# WordPress Publishing Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Let a Site be marked as WordPress-powered with Application Password credentials, and add `php artisan posts:publish {post}` to push an existing `Post` (type `blog`) to that site's WordPress REST API, updating the post's `status` and `published_url` based on the result.

**Architecture:** Two additive migrations (`sites.cms_type`/`wp_username`/`wp_app_password`, `posts.published_url`), one new Artisan command (`app/Console/Commands/PublishPost.php`) using Laravel's `Http` facade (Guzzle under the hood, already a framework dependency — no new package) with HTTP Basic Auth against `{site.url}/wp-json/wp/v2/posts`, and updates to the existing Sites Livewire component/view, `SiteResource`, and `PostResource` to surface the new fields. No new package, no new controller, no new API routes.

**Tech Stack:** Laravel 13, PHP 8.3+, Livewire 4.3, Pest 4 (`pestphp/pest-plugin-laravel`), `Illuminate\Support\Facades\Http` for the WP REST call (mocked in tests via `Http::fake()`). Laravel 13's slim skeleton auto-discovers commands placed in `app/Console/Commands` — no `Kernel.php` registration needed.

## Global Constraints

- No authentication/authorization anywhere (UI, API, or command) — local network only, per spec.
- `cms_type` enum: `wordpress`, `custom`, `other`; default `custom`.
- `wp_username` / `wp_app_password` are nullable columns; no DB-level constraint ties them to `cms_type = wordpress` (validated at UI/command level instead).
- `posts.published_url` is nullable, generic (not WP-specific), set on any successful publish.
- The command only ever requests WordPress `status: publish` (immediate live publish) — no draft/future support.
- Command validates, in order, before touching the Post's status: `post.type === 'blog'`, `post.title` present, `post.site.cms_type === 'wordpress'`, `site.wp_username` + `site.wp_app_password` both present. Any failure here exits 1 with a descriptive message and leaves `Post.status` untouched.
- Only after pre-flight passes and the HTTP call is actually attempted does the command write `status = 'published'` (+ `published_url`) or `status = 'failed'` to the Post.
- Sites API (`GET /api/sites`) returns `wp_app_password` in plain text — consistent with the existing precedent that Social Accounts' API returns plain-text passwords, since the AI agent needs credentials directly.
- WordPress auth is Application Passwords (HTTP Basic Auth with `wp_username` + `wp_app_password`) — no plugin-based schemes (JWT, API-key plugins).

---

## File Structure

- `database/migrations/xxxx_add_cms_fields_to_sites_table.php` — new
- `database/migrations/xxxx_add_published_url_to_posts_table.php` — new
- `app/Models/Site.php` — modify (add `CMS_TYPES` const, fillable fields)
- `app/Models/Post.php` — modify (add `published_url` to fillable)
- `database/factories/SiteFactory.php` — modify (default `cms_type = custom`, nullable WP fields)
- `app/Console/Commands/PublishPost.php` — new (the `posts:publish` command)
- `app/Http/Resources/SiteResource.php` — modify (add `cms_type`, `wp_username`, `wp_app_password`)
- `app/Http/Resources/PostResource.php` — modify (add `published_url`)
- `app/Livewire/Sites/Index.php` — modify (cms_type + WP credential fields, validation, reveal toggle)
- `resources/views/livewire/sites/index.blade.php` — modify (CMS Type column/dropdown, conditional WP fields, password reveal)
- `tests/Feature/PublishPostCommandTest.php` — new
- `tests/Feature/Api/SitesApiTest.php` — modify (assert new fields present)
- `tests/Feature/Api/PostsApiTest.php` — modify (assert `published_url` present)
- `tests/Feature/Livewire/SitesTest.php` — modify (cms_type/WP field coverage)
- `tests/Feature/SiteModelTest.php` — modify (default cms_type coverage)

---

## Task 1: Add `cms_type` + WordPress credential columns to `sites`

**Files:**
- Create: `database/migrations/xxxx_add_cms_fields_to_sites_table.php`
- Modify: `app/Models/Site.php`
- Modify: `database/factories/SiteFactory.php`
- Test: `tests/Feature/SiteModelTest.php`

**Interfaces:**
- Produces: `Site::CMS_TYPES = ['wordpress', 'custom', 'other']` constant; `Site` fillable gains `cms_type`, `wp_username`, `wp_app_password`; DB columns `sites.cms_type` (string, default `'custom'`), `sites.wp_username` (string, nullable), `sites.wp_app_password` (string, nullable).

