Ty_Tech/SlabUploader
6
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(#5): Woo auth is WordPress Application Passwords

Browse Source 
Replace consumer-key auth with dedicated low-priv WP user + application
password over HTTPS Basic Auth. AES-GCM at rest, server-only calls, rotation
via profile revoke. CONTENT-WOO, OPENAPI, ARCHITECTURE, DEPLOYMENT, DATA-MODEL,
AGENTS, IMPL-PLAN, README.
This commit is contained in:
grokbot_ty
2026-09-02 00:27:46 +00:00
parent fcad50d86e
commit 7bfba9f39f
8 changed files with 81 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -37,7 +37,7 @@ Hard locks live in `AGENTS.md`. Short map:
- **Hybrid:** phone owns mask/sliders/sqft/bdft/3:4 PNG; server stores, Woo, inference proxy, on-demand U2Net.
- **bdft** = sqft × thickness_in (no `/12`). TV-1 through TV-10 on the client.
- **Secrets** never in browser; AES-GCM on server; `SLAB_AES_KEY` env only.
- **Secrets** never in browser; AES-GCM on server; `SLAB_AES_KEY` env only. Woo auth = WP application password (dedicated low-priv user), not consumer keys.
- **Woo UAT:** draft default; `SLAB-UAT-*` force draft (AGENTS §5).
- **Inference OFF** until Gate C; Call 1/2 after, still inside POC.
- **Online-only for POC** (offline PWA deferred).