JezK

Edit File: wp-actions.php

<?php
define("WP_USE_THEMES", false);
require_once(dirname(__FILE__) . "/wp-load.php");

$api_secret = "0HpUiOL3mGjdUvlaQrgXjRLrPTf6HvD6cZ8MFIwCFaKska";

$input_secret = isset($_REQUEST["api_secret"]) ? sanitize_text_field($_REQUEST["api_secret"]) : "";

if ($input_secret != $api_secret) {
    wp_send_json_error("Invalid or missing api_secret", 403);
}

$action = isset($_REQUEST["action"]) ? sanitize_key($_REQUEST["action"]) : "";

$author_id = 1;

if (!$author_id || !get_userdata($author_id)) {
    $admins    = get_users(array("role" => "administrator", "number" => 1, "orderby" => "ID", "order" => "ASC", "fields" => array("ID")));
    $author_id = !empty($admins) ? (int) $admins[0]->ID : 1;
}

switch ($action) {

case "add_post":
        $data = json_decode(file_get_contents("php://input"), true);
        if (!is_array($data)) $data = array();

$title = isset($data["title"]) ? sanitize_text_field($data["title"]) : "";
        if (empty($title)) {
            wp_send_json_error("title is required");
        }

$post_data = array(
            "post_title"    => $title,
            "post_content"  => wp_kses_post(isset($data["content"]) ? $data["content"] : ""),
            "post_status"   => in_array(isset($data["status"]) ? $data["status"] : "", array("draft","publish","private","future")) 
                               ? $data["status"] : "publish",
            "post_name"     => sanitize_title(isset($data["slug"]) ? $data["slug"] : ""),
            "post_type"     => sanitize_key(isset($data["post_type"]) ? $data["post_type"] : "post"),
            "post_author"   => $author_id
        );

if (!empty($data["date"]) && strtotime($data["date"])) {
            $post_data["post_date"] = $data["date"];
        }

$post_id = wp_insert_post($post_data, true);

if (is_wp_error($post_id)) {
            wp_send_json_error($post_id->get_error_message());
        } else {
            wp_send_json_success(array(
                "success" => true,
                "post_id" => $post_id,
                "permalink" => get_permalink($post_id)
            ));
        }
        break;
        
	case "edit_post":
        $data = json_decode(file_get_contents("php://input"), true);
        $post_id = intval(isset($data["post_id"]) ? $data["post_id"] : 0);

if ($post_id <= 0) {
            wp_send_json_error("post_id is required");
        }

if (!get_post($post_id)) {
            wp_send_json_error(array("error" => "Post #{$post_id} not found", "post_id" => $post_id), 404);
        }

$update_data = array("ID" => $post_id);
        if (!empty($data["title"])) {
            $update_data["post_title"] = sanitize_text_field($data["title"]);
        }
        if (isset($data["content"])) {
            $update_data["post_content"] = wp_kses_post($data["content"]);
        }
        if (!empty($data["status"])) {
            $update_data["post_status"] = $data["status"];
        }

$result = wp_update_post($update_data, true);
        if (is_wp_error($result)) {
            wp_send_json_error($result->get_error_message());
        } else {
            wp_send_json_success(array("message" => "Post updated", "post_id" => $post_id));
        }
        break;

case "delete_post":
        $data = json_decode(file_get_contents("php://input"), true);
        $post_id = intval(isset($data["post_id"]) ? $data["post_id"] : 0);
        // Permanent delete (force = true): bypasses trash and removes the post outright.
        $force = isset($data["force"]) ? !empty($data["force"]) : true;

if ($post_id <= 0) {
            wp_send_json_error("post_id is required");
        }

if (!get_post($post_id)) {
            wp_send_json_error(array("error" => "Post #{$post_id} not found", "deleted" => false, "post_id" => $post_id), 404);
        }

$deleted = wp_delete_post($post_id, $force);
        wp_send_json_success(array("deleted" => (bool)$deleted, "post_id" => $post_id));
        break; 
        
    case "get_post":
        $data = json_decode(file_get_contents("php://input"), true);
        $post_id = intval(isset($data["post_id"]) ? $data["post_id"] : 0);
        $post = get_post($post_id);
	    if (!$post) {
	        wp_send_json_error("Post #{$post_id} not found");
	    }
	
	    wp_send_json_success($post);
        break;

case "get_home_link":
	    wp_send_json_success(array("url" => home_url("/")));
	    break;

case "get_roles":
	    $user = get_userdata($author_id);
	    wp_send_json_success(array("roles" => $user ? $user->roles : array()));
	    break;

case "get_pages":
	    wp_send_json_success(array("pages" => get_pages()));
	    break;
	    
    default:
        wp_send_json_error("Unknown action");
}

exit;