Security

[twocs]

From the CiviCRM documents there are two methods for using the REST interface for v3 (https://docs.civicrm.org/dev/en/latest/api/v3/usage/#rest): (1) for external services, and (2) for sessions already authenticated by the CMS. This plugin has covered the first but not the second.

Due to its name and I expected that this plugin would support the second form of REST (for logged in users), but this plugin supplies only the single endpoint, not the two separate endpoints. Is this by design? If so, I'd expect a simple note in the Readme that explains why CiviCRM WP REST only needs half its implementation.

[twocs]

After writing the above, I do realise (now) that it's possible to access AJAX for a CiviCRM for Wordpress install without CiviCRM-WP-Rest, by adding the following PHP code to my own plugin. $civi = civi_wp(); $civi->add_core_resources();

This makes a javascript object available for AJAX via something like CRM.api3('entity', 'action', [params], [statusMessage]);

(https://docs.civicrm.org/dev/en/latest/api/v3/usage/#ajax)

Nonetheless I must say that it was not easily apparent and from appearances, the CiviCRM WP REST plugin will never fully support REST as it is described in the CiviCRM docs. Would an admin settings page that supports selecting between the two REST routes (API key or logged in user) be out of scope for this plugin?

[mecachisenros]

@twocs that's correct this plugin only replaces CiviCRM's extern scripts (i.e. civicrm/extern/rest.php) as WP REST endpoints, it actually adds the WP REST endpoint, both extern and WP REST endpoints will coexist.

You can find some of the reasons this plugin exists here.

It does not replace the AJAX interface nor it intends to, I think that's out of this plugin's scope.

For AJAX use within WP pages, as you well referenced, civi_wp()->add_core_resources() is the recommended way to go.

If you would like something like CRM.api3/api4 available to your page/application without adding CiviCRM's resources you would need to create your own wrapper, here's an example using axios and qs and nonces as authentication, or if you are using node.js or a bundler like webpack/parcel/rollup there's node-civicrm.