allow for non-licensed plugins to use TrustedLogin

[inztinkt]

• rename auth/license_key in config object to 'auth/access_key`
• add:

if get_setting( 'auth/access_key' ) == false  { 
  set $access_key = md5( get_site_url() . get_setting( 'vendor/namespace') );
}

• ensure that the generated $access_key is shown on the confirmation box with instructions to share it with vendor's support team

(Note: this is added so that free plugins and WP org plugins can offer TL-powered support.

[inztinkt]

@zackkatz i've begun building this out.

• I've left auth/license_key in config object as its better to explain what we expect there (in docs etc)
• added that if get_setting( 'auth/license_key' ) is false or empty then generate the <accessKey> via the following function:

    private function make_shareable_accesskey(){

		$hash = md5( get_site_url() . $this->get_setting( 'auth/public_key' ) );

		/**
		 * Filter: Allow for over-riding the shareable 'accessKey' prefix
		 *
		 * @since 0.9.2
		 */
		$access_key_prefix  = apply_filters( 'trustedlogin/' . $this->ns . '/access_key_prefix' , 'TL|');
		
		$length 			= strlen( $access_key_prefix );
		$access_key 		= $access_key_prefix . substr( $hash, $length );

		return $access_key;
	}

• this allows for us/the vendor to visually identify if it's an autogenerated/shareable key or something more private like a license key. Overkill or good idea?

What I am working on now, is displaying this shareable key on jconfirm via TrustedLogin::output_secondary_alerts() regardless of whether the sync succeeds or not, as they'll need to share it with support. Any gotchas I should keep in mind with this function/parameters?

[zackkatz]

Let’s store in DB and make available via a static method so people can show easily on plugin support pages

[inztinkt]

Great idea.

As for the output, I'm thinking we might have to build a whole new jconfirm output (if using shareable accesskey) instead of just replacing the error message output (which was going to be my first approach, but now seems really silly)

[zackkatz]

Okay and if that’s the case, we should use thickbox for pure WP. But first things first :-)

[inztinkt]

What are your thoughts on the ::get_access_key() function always returning a shareable accessKey?

This way even devs of licensed plugins can present this information on their plugin support pages.

[zackkatz]

Yes, that's what I was thinking as well.

[inztinkt]

Alrighty, working on that now.

[inztinkt]

Ok that's set up, i see that you're redirecting users to wp-admin/users.php?role=... from the button if a support user exists, shall we instead popup the accessKey now with instructions that sharing this with get_setting(vendor/name) will give them (and only them) secure access to your site?

[zackkatz]

Sure. Sounds good.

[inztinkt]

Ok so that now this shows on second click (after page reload):

Shall we add TrustedLogin Key output to success/server error responses?

[zackkatz]

Nice, yeah let’s make it available wherever possible.

…

On Feb 14, 2020, at 3:25 PM, Hector K ***@***.***> wrote: Ok so that now this shows on second click (after page reload): <https://user-images.githubusercontent.com/251348/74573568-f08c6e80-4f4e-11ea-8e52-b750cc54f03b.png> Shall we add TrustedLogin Key output to success/server error responses? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#20>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGUUQ5SNOZ5WW7KERWV4F3RC4K6VANCNFSM4KUEGXSQ>.

[inztinkt]

Actually, I went down the rabbit hole there...

The accessKey for licensed plugins/themes, is that customer's license_key 🤦‍♂️

So vendors can always find authorized sessions via their customers' license keys, like our helpdesk code does.

[zackkatz]

Ah, right…I guess only show if licensing is false.

…

On Feb 14, 2020, at 3:40 PM, Hector K ***@***.***> wrote: Actually, I went down the rabbit hole there... The accessKey for licensed plugins/themes, is any customer's license_key 🤦‍♂️ So vendors can always find authorized sessions via their customers' license keys, like our helpdesk software does. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#20>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGUUQ6EMADLNFAEF234K7DRC4MUNANCNFSM4KUEGXSQ>.