- [ ] **Step 1: Write the failing test**

Add to `tests/Feature/SiteModelTest.php`:

```php
test('a site defaults to cms_type custom with null WordPress credentials', function () {
    $site = Site::create([
        'name' => 'My Blog',
        'url' => 'https://example.com',
    ]);

    expect($site->fresh())
        ->cms_type->toBe('custom')
        ->wp_username->toBeNull()
        ->wp_app_password->toBeNull();
});

test('a site can be created as WordPress with credentials', function () {
    $site = Site::create([
        'name' => 'My WP Blog',
        'url' => 'https://wp.example.com',
        'cms_type' => 'wordpress',
        'wp_username' => 'admin',
        'wp_app_password' => 'abcd 1234 efgh 5678',
    ]);

    expect($site->fresh())
        ->cms_type->toBe('wordpress')
        ->wp_username->toBe('admin')
        ->wp_app_password->toBe('abcd 1234 efgh 5678');
});
```

- [ ] **Step 2: Run test to verify it fails**

Run: `php artisan test --filter=SiteModelTest`
Expected: FAIL — `cms_type` column/attribute does not exist (SQL error or null mismatch).

- [ ] **Step 3: Create the migration**

Run: `php artisan make:migration add_cms_fields_to_sites_table --table=sites`

Replace the generated file's contents with:

```php
<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::table('sites', function (Blueprint $table) {
            $table->string('cms_type')->default('custom')->after('description');
            $table->string('wp_username')->nullable()->after('cms_type');
            $table->string('wp_app_password')->nullable()->after('wp_username');
        });
    }

    public function down(): void
    {
        Schema::table('sites', function (Blueprint $table) {
            $table->dropColumn(['cms_type', 'wp_username', 'wp_app_password']);
        });
    }
};
```

- [ ] **Step 4: Update the `Site` model**

Replace `app/Models/Site.php` contents with:

```php
<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;

class Site extends Model
{
    use HasFactory;

    public const CMS_TYPES = ['wordpress', 'custom', 'other'];

    protected $fillable = [
        'name',
        'url',
        'description',
        'cms_type',
        'wp_username',
        'wp_app_password',
    ];
}
```

- [ ] **Step 5: Update `SiteFactory`**

Replace `database/factories/SiteFactory.php` contents with:

```php
<?php

namespace Database\Factories;

use App\Models\Site;
use Illuminate\Database\Eloquent\Factories\Factory;

class SiteFactory extends Factory
{
    protected $model = Site::class;

    public function definition(): array
    {
        return [
            'name' => fake()->company(),
            'url' => fake()->url(),
            'description' => fake()->optional()->sentence(),
            'cms_type' => 'custom',
            'wp_username' => null,
            'wp_app_password' => null,
        ];
    }

    public function wordpress(): static
    {
        return $this->state(fn () => [
            'cms_type' => 'wordpress',
            'wp_username' => fake()->userName(),
            'wp_app_password' => fake()->password(),
        ]);
    }
}
```

- [ ] **Step 6: Run the migration and tests**

Run: `php artisan migrate && php artisan test --filter=SiteModelTest`
Expected: PASS (both new tests, plus the two pre-existing ones).

- [ ] **Step 7: Commit**

```bash
git add database/migrations app/Models/Site.php database/factories/SiteFactory.php tests/Feature/SiteModelTest.php
git commit -m "feat: add cms_type and WordPress credential fields to sites"
```

---

## Task 2: Add `published_url` column to `posts`

**Files:**
- Create: `database/migrations/xxxx_add_published_url_to_posts_table.php`
- Modify: `app/Models/Post.php`
- Test: `tests/Feature/PostModelTest.php`

**Interfaces:**
- Produces: `Post` fillable gains `published_url`; DB column `posts.published_url` (string, nullable).

- [ ] **Step 1: Write the failing test**

Add to `tests/Feature/PostModelTest.php`:

```php
test('a post can store a published_url', function () {
    $post = Post::factory()->create(['published_url' => null]);

    $post->update(['published_url' => 'https://example.com/2026/07/my-post']);

    expect($post->fresh()->published_url)->toBe('https://example.com/2026/07/my-post');
});

test('published_url defaults to null', function () {
    $post = Post::factory()->create();

    expect($post->fresh()->published_url)->toBeNull();
});
```

- [ ] **Step 2: Run test to verify it fails**

Run: `php artisan test --filter=PostModelTest`
Expected: FAIL — `published_url` column does not exist.

