Add prompt to authenticate with application passwords #23726

crazytonyli · 2024-10-30T08:25:44Z

Note

This PR is built on top of #23715.

The main change in this PR is taken from #23572, which is opening up "Application Passwords" entry (and upcoming "Users") to all self-hosted sites, with a prompt (RestApiUpgradePrompt) for application password authentication if the site is not authenticated with application password.

Here is a walkthrough video:

Simulator.Screen.Recording.-.iPhone.16.-.2024-10-30.at.21.22.21.mp4

Regression Notes

Potential unintended areas of impact
What I did to test those areas of impact (or what existing automated tests I relied on)
What automated tests I added (or what prevented me from doing so)

PR submission checklist:

I have completed the Regression Notes.
I have considered adding unit tests for my changes.
I have considered adding accessibility improvements for my changes.
I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

Testing checklist:

dangermattic · 2024-10-30T08:26:08Z

	1 Warning
⚠️	This PR is assigned to the milestone 25.6. This milestone is due in less than 4 days. Please make sure to get it merged by then or assign it to a milestone with a later deadline.

Generated by 🚫 Danger

crazytonyli · 2024-10-30T08:28:44Z

Modules/Sources/WordPressUI/Components/RestApiUpgradePrompt.swift

+
+            if #available(iOS 16.4, *) {
+                scrollView.scrollBounceBehavior(.basedOnSize, axes: [.vertical])
+            }


@jkmassel I didn't use the AccessibilityScrollView in your PR, because dynamic size seems working fine without it. Let me know if I missed anything.

Not a problem – we have a lot more room to work with here

wpmobilebot · 2024-10-30T08:35:04Z

📲 You can test the changes from this Pull Request in WordPress Alpha by scanning the QR code below to install the corresponding build.

	App Name	WordPress Alpha
	Configuration	Release-Alpha
	Build Number	pr23726-97a28ad
	Version	25.4.2
	Bundle ID	org.wordpress.alpha
	Commit	`97a28ad`
	App Center Build	WPiOS - One-Offs #10977

Automatticians: You can use our internal self-serve MC tool to give yourself access to App Center if needed.

wpmobilebot · 2024-10-30T08:35:42Z

📲 You can test the changes from this Pull Request in Jetpack Alpha by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Alpha
	Configuration	Release-Alpha
	Build Number	pr23726-97a28ad
	Version	25.4.2
	Bundle ID	com.jetpack.alpha
	Commit	`97a28ad`
	App Center Build	jetpack-installable-builds #10017

Automatticians: You can use our internal self-serve MC tool to give yourself access to App Center if needed.

kean · 2024-10-30T21:14:03Z

Modules/Sources/WordPressAppUI/RestApiUpgradePrompt.swift

+    }
+}
+
+#Preview {


Did you get it to work?

Nope 🤦‍♂️

kean · 2024-10-30T21:14:23Z

WordPress/Classes/ViewRelated/Blog/Blog Details/BlogDetailsViewController+SectionHelpers.swift

+    @MainActor
+    private func migrate() async {
+        guard let url = try? blog.getUrlString() else {
+            let error = NSLocalizedString("applicationPasswordMigration.error.siteUrlNotFound", value: "Cannot find the current site's url", comment: "Error message when the current site's url cannot be found")


(nit) Move to the bottom to Strings (applies to all other instances too)

Addressed in 53aaea9

Modules/Sources/WordPressAppUI/RestApiUpgradePrompt.swift

kean · 2024-10-30T21:21:58Z

Modules/Sources/WordPressAppUI/RestApiUpgradePrompt.swift

+        }
+
+        static func description(localizedFeatureName: String) -> String {
+            let format = NSLocalizedString("applicationPasswordRequired.description", value: "Application passwords are a more secure way to connect to your self-hosted site, and enable support for features like %@.", comment: "Description for the prompt to upgrade to Application Passwords. The first argument is the name of the feature that requires Application Passwords.")


"are a more secure way" – as opposed to what? I'd probably leave it out as it raises questions about the alternative options. I don't think it's inherently more secure than cookies.

I think that's compared to what the app currently uses to authenticate: xmlrpc.

Yep that's right – it's way more secure than XMLRPC

kean · 2024-10-30T21:30:13Z

Modules/Package.swift

                "WordPressFlux",
                "WordPressShared",
                "WordPressUI",
+                "WordPressAppUI",


I'd suggest adding a new auth-related module for these new screens like we had with WordPressAuthentificator as opposed to a broad "AppUI". For shared components, we already have WordPressUI.

Removed in ce8d2f8.

crazytonyli · 2024-11-04T20:58:33Z

⬆️ Rebased without code changes.

crazytonyli added the Self-hosted label Oct 30, 2024

crazytonyli added this to the 25.6 milestone Oct 30, 2024

crazytonyli requested review from jkmassel and kean October 30, 2024 08:25

crazytonyli changed the title ~~Add/rest api upgrade prompt~~ Add prompt to authenticate with application passwords Oct 30, 2024

crazytonyli commented Oct 30, 2024

View reviewed changes

kean reviewed Oct 30, 2024

View reviewed changes

Base automatically changed from self-hosted-sites-user-management to trunk November 4, 2024 12:38

crazytonyli added 6 commits November 5, 2024 09:57

Add a side-effect-free SelfHostedSiteAuthenticator.authentication

2c5c220

Add a RestApiUpgradePrompt for migrating site to application passwords

c3ac0e3

Localize the "Get Started" button

19cae00

Add a WordPressAppUI target to workaround an Xcode/SPM issue

d468cb2

Extract localized strings to an enum

c70a8bc

Remove WordPressAppUI

97a28ad

crazytonyli force-pushed the add/rest-api-upgrade-prompt branch from ce8d2f8 to 97a28ad Compare November 4, 2024 20:58

crazytonyli requested a review from kean November 4, 2024 21:10

kean approved these changes Nov 5, 2024

View reviewed changes

crazytonyli added this pull request to the merge queue Nov 5, 2024

Merged via the queue into trunk with commit 9358451 Nov 5, 2024
25 checks passed

crazytonyli deleted the add/rest-api-upgrade-prompt branch November 5, 2024 05:38

johnbillion mentioned this pull request Jan 14, 2025

Moving toward enforcing use of application passwords for authenticated XML-RPC requests #23976

Open

Add prompt to authenticate with application passwords #23726

Add prompt to authenticate with application passwords #23726

Uh oh!

Conversation

crazytonyli commented Oct 30, 2024

Regression Notes

Uh oh!

dangermattic commented Oct 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wpmobilebot commented Oct 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Oct 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kean Oct 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crazytonyli commented Nov 4, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

dangermattic commented Oct 30, 2024 •

edited

Loading

wpmobilebot commented Oct 30, 2024 •

edited

Loading

wpmobilebot commented Oct 30, 2024 •

edited

Loading

kean Oct 30, 2024 •

edited

Loading