WordPress.org
Get WordPress

Plugin Directory

Changeset 2649870


Ignore:
Timestamp:
12/28/2021 09:14:44 AM (4 years ago)
Author:
artpi
Message:

Update to version 0.2.1 from GitHub

Location:
dao-login
Files:
10 added
16 deleted
4 edited
1 copied

Legend:

Unmodified
Added
Removed

  • dao-login/tags/0.2.1/dao-login.php

    r2635441 r2649870  
    11<?php
    22namespace Artpi\WPDAO;
    3 
    4 use Elliptic\EC;
    5 use kornrunner\Keccak;
    6 use WP_Error;
    73
    84/**
    95 * Plugin Name:     DAO Login
    106 * Description:     Make your site web3-ready: Log in with Ethereum or create users based on governance tokens.
    11  * Version:         0.1.2
     7 * Version:         0.2.1
    128 * Author:          Artur Piszek (artpi)
    139 * Author URI:      https://piszek.com
    … …  
    1915 */
    2016
     17require_once __DIR__ . '/dao-permissions.php';
     18require_once __DIR__ . '/members-only.php';
     19require_once __DIR__ . '/web3.php';
     20
     21register_activation_hook( __FILE__, __NAMESPACE__ . '\add_roles_on_plugin_activation' );
     22
     23class DaoLogin {
     24    public static $settings;
     25    public static $web3;
     26
     27    public static function init() {
     28        self::$settings = new Settings();
     29        self::$web3     = new Web3( self::$settings );
     30    }
     31}
     32add_action( 'init', __NAMESPACE__ . '\DaoLogin::init' );
    2133
    2234add_action(
    … …  
    2840            array(
    2941                'methods'   => 'GET',
    30                 'callback'  => __NAMESPACE__ . '\generate_message',
     42                'callback'  => __NAMESPACE__ . '\Web3::generate_message',
    3143                'arguments' => array(
    3244                    'address' => array(
    … …  
    4052);
    4153
    42 function generate_message( $request ) {
    43     $nonce     = wp_create_nonce( 'eth_login' );
    44     $uri       = get_site_url();
    45     $domain    = parse_url( $uri, PHP_URL_HOST );
    46     $statement = esc_attr__( 'Log In with your Ethereum wallet', 'dao-login' ); // TBD
    47     $version   = 1; // Per https://github.com/ethereum/EIPs/blob/9a9c5d0abdaf5ce5c5dd6dc88c6d8db1b130e95b/EIPS/eip-4361.md#example-message-to-be-signed
    48     $issued_at = gmdate( 'Y-m-d\TH:i:s\Z' );
    49 
    50     // This is copy-pasted from https://github.com/ethereum/EIPs/blob/9a9c5d0abdaf5ce5c5dd6dc88c6d8db1b130e95b/EIPS/eip-4361.md#informal-message-template
    51     $message = "{$domain} wants you to sign in with your Ethereum account:
    52 {$request['address']}
    53 
    54 {$statement}
    55 
    56 URI: {$uri}
    57 Version: {$version}
    58 Nonce: {$nonce}
    59 Issued At: {$issued_at}
    60 ";
    61     // This attempt will auto expire in 5 minutes. This way, we'll save the message server-side to check after the login attempt.
    62     set_transient( 'wp_dao_message_' . $request['address'], $message, 60 * 5 );
    63     return array(
    64         'address' => $request['address'],
    65         'message' => $message,
    66         'nonce'   => $nonce,
    67     );
    68 }
    6954
    7055/**
    … …  
    8671        return $user;
    8772    }
    88     $nonce = sanitize_title( $_POST['eth_login_nonce'] );
     73    $nonce   = sanitize_title( $_POST['eth_login_nonce'] );
    8974    $address = sanitize_title( $_POST['eth_login_address'] );
    9075    // We stored the message in the DB before sending it to the client.
    … …  
    9883
    9984    // Now let's check the signature.
    100     if ( ! verify_signature( $message, $signature, $address ) ) {
