Features #14-17: WordPress Manager, Backup, Cloudflare, TOTP 2FA

- WordPressManager.php: wp-cli wrapper for install/update/clone/delete - BackupManager.php: tar+mysqldump, schedules, retention, rclone - CloudflareManager.php: zone/record management, sync, cache purge - TOTP.php: RFC 6238 pure-PHP with backup codes - Auth.php: TOTP_REQUIRED two-step login flow - 4 new API endpoints: wordpress, backup, cloudflare, totp - DB migration 002: TOTP cols, CF cols, wordpress_installs, backups tables - admin.js: full UI for all 4 features + TOTP login step - admin/index.php: sidebar nav for WordPress, 2FA Manager, Cloudflare Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-28 05:03:14 -05:00 · 2026-06-07 21:13:59 +00:00
parent 62707d62ce
commit 135bbcb0b3
13 changed files with 1542 additions and 47 deletions
@@ -0,0 +1,72 @@
+<?php
+require_once NOVACPX_LIB . '/WordPressManager.php';
+if (!in_array($currentUser['role'], ['admin','reseller','user'])) Response::error('Forbidden', 403);
+
+$wp    = new WordPressManager();
+$body  = json_decode(file_get_contents('php://input'), true) ?? [];
+$isAdmin = $currentUser['role'] === 'admin';
+
+// Scope account_id: users can only manage their own
+$accountId = (int)($body['account_id'] ?? $_GET['account_id'] ?? 0);
+if ($currentUser['role'] === 'user') {
+    $accountId = $currentUser['account_id'] ?? 0;
+}
+
+match ($action) {
+    'list' => (function() use ($wp, $accountId, $isAdmin) {
+        Response::success($wp->list($isAdmin ? $accountId : $accountId));
+    })(),
+
+    'install' => (function() use ($wp, $body, $accountId, $currentUser) {
+        $required = ['domain','path','admin_user','admin_email','admin_pass','site_title'];
+        foreach ($required as $f) if (empty($body[$f])) Response::error("Missing: {$f}");
+        if (!$accountId) Response::error('account_id required');
+        $result = $wp->install($accountId, $body['domain'], $body['path'],
+            $body['admin_user'], $body['admin_email'], $body['admin_pass'], $body['site_title']);
+        audit('wordpress_install', 'wordpress', ['domain' => $body['domain']]);
+        Response::success($result, 'WordPress installed successfully');
+    })(),
+
+    'update-core' => (function() use ($wp, $body) {
+        $id = (int)($body['id'] ?? 0);
+        if (!$id) Response::error('id required');
+        Response::success(['output' => $wp->updateCore($id)], 'Core updated');
+    })(),
+
+    'update-plugins' => (function() use ($wp, $body) {
+        $id = (int)($body['id'] ?? 0);
+        if (!$id) Response::error('id required');
+        Response::success(['output' => $wp->updatePlugins($id)], 'Plugins updated');
+    })(),
+
+    'update-themes' => (function() use ($wp, $body) {
+        $id = (int)($body['id'] ?? 0);
+        if (!$id) Response::error('id required');
+        Response::success(['output' => $wp->updateThemes($id)], 'Themes updated');
+    })(),
+
+    'clone-staging' => (function() use ($wp, $body) {
+        $id = (int)($body['id'] ?? 0);
+        if (!$id) Response::error('id required');
+        $result = $wp->cloneStaging($id);
+        audit('wordpress_staging', 'wordpress', ['id' => $id]);
+        Response::success($result, 'Staging clone created');
+    })(),
+
+    'info' => (function() use ($wp, $body) {
+        $id = (int)($body['id'] ?? $_GET['id'] ?? 0);
+        if (!$id) Response::error('id required');
+        Response::success($wp->info($id));
+    })(),
+
+    'delete' => (function() use ($wp, $body, $isAdmin) {
+        if (!$isAdmin) Response::error('Admin only', 403);
+        $id = (int)($body['id'] ?? 0);
+        if (!$id) Response::error('id required');
+        $wp->delete($id);
+        audit('wordpress_delete', 'wordpress', ['id' => $id]);
+        Response::success(null, 'WordPress installation deleted');
+    })(),
+
+    default => Response::error('Unknown action', 404),
+};