Changeset 3781981

Timestamp:

11/03/2026 02:11:25 PM (63 minutes ago)

Author:

simpliteca

Message:

3.10.0: Remote support access (one-click admin SSO login)

Location:

simpliroot-lead-capture/trunk

Files:

• readme.txt (modified) (4 diffs)
• simpliroot-lead-capture.php (modified) (7 diffs)

simpliroot-lead-capture/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.0
 Requires PHP: 7.4
-Stable tag: 3.9.0
+Stable tag: 3.10.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -53 +53 @@
 Paste your project token and pick what to track. "Test connection" and "Send test lead" buttons confirm everything works.
 
+= Optional: one-click support access =
+
+If you work with the SimpliRoot team, you can let an authorized SimpliRoot panel user open your WordPress admin from the panel with one click — without you ever sharing a password. This is **off by default** and must be switched on by a WordPress administrator on the SimpliRoot settings screen (under "Remote support access"). When on, the plugin creates a dedicated `simpliroot-support` administrator account and signs each login request with your project token, which never travels over the network. Every entry is logged on the settings screen and in your panel. Turn the toggle off, or delete the `simpliroot-support` user, to revoke access immediately.
+
 = Requirements =
 
@@ -77 +81 @@
 
 7. **When you click "Send test lead"** (admin only): a sample lead is sent to the same lead endpoint so you can verify the connection.
+
+8. **Regular check-in**: the plugin periodically calls `https://app.simpliroot.com/api/dni/ping` with your project id, site domain and plugin version to fetch the project's current settings. If you enable "Remote support access" (one-click support login, off by default — see above), this check-in also reports that the option is on, so the panel can offer the login. No login happens unless an authorized panel user initiates it and the request is cryptographically verified by the plugin.
 
 Your use of the SimpliRoot service is governed by its terms and privacy policy:
@@ -122 +128 @@
 
 
+
+= 3.10.0 =
+* New optional "Remote support access": let an authorized SimpliRoot panel user open your wp-admin with one click, without sharing a password. Off by default; a WordPress administrator opts in on the settings screen. Each login is signed with your project token (never sent over the network), uses a dedicated `simpliroot-support` administrator account, is one-time and expires in seconds, and is logged on both sides. Revoke any time by turning the toggle off or deleting the support user.
 
 = 3.9.0 =

simpliroot-lead-capture/trunk/simpliroot-lead-capture.php

@@ -4 +4 @@
  * Plugin URI:  https://app.simpliroot.com
  * Description: Live chat with an AI bot, plus lead capture (Contact Form 7, Elementor, WPForms, Gravity, Fluent + any other form) and call tracking — all sent to your SimpliRoot CRM server-side (no cookies/GTM needed), with full ad-platform attribution. Configure with just your project token.
- * Version:           3.9.0
+ * Version:           3.10.0
  * Requires at least: 5.7
  * Requires PHP:      7.4
@@ -16 +16 @@
 if (!defined('ABSPATH')) exit;
 
-define('SIMPLIROOT_VERSION',  '3.9.0');
+define('SIMPLIROOT_VERSION',  '3.10.0');
 define('SIMPLIROOT_API_BASE', defined('SIMPLIROOT_API_BASE') ? SIMPLIROOT_API_BASE : 'https://app.simpliroot.com');
 define('SIMPLIROOT_OPT',      'simpliroot_settings'); // option key
@@ -55 +55 @@
         'domain'        => '',
         'last_check'    => 0,
+        // Remote one-click admin login (SSO) from the SimpliRoot panel. OFF by
+        // default: the site admin must opt in here, which is the client's consent.
+        // Every gate fails CLOSED — see the /sso endpoint at the bottom.
+        'enable_sso'    => 0,
     ]);
 }
@@ -111 +115 @@
             'domain'     => wp_parse_url(home_url(), PHP_URL_HOST),
             'v'          => SIMPLIROOT_VERSION,
+            // Report local SSO consent so the panel shows the "Enter WordPress"
+            // button only when this site has actually opted in.
+            'sso'        => !empty($s['enable_sso']) ? 1 : 0,
         ],
     ]);
@@ -1229 +1236 @@
     $s = simpliroot_local_settings();
     $s['token']        = sanitize_text_field(wp_unslash($_POST['token'] ?? ''));
+    // Local consent toggle: the WP admin opts in to one-click remote admin login.
+    // Unchecked box sends nothing, so an absent key means OFF.
+    $s['enable_sso']   = empty($_POST['enable_sso']) ? 0 : 1;
     // enable_forms/enable_calls are NOT edited here anymore — the SimpliRoot
     // panel controls them (see simpliroot_server_config). Local values stay at
@@ -1549 +1559 @@
         </div>
 