     85    if ( ! Web3::verify_signature( $message, $signature, $address ) ) {
    10186        return new \WP_Error( 'eth_login_sig', esc_attr__( 'ETH Signature doesent match!', 'dao-login' ) );
    10287    }
    … …  
    11297        )
    11398    );
    114     $users = $user_query->get_results();
     99    $users      = $user_query->get_results();
    115100    if ( isset( $users[0] ) ) {
    116101        return $users[0];
     102    } elseif ( DaoLogin::$settings->is_registering_enabled() ) {
     103        // Allow registering through the API.
     104        $balances = DaoLogin::$web3->get_token_balances( $address, DaoLogin::$settings->get_token_list() );
     105        $role     = balances_to_role( DaoLogin::$settings->get_tokens_array(), $balances );
     106        if ( $role ) {
     107            $user_id = wp_create_user( $address, wp_generate_password(), "{$address}@ethmail.cc" );
     108            add_user_meta( $user_id, 'eth_address', $address, true );
     109            $user = get_user_by( 'ID', $user_id );
     110            $user->set_role( $role );
     111            return $user;
     112        } else {
     113            return new \WP_Error( 'eth_login_insufficient_funds', esc_attr__( 'Insufficient tokens to register on this site.', 'dao-login' ) );
     114        }
    117115    } else {
    118116        return new \WP_Error( 'eth_login_nouser', esc_attr__( 'No user connected to this Ethereum wallet.', 'dao-login' ) );
    … …  
    124122
    125123
    126 /**
    127  * This will verify Ethereum signed message according to the specification.
    128  * From https://github.com/simplito/elliptic-php#verifying-ethereum-signature
    129  */
    130 function verify_signature( $message, $signature, $address ) {
    131     require_once __DIR__ . '/vendor/autoload.php';
    132     $msglen = strlen( $message );
    133     $hash   = Keccak::hash( "\x19Ethereum Signed Message:\n{$msglen}{$message}", 256 );
    134     $sign   = [
    135         'r' => substr( $signature, 2, 64 ),
    136         's' => substr( $signature, 66, 64 ),
    137     ];
    138     $recid  = ord( hex2bin( substr( $signature, 130, 2 ) ) ) - 27;
    139     if ( $recid != ( $recid & 1 ) ) {
    140         return false;
     124function balances_to_role( $tokens, $balances ) {
     125    $roles = wp_roles()->roles;
     126    // I am assuming roles are going down with the order of importance.
     127    foreach ( $roles as $role_id => $role ) {
     128        foreach ( $tokens as $token_id => $token ) {
     129            foreach ( $balances as $balance ) {
     130                if (
     131                    $balance->contractAddress === $token_id &&
     132                    ! empty( $token[ "role_{$role_id}" ] ) &&
     133                    $balance->tokenBalance >= $token[ "role_{$role_id}" ]
     134                ) {
     135                    return $role_id;
     136                }
     137            }
     138        }
    141139    }
    142 
    143     $ec     = new EC( 'secp256k1' );
    144     $pubkey = $ec->recoverPubKey( $hash, $sign, $recid );
    145 
    146     return $address == pub_key_address( $pubkey );
     140    return false;
    147141}
    148142
    149 function pub_key_address( $pubkey ) {
    150     return '0x' . substr( Keccak::hash( substr( hex2bin( $pubkey->encode( 'hex' ) ), 1 ), 256 ), 24 );
    151 }
    152143
    153144
    … …  
    184175add_action( 'personal_options_update', __NAMESPACE__ . '\save_profile_fields' );
    185176add_action( 'edit_user_profile_update', __NAMESPACE__ . '\save_profile_fields' );
     177

