Connector mu-plugin `lamoi-connector`: secure core
Imported from GitHub issue El-SaMa/lamoi-waas#15 by @El-SaMa.
Goal
The only way TEKORI and OMA change a subsite. Typed operations, scoped tokens, validation, snapshots, undo and an audit log. No code execution, no SQL, no file writes outside uploads.
Tasks
- REST namespace
lamoi/v1; every operation has a JSON schema (input and output) published atlamoi/v1/schemafor the MCP layer. - Auth: OMA signs tokens (HMAC or Ed25519) scoped to
{site_id, scopes[], exp, actor}; network-level token for provisioning only; tokens never stored in plain text; clock skew handling; revocation list. - Scopes:
content:read|write,design:write,shop:read|write,users:invite,domains:write,plugins:toggle,site:admin(provisioning only). - Validation: block markup parsed and re-serialised (only allowed blocks),
wp_ksesfor text, URL and media checks, size limits. -
dry_run: truereturns a diff without writing; every write takes an idempotency key. - Snapshot before every write batch (subsite tables involved + changed options; media referenced), stored with an id;
undo(snapshot_id)op. Retention 30 days. - Destructive operations (delete page/product in bulk, remove domain, delete site, reset design) require a human confirm token issued by OMA after the user confirms (same pattern as
oma.confirm_tool). - Audit log table: actor, op, args hash, result, snapshot id, time; viewable in OMA.
- Rate limits per token; request size limits.
- Plugin definition of done: PHPCS + Plugin Check zero issues, security review loop, unit tests (WP test suite) for auth, scopes, validation, undo.
Acceptance criteria
- A token for site A cannot read or write site B (test).
- No operation can execute PHP, run SQL, write files outside uploads, install code, or change network settings with a site token (tests).
- Undo restores a page after a write (test).
Depends on
#4.
Plan key W15. Epic: El-SaMa/lamoi-waas#25.