LicenseOAuthController
\Benecaster\REST\LicenseOAuthController
Handles connecting and disconnecting a show’s license — POST /license/oauth/start and POST /license/oauth/deactivate.
Constructor Dependencies
| Type | Description |
|---|---|
\Benecaster\License\OAuthInitiator |
Starts the authorisation flow. |
\Benecaster\License\LicenseClient |
Talks to the license server. |
\Benecaster\License\ShowTokenRepository |
Stores and clears the per-show site token. |
\Benecaster\License\ShowAddonRepository |
Defaulted, so three-argument construction works. |
Methods
| Method | Visibility | Since | Description |
|---|---|---|---|
register_routes(): void |
Public | — | Registers POST /license/oauth/start and POST /license/oauth/deactivate, both permission_callback_admin. |
start( WP_REST_Request $request ): WP_REST_Response |
Public | — | Body: show_id (post ID). 400 missing_show_id when absent/empty; 400 invalid_show_id when it isn't a positive int or isn't a show CPT post. Lazy-generates the show's _benecaster_show_uuid via ShowMeta::ensure_show_uuid() as a defence against a save_post meta-write failure — the Connect button must never be clickable without a stable identifier to bind the issued token to. Returns {redirect_url} from OAuthInitiator::start(), the URL the browser navigates to for the PKCE handshake (verifier + challenge + opaque state nonce are generated and stashed in a transient inside the initiator, not here). |
deactivate( WP_REST_Request $request ): WP_REST_Response |
Public | — | Body: show_id. Same 400 missing_show_id / invalid_show_id checks as start(). 400 no_show_uuid when the show has never been assigned a UUID (never connected). Calls the license server's /deactivate with the site URL and show UUID on a best-effort basis — local state is cleared regardless of whether the server call succeeds. Deletes the per-show bearer token (ShowTokenRepository::delete_show_token()) and both per-show add-on layers (ShowAddonRepository::delete_show_addons()). Site-level license state (plan, add-ons, subscriber count) is untouched — only the one show is disconnected. Returns {deactivated: true} unconditionally. |
Notes
Extends the plugin's internal RestController base — not part of the public API; its own
docblock tells add-on developers not to extend it, and to register independent routes on
rest_api_init with the public benecaster_rest_permission_admin() function instead. Inherits
register() (hooks register_routes() onto rest_api_init), the permission_callback_admin /
permission_callback_editor / permission_callback_subscriber callbacks, rest_error(), and
not_found(). This class returns raw WP_REST_Response objects for its 400s rather than using
rest_error()/not_found().
Disconnecting a show clears BOTH per-show add-on layers, not just the site token —
ShowAddonRepository::delete_show_addons().
Dropping the activation set is deliberate, and the reason is not obvious. A disconnected show can be reconnected to a different license. A surviving switch-off would then arrive on the new license with nobody having made it — the customer would see an add-on they now pay for sitting switched off, with no record of who turned it off or when.
The grant cache is dropped for the simpler reason that it is meaningless without a token.