Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

feat: connect Faust.js to WordPress with an Application Password

Chiusa
  • Qualcosa non va?
#2,678 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@josephfusco ci sta già lavorando.

Dal 20/10/2026.

  • #2676 di @josephfusco — aperta

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript, wordpress
Ambito
authentication, backend

Direzione di ricerca

Start by tracing how FAUST_SECRET_KEY authenticates token exchange, blockset uploads, schema introspection, health checks, and telemetry in Faust.js core and the CLI; the issue does not name specific files or tests. Then check how WordPress Application Passwords expose authenticated users and capabilities. Done means these requests can use Application Passwords with the stated capability checks while the existing secret key continues to work and encrypt tokens.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

[Area] CLI [Area] Core [Area] WordPress Plugin [Type] Feature

Every request from a Faust.js server or the CLI to WordPress authenticates with the shared FAUST_SECRET_KEY: the token exchange, faust blockset, schema introspection for faust generatePossibleTypes, the CLI's health checks and telemetry. One value does all of these, so a credential that only needs to exchange tokens can also upload blocksets, and rotating it logs every user out because the plugin also uses it to encrypt tokens.

Proposal

Let core and the CLI authenticate with a WordPress Application Password instead, checked against capabilities:

  • faustwp_exchange_tokens for the token exchange, health checks and telemetry. Administrators have it, and it can be added to a custom role for a dedicated user.
  • faustwp_upload_blocks for blockset uploads, limited to users who can manage the site's options (the network's on Multisite).
  • Schema introspection works for any authenticated Application Password, since WPGraphQL already allows it.

FAUST_SECRET_KEY keeps working and keeps encrypting tokens, so this is additive. Whether and when to deprecate the secret key is a separate decision.

Trade-offs

  • WordPress only accepts Application Passwords over HTTPS or on local environments.
  • Some servers strip the Authorization header, and sites protected with HTTP Basic auth can't use Application Passwords, since both use that header (see #1850, #1524, #851).

Related

  • #2673 documents Application Passwords for server-side writes, replacing the service-key idea in #2561.
  • #2564 and #1512: authentication outside Next.js relies on existing tools rather than a Faust package.
  • #2310 / #2312: how the secret key is compared today.
Lingua principale
TypeScript
Stelle
1.6k
Fork
157
Merge medio
1g 5h
PR unite (30g)
126

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di wpengine/faustjs

Tutte le issue di wpengine/faustjs

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.