- [ ] **Step 3: Create the migration**

Run: `php artisan make:migration add_published_url_to_posts_table --table=posts`

Replace the generated file's contents with:

```php
<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::table('posts', function (Blueprint $table) {
            $table->string('published_url')->nullable()->after('scheduled_at');
        });
    }

    public function down(): void
    {
        Schema::table('posts', function (Blueprint $table) {
            $table->dropColumn('published_url');
        });
    }
};
```

- [ ] **Step 4: Update the `Post` model**

In `app/Models/Post.php`, add `'published_url'` to the `$fillable` array (after `'scheduled_at'`):

```php
    protected $fillable = [
        'site_id',
        'social_account_id',
        'type',
        'title',
        'body',
        'status',
        'scheduled_at',
        'published_url',
    ];
```

- [ ] **Step 5: Run the migration and tests**

Run: `php artisan migrate && php artisan test --filter=PostModelTest`
Expected: PASS.

- [ ] **Step 6: Commit**

```bash
git add database/migrations app/Models/Post.php tests/Feature/PostModelTest.php
git commit -m "feat: add published_url column to posts"
```

---

## Task 3: Expose new fields in `SiteResource` and `PostResource`

**Files:**
- Modify: `app/Http/Resources/SiteResource.php`
- Modify: `app/Http/Resources/PostResource.php`
- Modify: `tests/Feature/Api/SitesApiTest.php`
- Modify: `tests/Feature/Api/PostsApiTest.php`

**Interfaces:**
- Consumes: `Site::CMS_TYPES` (Task 1), `Post.published_url` (Task 2).
- Produces: `GET /api/sites` and `GET /api/sites/{id}` responses include `cms_type`, `wp_username`, `wp_app_password`. `GET /api/posts` and `GET /api/posts/{id}` responses include `published_url`.

- [ ] **Step 1: Write the failing tests**

Add to `tests/Feature/Api/SitesApiTest.php`:

```php
test('it includes WordPress fields in the site response', function () {
    $site = Site::factory()->wordpress()->create([
        'wp_username' => 'admin',
        'wp_app_password' => 'abcd 1234 efgh 5678',
    ]);

    $response = $this->getJson("/api/sites/{$site->id}");

    $response->assertOk()
        ->assertJsonPath('data.cms_type', 'wordpress')
        ->assertJsonPath('data.wp_username', 'admin')
        ->assertJsonPath('data.wp_app_password', 'abcd 1234 efgh 5678');
});
```

Add to `tests/Feature/Api/PostsApiTest.php`:

```php
test('it includes published_url in the post response', function () {
    $post = Post::factory()->create(['published_url' => 'https://example.com/my-post']);

    $response = $this->getJson("/api/posts/{$post->id}");

    $response->assertOk()->assertJsonPath('data.published_url', 'https://example.com/my-post');
});
```

- [ ] **Step 2: Run tests to verify they fail**

Run: `php artisan test --filter=SitesApiTest && php artisan test --filter=PostsApiTest`
Expected: FAIL — `cms_type`/`wp_username`/`wp_app_password`/`published_url` keys missing from JSON response.

- [ ] **Step 3: Update `SiteResource`**

Replace `app/Http/Resources/SiteResource.php` contents with:

```php
<?php

namespace App\Http\Resources;

use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;

class SiteResource extends JsonResource
{
    public function toArray(Request $request): array
    {
        return [
            'id' => $this->id,
            'name' => $this->name,
            'url' => $this->url,
            'description' => $this->description,
            'cms_type' => $this->cms_type,
            'wp_username' => $this->wp_username,
            'wp_app_password' => $this->wp_app_password,
            'created_at' => $this->created_at,
            'updated_at' => $this->updated_at,
        ];
    }
}
```

- [ ] **Step 4: Update `PostResource`**

In `app/Http/Resources/PostResource.php`, add `'published_url' => $this->published_url,` after the `'scheduled_at'` line:

```php
    public function toArray(Request $request): array
    {
        return [
            'id' => $this->id,
            'site_id' => $this->site_id,
            'social_account_id' => $this->social_account_id,
            'type' => $this->type,
            'title' => $this->title,
            'body' => $this->body,
            'status' => $this->status,
            'scheduled_at' => $this->scheduled_at,
            'published_url' => $this->published_url,
            'created_at' => $this->created_at,
            'updated_at' => $this->updated_at,
        ];
    }
```

- [ ] **Step 5: Run tests to verify they pass**

Run: `php artisan test --filter=SitesApiTest && php artisan test --filter=PostsApiTest`
Expected: PASS.