  • dao-login/tags/0.2.1/readme.txt

    r2635441 r2649870  
    11=== DAO Login ===
    22Contributors:      artpi
    3 Tags:              signin, web3, ethereum, login, sso
     3Tags:              signin, web3, ethereum, login, sso, nft, dao
    44Requires at least: 5.3.1
    55Tested up to:      5.8.2
    6 Stable tag:        0.1.2
     6Stable tag:        0.2.1
    77Requires PHP:      7.0.0
    88License:           GPL-2.0-or-later
    99License URI:       https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Enable signin with Ethereum on your site.
     11Enable signin with Ethereum on your site and allow users to register based on Governance tokens, NFT, and token balance.
     12[Demo site here](https://wpdao.artpi.net/)
    1213
    1314== Description ==
    1415
    15 This plugin enables "Sign-In with Ethereum" protocol on your WordPress site. Your users will be able to log in with their wallets - you never have to send them the password!
    16 Enable cryptographically secure login option now!
     16DAO Login is a plugin that connects your site login system web3:
    1717
    18 - [More about sign-in with Ethereum protocol](https://login.xyz/)
    19 - [A video of this plugin in action](https://twitter.com/artpi/status/1462143739686699018)
     18- Existing users can log in with their Ethereum Wallets using the [Sign in with Ethereum](https://login.xyz)
     19- New users can create accounts based on their token balances
     20- You can designate members-only areas for token holders
     21- Works with existing WordPress user roles and other plugins. You can create a private forum, private store, DAO blog, etc.
    2022
    21 Future plans include:
    22 - Importing .eth username from ENS
    23 - Creating users based on them having a certain amount of governance tokens for a DAO, or a specific NFT
    24 - Disabling password / email options so that your users are 100% secured by private/public key pairs.
     23
     24= Automatic onboarding =
     25
     26DAO Login connects WordPress user roles to the token balances.
     27
     28Whenever somebody logs in with Ethereum on your site for the first time, the plugin checks their token balances on the Ethereum mainnet (or test network or L2 of your choosing).
     29
     30For any user role, you can specify the minimum amount of a token the user needs to have in order to create an account.
     31
     32Your token can be a DAO Governance token, NFT, coin, or any other contract.
     33
     34If you need a site for your DAO, just spin up a WordPress, install this plugin, and connect it to your governance structure. You don’t need to know the email address of anybody.
     35
     36= Built-in “Members only” area =
     37
     38DAO Login introduces a new “DAO Member” user role. You can mark posts or pages as “DAO Member only” and they will automatically be accessible only for users with this role, or higher.
     39
     40If you want to provide a secret page, resource manual, or a perk for your DAO, NFT, or other token holders – it’s a few seconds with this plugin.
     41
     42This opens a world of possibilities for your Airdrop.
     43
     44= Power of WordPress in web3 =
     45
     46WordPress plugins offer every functionality under the sun. By connecting user roles to tokens, you can create:
     47
     48- Private forums with bbPress
     49- Private swag store with WooCommerce
     50- Private courses with Sensei
    2551
    2652== Installation ==
    … …  
    28541. Upload the plugin files to the `/wp-content/plugins/dao-login` directory, or install the plugin through the WordPress plugins screen directly.
    29551. Activate the plugin through the 'Plugins' screen in WordPress
    30 1. Now you can add Ethereum wallet addresses in the users screen (`/wp-admin/users.php`), in the "WP DAO" section
     561. In order to allow token holders to register on your site, you have to select contract addresses in the settings page (`/wp-admin/options-general.php?page=dao-login`)
     571. You can also add Ethereum wallet addresses in the users screen (`/wp-admin/users.php`), in the "WP DAO" section
    31581. Every user that has that field filled out, can log in with their wallet
     59
    3260
    3361
    … …  
    4270= 0.1.1 =
    4371* Fix security issues pointed out in WordPress security review
     72= 0.2.1 =
     73* Add an option to create users using the account balance
     74* A simple members-only area
    4475
     76

