blueprint-editor-2fa.json

{
    "$schema": "https://playground.wordpress.net/blueprint-schema.json",
    "meta": {
        "title": "WP Sudo — In-Editor Two-Factor Reauthentication Demo",
        "author": "dknauss",
        "description": "Demonstrates the block-editor (Gutenberg) sudo reauth modal completing a two-factor (TOTP) step in place: installing a block from the inserter trips WP Sudo's gate, the in-editor modal takes the password, then renders the real Two Factor TOTP field (Milestone B server-rendered provider partial) inside the same modal to grant the sudo session and resume the request."
    },
    "preferredVersions": {
        "php": "8.2",
        "wp": "latest"
    },
    "landingPage": "/wp-admin/post-new.php",
    "steps": [
        {
            "step": "runPHP",
            "code": "<?php require_once '/wordpress/wp-load.php'; $mu = defined('WPMU_PLUGIN_DIR') ? WPMU_PLUGIN_DIR : WP_CONTENT_DIR . '/mu-plugins'; if ( is_dir( $mu ) === false ) { mkdir( $mu, 0777, true ); } file_put_contents( $mu . '/wp-sudo-demo-editor-2fa.php', base64_decode('PD9waHAKLyoqCiAqIERlbW8tb25seSBoZWxwZXIgZm9yIHRoZSBXUCBTdWRvIGluLWVkaXRvciAyRkEgcmVhdXRoIGRlbW8uCiAqCiAqIFdQIFN1ZG8gZ3JhbnRzIGEgc3VkbyBzZXNzaW9uIGF1dG9tYXRpY2FsbHkgb24gYnJvd3NlciBsb2dpbiwgc28gYSBmcmVzaGx5CiAqIGxvZ2dlZC1pbiBhZG1pbiB3b3VsZCBuZXZlciBzZWUgdGhlIHJlYXV0aCBtb2RhbC4gVGhpcyBoZWxwZXIga2VlcHMgdGhlIGRlbW8KICogcmVsaWFibGUgYW5kIG1ha2VzIHRoZSB0d28tZmFjdG9yIHN0ZXAgc2VsZi1ndWlkaW5nOgogKiAgIDEuIFN1cHByZXNzIHRoZSBsb2dpbiBhdXRvLWdyYW50IHZpYSB0aGUgcGx1Z2luJ3Mgb3duIHB1YmxpYyBmaWx0ZXIuCiAqICAgMi4gTGV0IFBsYXlncm91bmQncyBkZWZlcnJlZCBhdXRvLWxvZ2luIHJlYWNoIHRoZSBlZGl0b3Igd2l0aG91dCBoaXR0aW5nCiAqICAgICAgVHdvIEZhY3RvcidzIG93biBsb2dpbi1zY3JlZW4gMkZBIGNoYWxsZW5nZSAoc2VlIGJlbG93KS4KICogICAzLiBPbiBlYWNoIGJsb2NrLWVkaXRvciBQQUdFIGxvYWQsIGZ1bGx5IGVuZCBhbnkgYWN0aXZlIHNlc3Npb24gKGNvdmVycwogKiAgICAgIFBsYXlncm91bmQgc3RvcmFnZSByZXVzZSAvIHJhY2VzKSBzbyB0aGUgZ2F0ZSBhbHdheXMgZmlyZXMuCiAqICAgNC4gSW4gdGhlIGVkaXRvciwgb3BlbiB0aGUgYmxvY2sgaW5zZXJ0ZXIgYW5kIHNob3cgYSBkaXNtaXNzaWJsZSBub3RpY2Ugd2l0aAogKiAgICAgIHNldmVyYWwgY3VycmVudGx5LXZhbGlkIFRPVFAgY29kZXMgc28gdGhlIHZpZXdlciBjYW4gY29tcGxldGUgdGhlIHR3by1mYWN0b3IKICogICAgICBzdGVwLiBUaGUgVE9UUCBzZWNyZXQgYmVsb3cgaXMgYSB0aHJvd2F3YXkgc2FuZGJveCB2YWx1ZSBhbmQgaXMgcHVibGljIGJ5CiAqICAgICAgZGVzaWduOyBuZXZlciByZXVzZSBpdCBhbnl3aGVyZSByZWFsLgogKgogKiBUaGUgbW9kYWwgYWRtaW4tYWpheCBwYXNzd29yZCBncmFudCwgdGhlIHNlcnZlci1yZW5kZXJlZCBUd28gRmFjdG9yIFRPVFAKICogcGFydGlhbCwgYW5kIHRoZSBhcGlGZXRjaCByZS1kaXNwYXRjaCBvZiB0aGUgcmVzdW1lZCBhY3Rpb24gYXJlIGFsbCB0aGUKICogcGx1Z2luJ3Mgb3duIGNvZGUsIHNvIGF1dGhlbnRpY2F0aW5nIGhlcmUgZXhlcmNpc2VzIHRoZSByZWFsIE1pbGVzdG9uZSBCIGZsb3cuCiAqLwphZGRfZmlsdGVyKCAnd3Bfc3Vkb19ncmFudF9zZXNzaW9uX29uX2xvZ2luJywgJ19fcmV0dXJuX2ZhbHNlJyApOwoKLyoqCiAqIExldCB0aGUgZGVtbyBsYW5kIGluIHRoZSBlZGl0b3IgYWxyZWFkeSBsb2dnZWQgaW4uCiAqCiAqIEJlY2F1c2UgdGhlIGFkbWluIGhhcyBhIHJlYWwgVHdvIEZhY3RvciBUT1RQIHByb3ZpZGVyIGVuYWJsZWQsIFR3byBGYWN0b3IKICogZ2F0ZXMgV29yZFByZXNzIExPR0lOIGl0c2VsZiAoaXRzIGBhdXRoZW50aWNhdGVgIGZpbHRlciArIGB3cF9sb2dpbmAgYWN0aW9uCiAqIHNob3cgdGhlIGludGVyaW0gMkZBIHNjcmVlbikuIFBsYXlncm91bmQgcGVyZm9ybXMgYSBkZWZlcnJlZCBhdXRvLWxvZ2luIG9uIHRoZQogKiBsYW5kaW5nIG5hdmlnYXRpb24g4oCUIGJ5IHRoZW4gVHdvIEZhY3RvciBpcyBhY3RpdmUg4oCUIHNvIHdpdGhvdXQgdGhpcyB0aGUgZGVtbwogKiBkZWFkLWVuZHMgb24gdGhlIGxvZ2luLXNjcmVlbiAyRkEgY2hhbGxlbmdlIGluc3RlYWQgb2YgcmVhY2hpbmcgdGhlIGVkaXRvci4KICoKICogQm90aCBnYXRlcyByZXNvbHZlIHRocm91Z2ggYGlzX3VzZXJfdXNpbmdfdHdvX2ZhY3RvcigpYCwgd2hpY2ggcmVhZHMgdGhlCiAqIGVuYWJsZWQtcHJvdmlkZXJzIHVzZXIgbWV0YS4gRmlsdGVyaW5nIG9ubHkgdGhlICpkZXJpdmVkKiBwcm92aWRlciBsaXN0IGlzIG5vdAogKiBlbm91Z2g6IFR3byBGYWN0b3IgaGFzIGEgZmFpbC1vcGVuIGd1YXJkIHRoYXQsIHdoZW4gdGhlIGRlcml2ZWQgbGlzdCBpcyBlbXB0eQogKiBidXQgdGhlICpyYXcqIGBfdHdvX2ZhY3Rvcl9lbmFibGVkX3Byb3ZpZGVyc2AgbWV0YSBpcyBub3QsIGZvcmNlcyBlbWFpbGVkIGNvZGVzCiAqIG9uIChvciBlcnJvcnMpLiBTbyB3ZSBzaG9ydC1jaXJjdWl0IHRoZSBSQVcgbWV0YSByZWFkIGl0c2VsZiB0byBhbiBlbXB0eSBzZXQsCiAqIGJ1dCBPTkxZIHdoaWxlIGluc2lkZSB0aGUgbG9naW4gZmxvdyAoYGF1dGhlbnRpY2F0ZWAgZmlsdGVyIG9yIGB3cF9sb2dpbmAKICogYWN0aW9uKS4gRXZlcnkgb3RoZXIgcmVxdWVzdCDigJQgaW5jbHVkaW5nIFdQIFN1ZG8ncyBvd24gc3VkbyBjaGFsbGVuZ2UgYW5kIHRoZQogKiBlZGl0b3IgbG9hZCB0aGF0IGNvbXB1dGVzIHRoZSBjb2RlIGJlbG93IOKAlCByZWFkcyB0aGUgcmVhbCBtZXRhIGFuZCBzdGlsbCBzZWVzCiAqIHRoZSBUT1RQIHByb3ZpZGVyLCBzbyB0aGUgaW4tbW9kYWwgc2Vjb25kIGZhY3RvciB0aGlzIGRlbW8gc2hvd2Nhc2VzIGZpcmVzLgogKi8KYWRkX2ZpbHRlcigKCSdnZXRfdXNlcl9tZXRhZGF0YScsCglzdGF0aWMgZnVuY3Rpb24gKCAkdmFsdWUsICRvYmplY3RfaWQsICRtZXRhX2tleSApIHsKCQlpZiAoICdfdHdvX2ZhY3Rvcl9lbmFibGVkX3Byb3ZpZGVycycgIT09ICRtZXRhX2tleSApIHsKCQkJcmV0dXJuICR2YWx1ZTsKCQl9CgkJaWYgKCBkb2luZ19maWx0ZXIoICdhdXRoZW50aWNhdGUnICkgfHwgZG9pbmdfYWN0aW9uKCAnd3BfbG9naW4nICkgKSB7CgkJCS8vIFNoYXBlIGZvciB0aGUgZ2V0X21ldGFkYXRhIGZpbHRlcjogYSBzaW5nbGUtdmFsdWUgcmVhZAoJCQkvLyAoZ2V0X3VzZXJfbWV0YSgg4oCmLCB0cnVlICkpIHJldHVybnMgZWxlbWVudCBbMF0g4oCUIGhlcmUgYW4gZW1wdHkgYXJyYXkuCgkJCXJldHVybiBhcnJheSggYXJyYXkoKSApOwoJCX0KCQlyZXR1cm4gJHZhbHVlOwoJfSwKCTEwLAoJMwopOwoKYWRkX2FjdGlvbigKCSdsb2FkLXBvc3QtbmV3LnBocCcsCglzdGF0aWMgZnVuY3Rpb24gKCkgewoJCSR1ID0gd3BfZ2V0X2N1cnJlbnRfdXNlcigpOwoJCWlmICggISAkdSB8fCAhICR1LT5leGlzdHMoKSApIHsKCQkJcmV0dXJuOwoJCX0KCQkvLyBSZXNldCBUd28gRmFjdG9yJ3MgVE9UUCByZXBsYXkgbWFya2VyIHNvIGEgc2FtZS10aWNrIHJldHJ5IGFmdGVyIGFuCgkJLy8gZWRpdG9yIHJlbG9hZCBpcyBub3QgcmVqZWN0ZWQgYXMgYSByZXVzZWQgY29kZSAodGhlIGRlbW8gbm90aWNlIGNhbgoJCS8vIHN0aWxsIHNob3cgdGhlIGN1cnJlbnQgY29kZSB3aXRoaW4gdGhlIHNhbWUgMzBzIHRpY2spLgoJCWRlbGV0ZV91c2VyX21ldGEoIChpbnQpICR1LT5JRCwgJ190d29fZmFjdG9yX3RvdHBfbGFzdF9zdWNjZXNzZnVsX2xvZ2luJyApOwoJCWlmICggY2xhc3NfZXhpc3RzKCAnXFdQX1N1ZG9cU3Vkb19TZXNzaW9uJyApICkgewoJCQlcV1BfU3Vkb1xTdWRvX1Nlc3Npb246OmRlYWN0aXZhdGUoIChpbnQpICR1LT5JRCApOwoJCX0KCX0KKTsKCmFkZF9hY3Rpb24oCgknZW5xdWV1ZV9ibG9ja19lZGl0b3JfYXNzZXRzJywKCXN0YXRpYyBmdW5jdGlvbiAoKSB7CgkJaWYgKCBjbGFzc19leGlzdHMoICdcV1BfU3Vkb1xTdWRvX1Nlc3Npb24nICkgPT09IGZhbHNlICkgewoJCQlyZXR1cm47CgkJfQoKCQkvLyBTaG93IHRoZSBjdXJyZW50IFRPVFAgY29kZSBwbHVzIHRoZSBuZXh0IGZldyBzdGVwcy4gVHdvIEZhY3RvciBhY2NlcHRzIGEKCQkvLyDCsTQtc3RlcCB2YWxpZGF0aW9uIHdpbmRvdywgc28gbGlzdGluZyBzZXZlcmFsIGZvcndhcmQgY29kZXMga2VlcHMgYXQKCQkvLyBsZWFzdCBvbmUgdmFsaWQgd2hpbGUgdGhlIHZpZXdlciB3b3JrcyB0aHJvdWdoIHRoZSBwYXNzd29yZCBzdGVwIGZpcnN0CgkJLy8gYW5kIHJlYWNoZXMgdGhlIHR3by1mYWN0b3IgZmllbGQg4oCUIGEgc2luZ2xlIGNvZGUgc2hvd24gYXQgZWRpdG9yIGxvYWQKCQkvLyBjb3VsZCBvdGhlcndpc2UgbGFwc2UgaXRzIH4yLW1