feat: add studio-first wordpress connect flow

Author: shortov

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [1.2.4] - 2026-04-13
+
+### Added
+- Studio-first WordPress handoff: the plugin can now consume one-time `aeo_connect` tokens issued by Studio and complete the connection without manual API-key copy/paste
+- Public `/wp-json/aeo/v1/status` health endpoint with connection metadata for Studio install/connect detection
+
+### Changed
+- REST API now serves both `aeo/v1` and `aeocas/v1` namespaces during the migration window so old and new platform clients can coexist
+
+### Fixed
+- Studio and plugin contract mismatch that prevented direct draft-publish flows from recognizing an already connected WordPress site
+
 ## [1.2.2] - 2026-04-12
 
 ### Added

admin/views/audit-page.php

@@ -28,6 +28,7 @@
 $aeocas_notice        = isset( $_GET['aeocas_notice'] ) ? sanitize_key( wp_unslash( $_GET['aeocas_notice'] ) ) : '';
 $aeocas_requested_tab = isset( $_GET['tab'] ) ? sanitize_key( wp_unslash( $_GET['tab'] ) ) : '';
 // phpcs:enable WordPress.Security.NonceVerification.Recommended
+$aeocas_connect_notice = AEOCAS_Settings::consume_connect_notice();
 $aeocas_module_labels = array(
 	'content' => array(
 		'label' => 'Content Publishing',
@@ -362,6 +363,20 @@
 	<!-- Error state (rendered by JS when needed) -->
 	<div id="aeo-audit-error"></div>
 
+	<?php if ( is_array( $aeocas_connect_notice ) && ! empty( $aeocas_connect_notice['message'] ) ) : ?>
+		<?php
+		$aeocas_connect_notice_class = 'notice-info';
+		if ( 'success' === $aeocas_connect_notice['type'] ) {
+			$aeocas_connect_notice_class = 'notice-success';
+		} elseif ( 'warning' === $aeocas_connect_notice['type'] ) {
+			$aeocas_connect_notice_class = 'notice-warning';
+		} elseif ( 'error' === $aeocas_connect_notice['type'] ) {
+			$aeocas_connect_notice_class = 'notice-error';
+		}
+		?>
+		<div class="notice <?php echo esc_attr( $aeocas_connect_notice_class ); ?> is-dismissible"><p><?php echo esc_html( $aeocas_connect_notice['message'] ); ?></p></div>
+	<?php endif; ?>
+
 	<!-- Re-audit progress -->
 	<div id="aeo-reaudit-progress" style="display: none;">
 		<div class="aeo-reaudit-bar">

aeo-content-ai-studio.php

@@ -2,7 +2,7 @@
 /**
  * Plugin Name: AEO Content AI Studio
  * Description: AI Engine Optimization for WordPress. Connects your site to AEO Content AI Studio for AI-powered content management and audit reports.
- * Version: 1.2.3
+ * Version: 1.2.4
  * Author: AEO Content, Inc.
  * Author URI: https://www.aeocontent.ai
  * License: GPL v2 or later
@@ -17,7 +17,7 @@
 	exit;
 }
 
-define( 'AEOCAS_VERSION', '1.2.3' );
+define( 'AEOCAS_VERSION', '1.2.4' );
 define( 'AEOCAS_PLUGIN_FILE', __FILE__ );
 define( 'AEOCAS_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'AEOCAS_PLUGIN_URL', plugin_dir_url( __FILE__ ) );

includes/class-aeo-rest-api.php

@@ -1,6 +1,6 @@
 <?php
 /**
- * REST API endpoints under /wp-json/aeocas/v1/.
+ * REST API endpoints under /wp-json/aeo/v1/ with /wp-json/aeocas/v1/ aliases.
  *
  * All mutating endpoints require authenticated platform requests.
  */
@@ -14,29 +14,41 @@ class AEOCAS_Rest_Api {
 	/** @var AEOCAS_Plugin */
 	private $plugin;
 
-	const REST_NAMESPACE = 'aeocas/v1';
+	const REST_NAMESPACE        = 'aeo/v1';
+	const LEGACY_REST_NAMESPACE = 'aeocas/v1';
 
 	public function __construct( $plugin ) {
 		$this->plugin = $plugin;
 		add_action( 'rest_api_init', array( $this, 'register_routes' ) );
 	}
 
+	public static function get_rest_namespaces() {
+		return array(
+			self::REST_NAMESPACE,
+			self::LEGACY_REST_NAMESPACE,
+		);
+	}
+
+	private function register_route( $route, $args ) {
+		foreach ( self::get_rest_namespaces() as $namespace ) {
+			register_rest_route( $namespace, $route, $args );
+		}
+	}
+
 	public function register_routes() {
 		// Public health check.
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/status',
 			array(
 				'methods'             => 'GET',
 				'callback'            => array( $this, 'handle_status' ),
-				'permission_callback' => array( $this, 'check_auth' ),
+				'permission_callback' => array( $this, 'allow_public_request' ),
 				'args'                => array(),
 			)
 		);
 
 		// Unified command dispatch.
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/command',
 			array(
 				'methods'             => 'POST',
@@ -56,8 +68,7 @@ public function register_routes() {
 		);
 
 		// Activity log (authenticated platform requests).
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/logs',
 			array(
 				'methods'             => 'GET',
@@ -95,8 +106,7 @@ public function register_routes() {
 		);
 
 		// Posts list (read).
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/posts',
 			array(
 				'methods'             => 'GET',
@@ -138,8 +148,7 @@ public function register_routes() {
 		);
 
 		// Single post (read).
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/posts/(?P<id>\d+)',
 			array(
 				'methods'             => 'GET',
@@ -155,8 +164,7 @@ public function register_routes() {
 		);
 
 		// Publish endpoint.
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/publish',
 			array(
 				'methods'             => 'POST',
@@ -167,8 +175,7 @@ public function register_routes() {
 		);
 
 		// Categories list.
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/categories',
 			array(
 				'methods'             => 'GET',
@@ -201,8 +208,7 @@ public function register_routes() {
 		);
 
 		// Tags list.
-		register_rest_route(
-			self::REST_NAMESPACE,
+		$this->register_route(
 			'/tags',
 			array(
 				'methods'             => 'GET',
@@ -238,17 +244,27 @@ public function check_auth( $request ) {
 		return AEOCAS_Auth::verify_request( $request );
 	}
 
+	public function allow_public_request() {
+		return true;
+	}
+
 	// ─── Status ───────────────────────────────────────────────
 
 	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- REST callback signature includes the request argument for consistency.
 	public function handle_status( $request ) {
+		$connected = ! empty( get_option( 'aeocas_site_token', '' ) ) && get_option( 'aeocas_connection_verified', false );
+
 		return rest_ensure_response(
 			array(
-				'ok'       => true,
-				'version'  => AEOCAS_VERSION,
-				'features' => $this->plugin->get_enabled_features(),
-				'site_url' => get_site_url(),
-				'home_url' => get_home_url(),
+				'ok'             => true,
+				'version'        => AEOCAS_VERSION,
+				'plugin_version' => AEOCAS_VERSION,
+				'connected'      => (bool) $connected,
+				'namespace'      => self::REST_NAMESPACE,
+				'namespaces'     => self::get_rest_namespaces(),
+				'features'       => $this->plugin->get_enabled_features(),
+				'site_url'       => get_site_url(),
+				'home_url'       => get_home_url(),
 			)
 		);
 	}