Development

Development

Requirements

• PHP 7.4 or newer
• zip
• shellcheck for the shell-script check
• A WordPress 6.5+ HTTPS hub with OpenStation
• A separate HTTPS WordPress site with the OAuth-capable OpenStation build

Fleet has no Composer, npm, JavaScript framework, custom database, or hosted-service dependency.

Repository layout

fleet-for-openstation.php
includes/class-fleet-for-openstation.php
assets/admin.css
uninstall.php
readme.txt
tests/smoke.php
bin/build.sh

• fleet-for-openstation.php contains the plugin header and bootstrap.
• includes/class-fleet-for-openstation.php contains the UI, OAuth client, credential storage, and REST orchestration.
• assets/admin.css styles the bounded OpenStation workspace.
• uninstall.php removes local Fleet user metadata.
• tests/smoke.php checks URL validation, plugin-state inspection, secret-box storage, REST URL construction, and hub self-detection without a framework.
• bin/build.sh lints PHP, runs the smoke check, and builds the installable ZIP.

The managed-site OAuth server lives in OpenStation core at includes/fleet-oauth.php, with PHPUnit coverage in tests/phpunit/tests/fleetOAuth.php and protocol documentation in docs/fleet-oauth.md.

Build and test

./bin/build.sh
shellcheck bin/build.sh

The package is written to dist/fleet-for-openstation.zip. It contains only runtime files, including assets/admin.css.

Manual two-site acceptance pass

Use two distinct HTTPS WordPress installations.

1. Install OpenStation and Fleet on the hub; install OpenStation on the managed site.
2. Confirm the Fleet page identifies the hub and opens in a centered window no wider than 1040 pixels.
3. Connect the managed site and inspect the Full API consent screen.
4. Confirm state, exact callback, issuer, and PKCE code exchange complete.
5. Confirm the site card reports OAuth and Manage site stays inside the current window.
6. Test Overview, Content, Plugins, and Settings against the managed site.
7. Use the API console to read a Core route and write a reversible setting.
8. Force access-token expiry; confirm Fleet rotates the refresh token and completes the request.
9. Reuse an older refresh token in a disposable grant; confirm the family is revoked.
10. Disconnect; confirm the grant is revoked and bearer access fails.
11. Create another connection and revoke it under Users → Profile → Fleet connections.
12. Test rejection, expired authorization code, wrong issuer, wrong redirect, malformed JSON, insufficient capability, and an unreachable site.
13. Test the Application Password bootstrap with OpenStation absent, then install OpenStation and reconnect through OAuth.
14. Confirm the hub cannot connect to itself and a path-based multisite sibling can connect.

Contribution rules

• Prefer WordPress Core features over new infrastructure.
• Treat the managed site's endpoint permission callbacks as authoritative.
• Never log credentials, authorization codes, verifiers, or authorization headers.
• Keep tokens per user and encrypted at rest on the hub; store only hashes on the managed site.
• Keep exact redirect, issuer, PKCE, token rotation, replay revocation, and HTTPS checks intact.
• Keep unsafe-URL rejection and the public-HTTPS boundary intact.
• Keep Application Passwords limited to the OpenStation bootstrap path.
• Do not add a database table, JavaScript application, dependency, abstraction, or background worker without a concrete workflow that Core cannot cover.
• Run ./bin/build.sh after every Fleet implementation change and the OpenStation PHP/build checks after OAuth server changes.

Release checklist

1. Update the plugin header, readme.txt, and release notes to the same version.
2. Run the Fleet build, smoke check, and shell check.
3. Run the OpenStation OAuth PHPUnit tests and PHP lint.
4. Complete the manual two-site acceptance pass.
5. Inspect the ZIP and test a clean WordPress upload.
6. Tag the verified commit and attach the ZIP to the GitHub release.