  • dao-login/trunk/dao-login.php

    r2635441 r2649870  
    11<?php
    22namespace Artpi\WPDAO;
    3 
    4 use Elliptic\EC;
    5 use kornrunner\Keccak;
    6 use WP_Error;
    73
    84/**
    95 * Plugin Name:     DAO Login
    106 * Description:     Make your site web3-ready: Log in with Ethereum or create users based on governance tokens.
    11  * Version:         0.1.2
     7 * Version:         0.2.1
    128 * Author:          Artur Piszek (artpi)
    139 * Author URI:      https://piszek.com
    … …  
    1915 */
    2016
     17require_once __DIR__ . '/dao-permissions.php';
     18require_once __DIR__ . '/members-only.php';
     19require_once __DIR__ . '/web3.php';
     20
     21register_activation_hook( __FILE__, __NAMESPACE__ . '\add_roles_on_plugin_activation' );
     22
     23class DaoLogin {
     24    public static $settings;
     25    public static $web3;
     26
     27    public static function init() {
     28        self::$settings = new Settings();
     29        self::$web3     = new Web3( self::$settings );
     30    }
     31}
     32add_action( 'init', __NAMESPACE__ . '\DaoLogin::init' );
    2133
    2234add_action(
    … …  
    2840            array(
    2941                'methods'   => 'GET',
    30                 'callback'  => __NAMESPACE__ . '\generate_message',
     42                'callback'  => __NAMESPACE__ . '\Web3::generate_message',
    3143                'arguments' => array(
    3244                    'address' => array(
    … …  
    4052);
    4153
    42 function generate_message( $request ) {
    43     $nonce     = wp_create_nonce( 'eth_login' );
    44     $uri       = get_site_url();
    45     $domain    = parse_url( $uri, PHP_URL_HOST );
    46     $statement = esc_attr__( 'Log In with your Ethereum wallet', 'dao-login' ); // TBD
    47     $version   = 1; // Per https://github.com/ethereum/EIPs/blob/9a9c5d0abdaf5ce5c5dd6dc88c6d8db1b130e95b/EIPS/eip-4361.md#example-message-to-be-signed
    48     $issued_at = gmdate( 'Y-m-d\TH:i:s\Z' );
    49 
    50     // This is copy-pasted from https://github.com/ethereum/EIPs/blob/9a9c5d0abdaf5ce5c5dd6dc88c6d8db1b130e95b/EIPS/eip-4361.md#informal-message-template
    51     $message = "{$domain} wants you to sign in with your Ethereum account:
    52 {$request['address']}
    53 
    54 {$statement}
    55 
    56 URI: {$uri}
    57 Version: {$version}
    58 Nonce: {$nonce}
    59 Issued At: {$issued_at}
    60 ";
    61     // This attempt will auto expire in 5 minutes. This way, we'll save the message server-side to check after the login attempt.
    62     set_transient( 'wp_dao_message_' . $request['address'], $message, 60 * 5 );
    63     return array(
    64         'address' => $request['address'],
    65         'message' => $message,
    66         'nonce'   => $nonce,
    67     );
    68 }
    6954
    7055/**
    … …  
    8671        return $user;
    8772    }
    88     $nonce = sanitize_title( $_POST['eth_login_nonce'] );
     73    $nonce   = sanitize_title( $_POST['eth_login_nonce'] );
    8974    $address = sanitize_title( $_POST['eth_login_address'] );
    9075    // We stored the message in the DB before sending it to the client.
    … …  
    9883
    9984    // Now let's check the signature.
    100     if ( ! verify_signature( $message, $signature, $address ) ) {
     85    if ( ! Web3::verify_signature( $message, $signature, $address ) ) {
    10186        return new \WP_Error( 'eth_login_sig', esc_attr__( 'ETH Signature doesent match!', 'dao-login' ) );
    10287    }
    … …  
    11297        )
    11398    );
    114     $users = $user_query->get_results();
     99    $users      = $user_query->get_results();
    115100    if ( isset( $users[0] ) ) {
    116101        return $users[0];
     102    } elseif ( DaoLogin::$settings->is_registering_enabled() ) {
     103        // Allow registering through the API.
     104        $balances = DaoLogin::$web3->get_token_balances( $address, DaoLogin::$settings->get_token_list() );
     105        $role     = balances_to_role( DaoLogin::$settings->get_tokens_array(), $balances );
     106        if ( $role ) {
     107            $user_id = wp_create_user( $address, wp_generate_password(), "{$address}@ethmail.cc" );
     108            add_user_meta( $user_id, 'eth_address', $address, true );
     109            $user = get_user_by( 'ID', $user_id );
     110            $user->set_role( $role );
     111            return $user;
     112        } else {
     113            return new \WP_Error( 'eth_login_insufficient_funds', esc_attr__( 'Insufficient tokens to register on this site.', 'dao-login' ) );
     114        }
    117115    } else {
    118116        return new \WP_Error( 'eth_login_nouser', esc_attr__( 'No user connected to this Ethereum wallet.', 'dao-login' ) );
    … …  
    124122
    125123
    126 /**
    127  * This will verify Ethereum signed message according to the specification.
    128  * From https://github.com/simplito/elliptic-php#verifying-ethereum-signature
    129  */
    130 function verify_signature( $message, $signature, $address ) {
    131     require_once __DIR__ . '/vendor/autoload.php';
    132     $msglen = strlen( $message );
    133     $hash   = Keccak::hash( "\x19Ethereum Signed Message:\n{$msglen}{$message}", 256 );
    134     $sign   = [
    135         'r' => substr( $signature, 2, 64 ),
    136         's' => substr( $signature, 66, 64 ),
    137     ];
    138     $recid  = ord( hex2bin( substr( $signature, 130, 2 ) ) ) - 27;
    139     if ( $recid != ( $recid & 1 ) ) {
    140         return false;
     124function balances_to_role( $tokens, $balances ) {
     125    $roles = wp_roles()->roles;
     126    // I am assuming roles are going down with the order of importance.
     127    foreach ( $roles as $role_id => $role ) {
     128        foreach ( $tokens as $token_id => $token ) {
     129            foreach ( $balances as $balance ) {
     130                if (
     131                    $balance->contractAddress === $token_id &&
     132                    ! empty( $token[ "role_{$role_id}" ] ) &&
     133                    $balance->tokenBalance >= $token[ "role_{$role_id}" ]
     134                ) {
     135                    return $role_id;
     136                }
     137            }
     138        }
    141139    }
    142 
    143     $ec     = new EC( 'secp256k1' );
    144     $pubkey = $ec->recoverPubKey( $hash, $sign, $recid );
    145 
    146     return $address == pub_key_address( $pubkey );
     140    return false;
    147141}
    148142
    149 function pub_key_address( $pubkey ) {
    150     return '0x' . substr( Keccak::hash( substr( hex2bin( $pubkey->encode( 'hex' ) ), 1 ), 256 ), 24 );
    151 }
    152143
    153144
    … …  
    184175add_action( 'personal_options_update', __NAMESPACE__ . '\save_profile_fields' );
    185176add_action( 'edit_user_profile_update', __NAMESPACE__ . '\save_profile_fields' );
     177

