From 1630428b46dfdbb58c18f30da8381a1cf12ecb1e Mon Sep 17 00:00:00 2001
From: Josep Piguillem <jgpigui@gmail.com>
Date: Fri, 25 Sep 2026 08:44:34 +0200
Subject: [PATCH] =?UTF-8?q?Documentaci=C3=B3n=20Swagger=20propia:=20el=20p?=
 =?UTF-8?q?lugin=20de=20wordpress.org=20no=20incluye=20la=20interfaz=20(p?=
 =?UTF-8?q?=C3=A1gina=20en=20blanco)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

WP API SwaggerUI se sigue usando para generar el esquema OpenAPI (/rest-api/schema);
/rest-api/docs/ se sirve con Swagger UI 5.33 oficial (versión fijada, integridad SRI)
y autentica «Try it out» con la sesión de WordPress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 wp-content/mu-plugins/gure-ametsa/api.php | 68 ++++++++++++++++++++++-
 1 file changed, 66 insertions(+), 2 deletions(-)

diff --git a/wp-content/mu-plugins/gure-ametsa/api.php b/wp-content/mu-plugins/gure-ametsa/api.php
index 269e06f..8e9c801 100644
--- a/wp-content/mu-plugins/gure-ametsa/api.php
+++ b/wp-content/mu-plugins/gure-ametsa/api.php
@@ -105,9 +105,73 @@ add_action( 'graphql_register_types', function () {
 	) );
 } );
 
-/* Documentación Swagger (/rest-api/docs/): solo para usuarios conectados, salvo API_DOCS_PUBLIC=true */
+/*
+ * Documentación Swagger (/rest-api/docs/).
+ *
+ * El plugin WP API SwaggerUI genera bien el esquema OpenAPI (/rest-api/schema), pero su paquete
+ * en wordpress.org no incluye los archivos de la interfaz (assets/), así que su página sale en blanco.
+ * Servimos nuestra propia página con Swagger UI oficial (versión fijada y con integridad SRI).
+ * Solo para usuarios conectados, salvo API_DOCS_PUBLIC=true.
+ */
+define( 'GA_SWAGGER_UI_VERSION', '5.33.0' );
+
 add_action( 'template_redirect', function () {
-	if ( 'docs' === get_query_var( 'swagger_api' ) && 'true' !== getenv( 'API_DOCS_PUBLIC' ) && ! is_user_logged_in() ) {
+	if ( 'docs' !== get_query_var( 'swagger_api' ) ) {
+		return;
+	}
+	if ( 'true' !== getenv( 'API_DOCS_PUBLIC' ) && ! is_user_logged_in() ) {
 		auth_redirect();
 	}
+
+	$cdn    = 'https://cdn.jsdelivr.net/npm/swagger-ui-dist@' . GA_SWAGGER_UI_VERSION;
+	$config = array(
+		'url'   => home_url( '/rest-api/schema' ),
+		'nonce' => is_user_logged_in() ? wp_create_nonce( 'wp_rest' ) : '',
+	);
+	nocache_headers();
+	header( 'Content-Type: text/html; charset=utf-8' );
+	?>
+<!doctype html>
+<html lang="es">
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+	<meta name="robots" content="noindex">
+	<title><?php echo esc_html( get_bloginfo( 'name' ) ); ?> · API</title>
+	<link rel="stylesheet" href="<?php echo esc_url( $cdn . '/swagger-ui.css' ); ?>" integrity="sha384-Ov4/wv3j2bmct8cDc5X4ngJZohVPzEmc6uDPH8WeljUxO5vtoykvMEfbu9Vh6RaW" crossorigin="anonymous">
+	<style>body{margin:0;background:#fafafa}.ga-api-bar{padding:10px 20px;background:#401f0c;color:#fff;font:14px system-ui,sans-serif}.ga-api-bar a{color:#e6d9b7}</style>
+</head>
+<body>
+	<div class="ga-api-bar">
+		<?php echo esc_html( get_bloginfo( 'name' ) ); ?> · API REST ·
+		<a href="<?php echo esc_url( home_url( '/rest-api/schema' ) ); ?>">Esquema OpenAPI</a> ·
+		<a href="<?php echo esc_url( home_url( '/graphql' ) ); ?>">GraphQL</a> ·
+		<a href="<?php echo esc_url( admin_url() ); ?>">Volver al panel</a>
+	</div>
+	<div id="swagger-ui"></div>
+	<script src="<?php echo esc_url( $cdn . '/swagger-ui-bundle.js' ); ?>" integrity="sha384-YDALVcy8kj8yltLBVi1vBiBAUqdxvus673gM8XKwiy6aDUJFXivF/KCufekjYbVf" crossorigin="anonymous"></script>
+	<script>
+		( function ( config ) {
+			window.ui = SwaggerUIBundle( {
+				url: config.url,
+				dom_id: '#swagger-ui',
+				deepLinking: true,
+				docExpansion: 'none',
+				filter: true,
+				tryItOutEnabled: false,
+				// Con la sesión iniciada, «Try it out» se autentica con la cookie + nonce de WordPress.
+				requestInterceptor: function ( req ) {
+					if ( config.nonce && req.url.indexOf( '/wp-json/' ) !== -1 ) {
+						req.headers[ 'X-WP-Nonce' ] = config.nonce;
+						req.credentials = 'same-origin';
+					}
+					return req;
+				}
+			} );
+		} )( <?php echo wp_json_encode( $config ); ?> );
+	</script>
+</body>
+</html>
+	<?php
+	exit;
 }, 1 );