Scaffold Ladill Woo Manager for WooCommerce order fulfillment.

Standalone app with SSO shell, WordPress plugin connect flow, webhook ingest, fulfillment inbox, and plugin activation API — no payment processing. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-06 22:39:38 +00:00
commit ffe0b9d877
326 changed files with 33210 additions and 0 deletions
@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Http\Controllers\Woo;
+
+use App\Http\Controllers\Controller;
+use App\Models\WooStore;
+use App\Services\Woo\InstallTokenService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+use Illuminate\View\View;
+
+class ConnectWordPressController extends Controller
+{
+    public function __construct(private InstallTokenService $tokens) {}
+
+    public function start(Request $request): RedirectResponse|View
+    {
+        $validated = $request->validate([
+            'site_url' => ['required', 'url', 'max:500'],
+            'return_url' => ['required', 'url', 'max:2048'],
+            'site_name' => ['nullable', 'string', 'max:160'],
+        ]);
+
+        $siteUrl = $this->normalizeSiteUrl($validated['site_url']);
+        if (! $this->isAllowedReturnUrl($validated['return_url'], $siteUrl)) {
+            abort(422, 'Return URL must belong to the WooCommerce site.');
+        }
+
+        $request->session()->put('woo.connect', [
+            'site_url' => $siteUrl,
+            'return_url' => $validated['return_url'],
+            'site_name' => $validated['site_name'] ?? null,
+        ]);
+
+        if (! $request->user()) {
+            return redirect()->route('sso.connect', [
+                'redirect' => $request->fullUrl(),
+                'interactive' => 1,
+            ]);
+        }
+
+        return $this->complete($request);
+    }
+
+    public function complete(Request $request): RedirectResponse|View
+    {
+        $pending = (array) $request->session()->pull('woo.connect', []);
+        if ($pending === []) {
+            return redirect()->route('woo.dashboard');
+        }
+
+        $user = $request->user();
+        abort_if(! $user, 401);
+
+        $siteUrl = (string) ($pending['site_url'] ?? '');
+        $returnUrl = (string) ($pending['return_url'] ?? '');
+
+        $store = WooStore::query()->updateOrCreate(
+            [
+                'user_id' => $user->id,
+                'site_url' => $siteUrl,
+            ],
+            [
+                'site_name' => $pending['site_name'] ?? parse_url($siteUrl, PHP_URL_HOST),
+                'return_url' => $returnUrl,
+                'status' => WooStore::STATUS_PENDING,
+            ],
+        );
+
+        $issued = $this->tokens->issue($store);
+        $separator = str_contains($returnUrl, '?') ? '&' : '?';
+
+        return redirect()->away($returnUrl.$separator.http_build_query([
+            'ladill_connect' => '1',
+            'install_token' => $issued['token'],
+            'store_id' => $store->public_id,
+        ]));
+    }
+
+    private function normalizeSiteUrl(string $url): string
+    {
+        $parsed = parse_url($url);
+        $scheme = $parsed['scheme'] ?? 'https';
+        $host = strtolower((string) ($parsed['host'] ?? ''));
+
+        return rtrim($scheme.'://'.$host, '/');
+    }
+
+    private function isAllowedReturnUrl(string $returnUrl, string $siteUrl): bool
+    {
+        $returnHost = strtolower((string) (parse_url($returnUrl, PHP_URL_HOST) ?: ''));
+        $siteHost = strtolower((string) (parse_url($siteUrl, PHP_URL_HOST) ?: ''));
+
+        return $returnHost !== '' && $returnHost === $siteHost;
+    }
+}