isset($site["username"]) ? $site["username"] : "",
+        ];
+      }, $settings["remote_sites"]));
+    }
+
+    return $settings;
+  }
+}