+        <div class="card" style="max-width:760px;padding:4px 16px 16px">
+          <h2>Remote support access</h2>
+          <table class="form-table">
+            <tr>
+              <th scope="row">One-click admin login</th>
+              <td>
+                <label>
+                  <input type="checkbox" name="enable_sso" value="1" <?php checked(!empty($s['enable_sso'])); ?> <?php disabled(!$connected); ?>>
+                  Let the SimpliRoot team open this site's admin from the SimpliRoot panel, with one click, without you sharing a password.
+                </label>
+                <p class="description">
+                  <strong>Off by default.</strong> When on, an authorized SimpliRoot panel user can be logged in to <code>wp-admin</code> as a dedicated
+                  <code>simpliroot-support</code> administrator account that this plugin creates. Each entry is cryptographically signed with your project
+                  token (the same secret already used by this plugin — it never travels over the network) and is logged here and in the panel.
+                  Turn this off, or delete the <code>simpliroot-support</code> user, to revoke access immediately.
+                  <?php if (!$connected): ?><br><em>Connect a project token first to enable this.</em><?php endif; ?>
+                </p>
+                <?php
+                  $log = get_option('simpliroot_sso_log', []);
+                  if (is_array($log) && $log) {
+                      echo '<p class="description" style="margin-top:10px"><strong>Recent logins:</strong></p><ul style="margin:0 0 0 4px;font-size:12px;color:#555">';
+                      foreach (array_slice(array_reverse($log), 0, 5) as $e) {
+                          echo '<li>' . esc_html(gmdate('Y-m-d H:i', (int) ($e['t'] ?? 0))) . ' UTC — '
+                              . esc_html($e['email'] ?? '?') . ' — ' . esc_html($e['ip'] ?? '?')
+                              . ' — ' . esc_html($e['result'] ?? '?') . '</li>';
+                      }
+                      echo '</ul>';
+                  }
+                ?>
+              </td>
+            </tr>
+          </table>
+        </div>
+
       </form>
     </div>
@@ -1620 +1664 @@
     ], 200);
 }
+
+
+// ═════════════════════════════════════════════════════════════════════════════
+// SSO — one-click admin login from the SimpliRoot panel ("Enter WordPress")
+// ═════════════════════════════════════════════════════════════════════════════
+//
+// An authorized user in the SimpliRoot panel clicks "Enter WordPress" for a
+// project. The panel mints a SHORT-LIVED, SINGLE-USE ticket signed with the
+// project token (the same shared secret used by /invalidate — it never travels
+// over the network, only the signature computed from it) and the browser POSTs
+// it here. We verify, log the panel user in as a DEDICATED support account and
+// redirect to wp-admin. No password ever changes hands.
+//
+// Wire contract (panel → browser form POST → here):
+//
+//   POST https://{domena_klienta}/wp-json/simpliroot/v1/sso   (form-encoded)
+//     p = base64url( json {
+//           "pu_id":     <int>    panel user id
+//           "pu_email":  <string> panel user email (for the audit log)
+//           "project_id":<int>    must match this site's project
+//           "ts":        <int>    unix seconds
+//           "nonce":     <string> random, one-time
+//         } )
+//     s = hex( hmac_sha256( p, project_token ) )
+//
+// POST (not a GET link) on purpose: the ticket rides in the request body, so it
+// never lands in access logs, the Referer header or browser history.
+//
+// EVERY gate fails CLOSED. SSO off, no token, wrong project, bad signature, a
+// ticket older than 90 s, or a reused nonce → nothing happens but a logged 401/
+// 403. Rotating the project token (same path as /invalidate) kills old tickets.
+// The client revokes access any time by unticking the toggle or deleting the
+// simpliroot-support user.
+
+add_action('rest_api_init', function () {
+    register_rest_route('simpliroot/v1', '/sso', [
+        'methods'             => 'POST',
+        'permission_callback' => '__return_true', // own HMAC verification below
+        'callback'            => 'simpliroot_rest_sso',
+    ]);
+});
+
+// base64url → raw. Tolerates missing padding.
+function simpliroot_b64url_decode($in) {
+    $in = strtr((string) $in, '-_', '+/');
+    $pad = strlen($in) % 4;
