开发WordPress平板现场电子签名插件：求最简认证方法

Hey Kevin,

Great question—since you're building an on-site e-signature plugin for WordPress (and WP Signature isn't cutting it for tablet use), let's focus on the simplest, most practical authentication and implementation flow tailored to your in-person use case.

Since your staff is physically present with customers, you don't need heavy remote authentication. The core is lightweight session binding + quick customer verification:

• Temporary Device Session: When your staff opens the plugin's tablet page, generate a one-time nonce using WordPress's wp_create_nonce() that's tied to the tablet's IP and user agent. This prevents unauthorized use of the same session from another device, and the nonce expires automatically after the signing flow completes. No customer login required—your staff's presence is the primary trust layer.
• Quick Customer Identity Check: After entering the customer's name, add a simple verification step (like having the customer provide the last 4 digits of their phone number, which your staff inputs) to match against the existing customer custom post. This is fast, low-friction, and ensures you're signing the right person without overcomplicating things.

Here's how to build the end-to-end workflow:

• PDF Display & Field Collection: Store your original contracts in the WordPress media library. On the tablet page, render the PDF using PDF.js (bundle the library in your plugin to avoid external dependencies) so it stays within your interface. Use a simple HTML form to collect the customer's name and any required fields, then temporarily store this data in the session (via $_SESSION or WordPress's transient API) until signing is done.
• Touch-Friendly Signature Pad: Integrate a lightweight JS signature library (like Signature Pad) to create a touch-optimized canvas on the tablet. Once the customer signs, convert the canvas to a Base64 image string and send it to your WordPress backend.
• Document Synthesis & Storage:
  1. Use a PHP PDF library (FPDF or TCPDF) to overlay the signature image onto the original PDF at the correct position.
  2. Upload the signed PDF to the WordPress media library with wp_upload_bits(), then link it to the customer's custom post using update_post_meta().
  3. If you need to store the document elsewhere on your server, use PHP's copy() function to duplicate the file to your desired directory.

Generate & Verify the Temporary Session Nonce #

// On the tablet's signing page template
$session_nonce = wp_create_nonce('onsite_sign_' . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']);
echo '<input type="hidden" name="sign_nonce" value="' . esc_attr($session_nonce) . '">';

// When processing the form submission
if (!wp_verify_nonce($_POST['sign_nonce'], 'onsite_sign_' . $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'])) {
    wp_die('Invalid session—please refresh the page and try again.');
}

Match Customer to Custom Post #

$customer_name = sanitize_text_field($_POST['customer_name']);
$phone_last_four = sanitize_text_field($_POST['phone_last_four']);

// Query your customer custom post type
$customer_post = get_posts([
    'post_type' => 'customer',
    'numberposts' => 1,
    'meta_query' => [
        ['key' => 'customer_full_name', 'value' => $customer_name, 'compare' => '='],
        ['key' => 'customer_phone', 'value' => '%' . $phone_last_four, 'compare' => 'LIKE']
    ]
]);

if (empty($customer_post)) {
    wp_die('Customer not found or verification failed.');
}
$customer_post_id = $customer_post[0]->ID;

Save the Signature & Link to Customer Post #

// Decode Base64 signature from frontend
$signature_base64 = $_POST['signature_data'];
list(, $signature_base64) = explode(',', $signature_base64);
$signature_image = base64_decode($signature_base64);

// Save to WordPress uploads
$upload_dir = wp_upload_dir();
$signature_file_path = $upload_dir['path'] . '/signature_' . time() . '.png';
file_put_contents($signature_file_path, $signature_image);

// Create attachment and link to customer post
$attachment_data = [
    'post_mime_type' => 'image/png',
    'post_title' => 'Signature for ' . $customer_name,
    'post_status' => 'inherit'
];
$signature_attachment_id = wp_insert_attachment($attachment_data, $signature_file_path, $customer_post_id);

// Update customer post meta with signed doc details (after PDF is merged)
update_post_meta($customer_post_id, 'signed_contract_id', $signed_pdf_attachment_id);
update_post_meta($customer_post_id, 'signature_id', $signature_attachment_id);

内容的提问来源于stack exchange，提问作者Kevin Keeney