pbnV0ZSB3aW5kb3cgYmVmb3JlIHRoZXkgZ2V0IHRoZXJlLgoJCSRjb2RlcyA9IGFycmF5KCk7CgkJaWYgKCBjbGFzc19leGlzdHMoICdcVHdvX0ZhY3Rvcl9Ub3RwJyApICYmIG1ldGhvZF9leGlzdHMoICdcVHdvX0ZhY3Rvcl9Ub3RwJywgJ2NhbGNfdG90cCcgKSApIHsKCQkJJHN0ZXAgPSAoaW50KSBmbG9vciggdGltZSgpIC8gMzAgKTsKCQkJZm9yICggJGkgPSAwOyAkaSA8IDU7ICRpKysgKSB7CgkJCQkkY29kZXNbXSA9IChzdHJpbmcpIFxUd29fRmFjdG9yX1RvdHA6OmNhbGNfdG90cCggJ0pCU1dZM0RQRUhQSzNQWFAnLCAkc3RlcCArICRpICk7CgkJCX0KCQl9CgoJCSRub3RpY2UgID0gJ1dQIFN1ZG8gMkZBIGRlbW8g4oCUIHRoaXMgYWRtaW4gaGFzIFRPVFAgdHdvLWZhY3RvciBlbmFibGVkLiBJbiB0aGUgb3BlbiBpbnNlcnRlciwgc2VhcmNoIGEgYmxvY2sgKGZvciBleGFtcGxlICJjb250YWN0IGZvcm0iKSBhbmQgY2xpY2sgSW5zdGFsbDsgd2hlbiBXUCBTdWRvIGFza3MgeW91IHRvIGNvbmZpcm0geW91ciBpZGVudGl0eSwgZW50ZXIgdGhlIHBhc3N3b3JkICJwYXNzd29yZCIsIHRoZW4gYW55IHR3by1mYWN0b3IgY29kZSBzaG93biBoZXJlLic7CgkJJG5vdGljZSAuPSAhIGVtcHR5KCAkY29kZXMgKSA/ICcgVHdvLWZhY3RvciBjb2RlcyAoYW55IG9uZSB3b3JrcyByaWdodCBub3c7IHRoZXkgcm9sbCBmb3J3YXJkIHNvIHRoZSBkZW1vIHN0YXlzIHVzYWJsZSBmb3IgYSBmZXcgbWludXRlcyDigJQgcmVsb2FkIHRoZSBlZGl0b3IgZm9yIGEgZnJlc2ggc2V0KTogJyAuIGltcGxvZGUoICcsICcsICRjb2RlcyApIC4gJy4nIDogJyc7CgkJJG5vdGljZSAuPSAnIFRoZSBzYW5kYm94IHR3by1mYWN0b3Igc2VjcmV0IGlzIGludGVudGlvbmFsbHkgcHVibGljLic7CgoJCSRqcyAgPSAnd2luZG93LndwICYmIHdwLmRvbVJlYWR5ICYmIHdwLmRvbVJlYWR5KGZ1bmN0aW9uKCl7JzsKCQkkanMgLj0gJ3RyeXt2YXIgbz13cC5kYXRhJiZ3cC5kYXRhLmRpc3BhdGNoKCJjb3JlL2VkaXRvciIpOyc7CgkJJGpzIC49ICdpZihvJiZvLnNldElzSW5zZXJ0ZXJPcGVuZWQpe28uc2V0SXNJbnNlcnRlck9wZW5lZCh0cnVlKTt9JzsKCQkkanMgLj0gJ2Vsc2V7dmFyIHA9d3AuZGF0YSYmd3AuZGF0YS5kaXNwYXRjaCgiY29yZS9lZGl0LXBvc3QiKTtpZihwJiZwLnNldElzSW5zZXJ0ZXJPcGVuZWQpe3Auc2V0SXNJbnNlcnRlck9wZW5lZCh0cnVlKTt9fX1jYXRjaChlKXt9JzsKCQkkanMgLj0gJ3RyeXt3cC5kYXRhLmRpc3BhdGNoKCJjb3JlL25vdGljZXMiKS5jcmVhdGVJbmZvTm90aWNlKCcgLiB3cF9qc29uX2VuY29kZSggJG5vdGljZSApIC4gJyx7aWQ6IndwLXN1ZG8tZGVtby0yZmEtZ3VpZGFuY2UiLGlzRGlzbWlzc2libGU6dHJ1ZX0pO31jYXRjaChlKXt9JzsKCQkkanMgLj0gJ30pOyc7CgkJd3BfYWRkX2lubGluZV9zY3JpcHQoICd3cC1lZGl0LXBvc3QnLCAkanMsICdhZnRlcicgKTsKCX0KKTsK') ); echo 'wrote mu-plugin';"
        },
        {
            "step": "runPHP",