+    if ($pad) $in .= str_repeat('=', 4 - $pad);
+    return base64_decode($in, true);
+}
+
+function simpliroot_client_ip() {
+    $ip = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '';
+    return $ip !== '' ? $ip : '?';
+}
+
+// Append an audit entry (kept trimmed) and mirror it to the PHP error log.
+function simpliroot_sso_log($email, $result) {
+    $log = get_option('simpliroot_sso_log', []);
+    if (!is_array($log)) $log = [];
+    $log[] = [
+        't'      => time(),
+        'email'  => (string) $email,
+        'ip'     => simpliroot_client_ip(),
+        'result' => (string) $result,
+    ];
+    if (count($log) > 50) $log = array_slice($log, -50);
+    update_option('simpliroot_sso_log', $log, false);
+    error_log(sprintf('[simpliroot] SSO %s for %s from %s', $result, $email ?: '?', simpliroot_client_ip()));
+}
+
+// Get (or lazily create) the dedicated support administrator. Created ONLY while
+// SSO is on, so the account never exists without the client's consent.
+function simpliroot_sso_support_user() {
+    $login = 'simpliroot-support';
+    $user  = get_user_by('login', $login);
+    if ($user) return $user;
+
+    $host  = wp_parse_url(home_url(), PHP_URL_HOST) ?: 'site';
+    $email = 'support+' . preg_replace('/[^a-z0-9.-]/i', '', $host) . '@simpliroot.com';
+    if (email_exists($email)) $email = 'support+' . wp_generate_password(10, false) . '@simpliroot.com';
+
+    $uid = wp_insert_user([
+        'user_login'   => $login,
+        'user_pass'    => wp_generate_password(40, true, true),
+        'user_email'   => $email,
+        'display_name' => 'SimpliRoot Support',
+        'role'         => 'administrator',
+    ]);
+    if (is_wp_error($uid)) return null;
+    update_user_meta($uid, 'simpliroot_managed', 1);
+    return get_user_by('id', $uid);
+}
+
+function simpliroot_rest_sso(WP_REST_Request $req) {
+    $s = simpliroot_local_settings();
+
+    // Gate 1: consent + connection. Fail closed.
+    if (empty($s['enable_sso']) || empty($s['project_id']) || empty($s['token'])) {
+        simpliroot_sso_log('', 'blocked_disabled');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'sso_disabled'], 403);
+    }
+
+    $p = (string) $req->get_param('p');
+    $sig = (string) $req->get_param('s');
+    if ($p === '' || $sig === '') {
+        simpliroot_sso_log('', 'bad_request');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'missing_ticket'], 400);
+    }
+
+    // Gate 2: signature over the exact payload string.
+    $expect = hash_hmac('sha256', $p, (string) $s['token']);
+    if (!hash_equals($expect, $sig)) {
+        simpliroot_sso_log('', 'bad_signature');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'bad_signature'], 401);
+    }
+
+    $raw  = simpliroot_b64url_decode($p);
+    $data = $raw ? json_decode($raw, true) : null;
+    if (!is_array($data) || !isset($data['project_id'], $data['ts'], $data['nonce'])) {
+        simpliroot_sso_log('', 'bad_payload');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'bad_payload'], 400);
+    }
+
+    $email = isset($data['pu_email']) ? sanitize_email((string) $data['pu_email']) : '';
+
+    // Gate 3: ticket is for THIS project.
+    if ((int) $data['project_id'] !== (int) $s['project_id']) {
+        simpliroot_sso_log($email, 'project_mismatch');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'project_mismatch'], 403);
+    }
+
+    // Gate 4: freshness (±90 s).
+    if (abs(time() - (int) $data['ts']) > 90) {
+        simpliroot_sso_log($email, 'stale');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'stale'], 401);
+    }
+
+    // Gate 5: single use. A reused nonce is a replay — refuse.
+    $nkey = 'simpliroot_sso_n_' . md5((string) $data['nonce']);
+    if (get_transient($nkey)) {
+        simpliroot_sso_log($email, 'replay');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'replay'], 401);
+    }
+    set_transient($nkey, 1, 180); // outlive the 90 s window comfortably
+
+    $user = simpliroot_sso_support_user();
+    if (!$user) {
+        simpliroot_sso_log($email, 'user_error');
+        return new WP_REST_Response(['ok' => false, 'reason' => 'user_error'], 500);
+    }
+
+    // Log the panel user in as the support account and send them to wp-admin.
+    wp_set_auth_cookie($user->ID, false, is_ssl());
+    wp_set_current_user($user->ID);
+    simpliroot_sso_log($email, 'ok');
+
+    nocache_headers();
+    wp_safe_redirect(admin_url());
+    exit;
+}