  • dao-login/trunk/readme.txt

    r2635441 r2649870  
    11=== DAO Login ===
    22Contributors:      artpi
    3 Tags:              signin, web3, ethereum, login, sso
     3Tags:              signin, web3, ethereum, login, sso, nft, dao
    44Requires at least: 5.3.1
    55Tested up to:      5.8.2
    6 Stable tag:        0.1.2
     6Stable tag:        0.2.1
    77Requires PHP:      7.0.0
    88License:           GPL-2.0-or-later
    99License URI:       https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Enable signin with Ethereum on your site.
     11Enable signin with Ethereum on your site and allow users to register based on Governance tokens, NFT, and token balance.
     12[Demo site here](https://wpdao.artpi.net/)
    1213
    1314== Description ==
    1415
    15 This plugin enables "Sign-In with Ethereum" protocol on your WordPress site. Your users will be able to log in with their wallets - you never have to send them the password!
    16 Enable cryptographically secure login option now!
     16DAO Login is a plugin that connects your site login system web3:
    1717
    18 - [More about sign-in with Ethereum protocol](https://login.xyz/)
    19 - [A video of this plugin in action](https://twitter.com/artpi/status/1462143739686699018)
     18- Existing users can log in with their Ethereum Wallets using the [Sign in with Ethereum](https://login.xyz)
     19- New users can create accounts based on their token balances
     20- You can designate members-only areas for token holders
     21- Works with existing WordPress user roles and other plugins. You can create a private forum, private store, DAO blog, etc.
    2022
    21 Future plans include:
    22 - Importing .eth username from ENS
    23 - Creating users based on them having a certain amount of governance tokens for a DAO, or a specific NFT
    24 - Disabling password / email options so that your users are 100% secured by private/public key pairs.
     23
     24= Automatic onboarding =
     25
     26DAO Login connects WordPress user roles to the token balances.
     27
     28Whenever somebody logs in with Ethereum on your site for the first time, the plugin checks their token balances on the Ethereum mainnet (or test network or L2 of your choosing).
     29
     30For any user role, you can specify the minimum amount of a token the user needs to have in order to create an account.
     31
     32Your token can be a DAO Governance token, NFT, coin, or any other contract.
     33
     34If you need a site for your DAO, just spin up a WordPress, install this plugin, and connect it to your governance structure. You don’t need to know the email address of anybody.
     35
     36= Built-in “Members only” area =
     37
     38DAO Login introduces a new “DAO Member” user role. You can mark posts or pages as “DAO Member only” and they will automatically be accessible only for users with this role, or higher.
     39
     40If you want to provide a secret page, resource manual, or a perk for your DAO, NFT, or other token holders – it’s a few seconds with this plugin.
     41
     42This opens a world of possibilities for your Airdrop.
     43
     44= Power of WordPress in web3 =
     45
     46WordPress plugins offer every functionality under the sun. By connecting user roles to tokens, you can create:
     47
     48- Private forums with bbPress
     49- Private swag store with WooCommerce
     50- Private courses with Sensei
    2551
    2652== Installation ==
    … …  
    28541. Upload the plugin files to the `/wp-content/plugins/dao-login` directory, or install the plugin through the WordPress plugins screen directly.
    29551. Activate the plugin through the 'Plugins' screen in WordPress
    30 1. Now you can add Ethereum wallet addresses in the users screen (`/wp-admin/users.php`), in the "WP DAO" section
     561. In order to allow token holders to register on your site, you have to select contract addresses in the settings page (`/wp-admin/options-general.php?page=dao-login`)
     571. You can also add Ethereum wallet addresses in the users screen (`/wp-admin/users.php`), in the "WP DAO" section
    31581. Every user that has that field filled out, can log in with their wallet
     59
    3260
    3361
    … …  
    4270= 0.1.1 =
    4371* Fix security issues pointed out in WordPress security review
     72= 0.2.1 =
     73* Add an option to create users using the account balance
     74* A simple members-only area
    4475
     76
Note: See TracChangeset for help on using the changeset viewer.