            "code": "<?php require_once '/wordpress/wp-load.php'; $user = get_user_by('login', 'admin'); if ($user) { wp_set_password('password', $user->ID); wp_set_current_user($user->ID); update_user_meta((int) $user->ID, '_two_factor_totp_key', 'JBSWY3DPEHPK3PXP'); update_user_meta((int) $user->ID, '_two_factor_enabled_providers', array('Two_Factor_Totp')); update_user_meta((int) $user->ID, '_two_factor_provider', 'Two_Factor_Totp'); } echo 'enrolled admin in TOTP';"
        },
        {
            "step": "login",
            "username": "admin",
            "password": "password"
        },
        {
            "step": "installPlugin",
            "pluginData": {
                "resource": "wordpress.org/plugins",
                "slug": "two-factor"
            },
            "options": {
                "activate": true
            }
        },
        {
            "step": "installPlugin",
            "pluginData": {
                "resource": "url",
                "url": "https://wordpress-playground-cors-proxy.net/?https://github.com/dknauss/Sudo/archive/refs/heads/main.zip"
            },
            "options": {
                "activate": true,
                "targetFolderName": "wp-sudo"
            }
        },
        {
            "step": "runPHP",
            "code": "<?php require_once '/wordpress/wp-load.php'; $admin = get_user_by('login', 'admin'); if ($admin) { foreach (array('_wp_sudo_expires','_wp_sudo_token','_wp_sudo_failed_attempts','_wp_sudo_lockout_until','_wp_sudo_failure_event','_wp_sudo_throttle_until') as $key) { delete_user_meta((int) $admin->ID, $key); } } echo 'Two Factor + WP Sudo active; admin has TOTP two-factor enabled and arrives with NO sudo session (every fresh editor load starts session-less). Admin password: password. Demo: open the block inserter (+), search a Block-Directory block (e.g. \"Contact Form 7\"), click to install it; the in-editor sudo modal appears; enter the password, then the two-factor code shown in the editor notice (or compute the current TOTP for secret JBSWY3DPEHPK3PXP) to grant the session and resume the request in place.';"
        }
    ]
}