Fulfilment System Plugin

A WordPress plugin for managing fulfilment delivery pages where agents upload media and clients access content via password-protected links.

Features

• Custom post type fulfilment_page for managing fulfilment content
• REST API endpoint for programmatic creation of fulfilment pages
• API token authentication for secure API access
• Automatic password generation (8-12 characters, human-readable)
• Media isolation: authors can only see their own uploaded media
• SEO protection: all fulfilment pages are noindex, nofollow
• Uses WordPress built-in password protection
• Admin settings page for API token management

Installation

1. Upload the placento-fulfilment-system folder to /wp-content/plugins/
2. Activate the plugin through the 'Plugins' menu in WordPress
3. The "Fulfilment Pages" menu will appear in wp-admin
4. Navigate to Fulfilment Pages → API Settings to generate an API token

Usage

For Administrators

1. Log in to WordPress with Administrator role
2. Navigate to Fulfilment Pages → API Settings
3. Generate or set an API token for REST API authentication
4. Copy the token for use in API requests

For Agents (Authors)

1. Log in to WordPress with an Author role
2. Navigate to "Fulfilment Pages" in the admin menu
3. Create or edit fulfilment pages
4. Upload media (only your own media will be visible)
5. Pages are automatically password-protected

REST API

Authentication

All API requests require authentication using a Bearer token in the Authorization header. Generate your token in Fulfilment Pages → API Settings.

Create Fulfilment Page

Create a fulfilment page via REST API:

Endpoint: POST /wp-json/fulfilment/v1/create

Headers:

Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/json

Request Body:

{
  "title": "Order 1234",
  "content": "Fulfilment content here",
  "agent_id": 1
}

Parameters:

• title (required): The title of the fulfilment page
• content (optional): HTML content for the fulfilment page
• agent_id (optional): WordPress user ID of the agent/author. Must have edit_posts capability

Success Response (201):

{
  "post_id": 123,
  "url": "https://site.com/fulfilment/order-1234",
  "password": "Ab39Ks82"
}

Error Responses:

Missing Authorization header (403):

{
  "code": "missing_authorization",
  "message": "Authorization header is required.",
  "data": {
    "status": 403
  }
}

Invalid token (403):

{
  "code": "invalid_token",
  "message": "Invalid API token.",
  "data": {
    "status": 403
  }
}

Invalid agent ID (400):

{
  "code": "invalid_agent",
  "message": "Invalid agent ID or agent does not have edit_posts capability.",
  "data": {
    "status": 400
  }
}

Example cURL Request:

curl -X POST https://yoursite.com/wp-json/fulfilment/v1/create \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Order 1234",
    "content": "Fulfilment content here",
    "agent_id": 1
  }'

Note: Bruno API collection files are included in placento-api-collections/ for testing API endpoints.

For Clients

1. Receive the fulfilment URL and password
2. Visit the URL
3. Enter the password when prompted
4. View the fulfilment content

Requirements

• WordPress 5.8 or higher
• PHP 7.4 or higher

Architecture

• placento-fulfilment-system.php - Main plugin file, bootstraps all components
• post-types/fulfilment-page.php - Custom post type registration
• api/create-page.php - REST API endpoint for creating pages
• settings/api-token.php - API token management and authentication
• permissions/media-isolation.php - Media library access restrictions
• seo/noindex.php - Search engine indexing prevention

Security

• API Token Authentication: All REST API requests require a Bearer token for authentication
• Password Protection: Access is password-based only (no login required for viewing)
• Author Permissions: Authors can only edit their own fulfilment pages
• Media Isolation: Authors can only see their own uploaded media
• SEO Protection: All fulfilment pages are excluded from search engines (noindex, nofollow)
• Token Security: API tokens are stored securely and validated using hash comparison to prevent timing attacks

Version

Current version: 1.0.0