WordPress/BuddyPress程序化认证需求：外部API注册用户后认证实现

Alright, let's walk through how to implement programmatic authentication for WordPress/BuddyPress now that you've got the user creation flow sorted via your external API. Since you're already validating users externally and creating WP accounts with a random password, we can skip the standard password check and directly authenticate the user once their identity is confirmed.

Step 1: Core WordPress Authentication #

The key here is to bypass the password requirement (since your external API already verified the user) and set the authentication cookie directly. Here's how to do it:

// Get the user from your external API's callback data (e.g., email or username)
$user_email = 'user@example.com'; // Replace with actual user email from your API payload
$user = get_user_by('email', $user_email);

if ($user && !is_wp_error($user)) {
    // First, check if the user account is active (WP sets user_status to 0 by default for active users)
    if ($user->user_status !== 0) {
        // Handle disabled account case (return error, log, etc.)
        return new WP_Error('account_disabled', 'This user account is disabled.');
    }

    // Set the authentication cookie and set the current user
    wp_set_auth_cookie($user->ID, true); // The second parameter enables "remember me"
    wp_set_current_user($user->ID);

    // Trigger WordPress' native login hook to ensure all related actions fire
    do_action('wp_login', $user->user_login, $user);
} else {
    // Handle user not found scenario
    return new WP_Error('user_not_found', 'No user exists with this email.');
}

Step 2: BuddyPress-Specific Enhancements #

BuddyPress has its own user session and activity tracking, so we need to sync those to make the login fully compatible:

// Add this inside the valid user check block above
if (function_exists('bp_core_login')) {
    // Update the user's last activity timestamp (keeps BP's "online" status accurate)
    bp_update_user_last_activity($user->ID, bp_core_current_time());
    
    // Trigger BuddyPress' login action to fire any BP-specific hooks
    do_action('bp_core_login_user', $user->ID);
}

Step 3: Secure Your Authentication Endpoint #

Since this is a programmatic flow, you need to secure it to prevent unauthorized access. A common approach is to create a custom REST API endpoint with API key validation:

add_action('rest_api_init', function () {
    register_rest_route('your-api/v1', '/authenticate', [
        'methods' => 'POST',
        'callback' => 'programmatic_bp_authentication',
        'permission_callback' => function ($request) {
            // Validate your external API's key (store this securely in wp-config.php!)
            $valid_api_key = defined('YOUR_EXTERNAL_API_KEY') ? YOUR_EXTERNAL_API_KEY : '';
            $provided_key = $request->get_param('api_key');

            if ($provided_key !== $valid_api_key) {
                return new WP_Error('invalid_key', 'Invalid API authentication key.', ['status' => 403]);
            }
            return true;
        }
    ]);
});

function programmatic_bp_authentication($request) {
    $user_email = $request->get_param('user_email');
    if (!$user_email) {
        return new WP_Error('missing_data', 'User email is required.', ['status' => 400]);
    }

    $user = get_user_by('email', $user_email);
    if (!$user || is_wp_error($user)) {
        return new WP_Error('user_not_found', 'User not found.', ['status' => 404]);
    }

    if ($user->user_status !== 0) {
        return new WP_Error('account_disabled', 'Account is disabled.', ['status' => 403]);
    }

    // Core WP auth
    wp_set_auth_cookie($user->ID, true);
    wp_set_current_user($user->ID);
    do_action('wp_login', $user->user_login, $user);

    // BP sync
    if (function_exists('bp_core_login')) {
        bp_update_user_last_activity($user->ID, bp_core_current_time());
        do_action('bp_core_login_user', $user->ID);
    }

    // Return success response
    return rest_ensure_response([
        'success' => true,
        'message' => 'User authenticated successfully.',
        'user_id' => $user->ID,
        'bp_profile_url' => bp_core_get_user_domain($user->ID)
    ]);
}

Key Notes: #

• Avoid wp_signon(): This function requires a valid password, which we don't need here since your external API already verified the user's identity. Using wp_set_auth_cookie() is the right approach for programmatic login.
• HTTPS is mandatory: If your external API communicates with this WP endpoint over the web, always use HTTPS to protect sensitive data like API keys and user emails.
• Redirects (if needed): If you're handling login in a server-side context (not an API), you can add a redirect after authentication:

  wp_redirect(bp_core_get_user_domain($user->ID));
  exit;
  

内容的提问来源于stack exchange，提问作者JI-Web