Skip to main content

LicenseOAuthController

\Benecaster\REST\LicenseOAuthController

Class Free

Handles connecting and disconnecting a show’s license — POST /license/oauth/start and POST /license/oauth/deactivate.

Constructor Dependencies

Type Description
\Benecaster\License\OAuthInitiator Starts the authorisation flow.
\Benecaster\License\LicenseClient Talks to the license server.
\Benecaster\License\ShowTokenRepository Stores and clears the per-show site token.
\Benecaster\License\ShowAddonRepository Defaulted, so three-argument construction works.

Methods

Method Visibility Since Description
register_routes(): void Public — Registers POST /license/oauth/start and POST /license/oauth/deactivate, both permission_callback_admin.
start( WP_REST_Request $request ): WP_REST_Response Public — Body: show_id (post ID). 400 missing_show_id when absent/empty; 400 invalid_show_id when it isn't a positive int or isn't a show CPT post. Lazy-generates the show's _benecaster_show_uuid via ShowMeta::ensure_show_uuid() as a defence against a save_post meta-write failure — the Connect button must never be clickable without a stable identifier to bind the issued token to. Returns {redirect_url} from OAuthInitiator::start(), the URL the browser navigates to for the PKCE handshake (verifier + challenge + opaque state nonce are generated and stashed in a transient inside the initiator, not here).
deactivate( WP_REST_Request $request ): WP_REST_Response Public — Body: show_id. Same 400 missing_show_id / invalid_show_id checks as start(). 400 no_show_uuid when the show has never been assigned a UUID (never connected). Calls the license server's /deactivate with the site URL and show UUID on a best-effort basis — local state is cleared regardless of whether the server call succeeds. Deletes the per-show bearer token (ShowTokenRepository::delete_show_token()) and both per-show add-on layers (ShowAddonRepository::delete_show_addons()). Site-level license state (plan, add-ons, subscriber count) is untouched — only the one show is disconnected. Returns {deactivated: true} unconditionally.

Notes

Extends the plugin's internal RestController base — not part of the public API; its own docblock tells add-on developers not to extend it, and to register independent routes on rest_api_init with the public benecaster_rest_permission_admin() function instead. Inherits register() (hooks register_routes() onto rest_api_init), the permission_callback_admin / permission_callback_editor / permission_callback_subscriber callbacks, rest_error(), and not_found(). This class returns raw WP_REST_Response objects for its 400s rather than using rest_error()/not_found().

Disconnecting a show clears BOTH per-show add-on layers, not just the site token — ShowAddonRepository::delete_show_addons().

Dropping the activation set is deliberate, and the reason is not obvious. A disconnected show can be reconnected to a different license. A surviving switch-off would then arrive on the new license with nobody having made it — the customer would see an add-on they now pay for sitting switched off, with no record of who turned it off or when.

The grant cache is dropped for the simpler reason that it is meaningless without a token.