- [ ] **Step 6: Commit**

```bash
git add app/Http/Resources/SiteResource.php app/Http/Resources/PostResource.php tests/Feature/Api/SitesApiTest.php tests/Feature/Api/PostsApiTest.php
git commit -m "feat: expose cms_type/WordPress credentials and published_url in API responses"
```

---

## Task 4: `posts:publish` Artisan command

**Files:**
- Create: `app/Console/Commands/PublishPost.php`
- Create: `tests/Feature/PublishPostCommandTest.php`

**Interfaces:**
- Consumes: `Site::CMS_TYPES` (Task 1), `site.wp_username`/`site.wp_app_password` (Task 1), `Post::TYPES` including `'blog'` (existing), `Post.published_url` (Task 2).
- Produces: `php artisan posts:publish {post}` — signature `posts:publish {post}`. On success prints `{"success": true, "url": "<published_url>"}` to stdout and exits 0, having set `Post.status = 'published'` and `Post.published_url`. On failure prints `{"success": false, "error": "<message>"}` and exits 1.

- [ ] **Step 1: Write the failing tests**

Create `tests/Feature/PublishPostCommandTest.php`:

```php
<?php

use App\Models\Post;
use App\Models\Site;
use Illuminate\Support\Facades\Http;

test('it fails when the post is not found', function () {
    $this->artisan('posts:publish', ['post' => 999])
        ->assertExitCode(1);
});

test('it fails when the post type is not blog', function () {
    $site = Site::factory()->wordpress()->create();
    $post = Post::factory()->create(['site_id' => $site->id, 'type' => 'twitter', 'title' => 'Hi']);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain("expected 'blog'")
        ->assertExitCode(1);

    expect($post->fresh()->status)->toBe($post->status);
});

test('it fails when the post has no title', function () {
    $site = Site::factory()->wordpress()->create();
    $post = Post::factory()->create(['site_id' => $site->id, 'type' => 'blog', 'title' => null]);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain('no title')
        ->assertExitCode(1);
});

test('it fails when the site is not configured as WordPress', function () {
    $site = Site::factory()->create(['cms_type' => 'custom']);
    $post = Post::factory()->create(['site_id' => $site->id, 'type' => 'blog', 'title' => 'Hi']);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain('not configured as WordPress')
        ->assertExitCode(1);
});

test('it fails when the WordPress site is missing credentials', function () {
    $site = Site::factory()->create(['cms_type' => 'wordpress', 'wp_username' => null, 'wp_app_password' => null]);
    $post = Post::factory()->create(['site_id' => $site->id, 'type' => 'blog', 'title' => 'Hi']);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain('missing WordPress credentials')
        ->assertExitCode(1);
});

test('it publishes successfully and updates the post', function () {
    Http::fake([
        '*/wp-json/wp/v2/posts' => Http::response([
            'id' => 42,
            'link' => 'https://wp.example.com/2026/07/hello-world/',
        ], 201),
    ]);

    $site = Site::factory()->wordpress()->create(['url' => 'https://wp.example.com']);
    $post = Post::factory()->create([
        'site_id' => $site->id,
        'type' => 'blog',
        'title' => 'Hello World',
        'body' => 'Post content',
        'status' => 'scheduled',
    ]);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain('"success":true')
        ->assertExitCode(0);

    expect($post->fresh())
        ->status->toBe('published')
        ->published_url->toBe('https://wp.example.com/2026/07/hello-world/');

    Http::assertSent(function ($request) use ($site) {
        return $request->url() === "{$site->url}/wp-json/wp/v2/posts"
            && $request['title'] === 'Hello World'
            && $request['content'] === 'Post content'
            && $request['status'] === 'publish';
    });
});

test('it marks the post as failed when WordPress returns an error', function () {
    Http::fake([
        '*/wp-json/wp/v2/posts' => Http::response([
            'code' => 'rest_cannot_create',
            'message' => 'Sorry, you are not allowed to create posts.',
        ], 401),
    ]);

    $site = Site::factory()->wordpress()->create();
    $post = Post::factory()->create(['site_id' => $site->id, 'type' => 'blog', 'title' => 'Hi', 'status' => 'draft']);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain('not allowed to create posts')
        ->assertExitCode(1);

    expect($post->fresh()->status)->toBe('failed');
});

test('it marks the post as failed when the site is unreachable', function () {
    Http::fake(function () {
        throw new \Illuminate\Http\Client\ConnectionException('Could not connect');
    });

    $site = Site::factory()->wordpress()->create();
    $post = Post::factory()->create(['site_id' => $site->id, 'type' => 'blog', 'title' => 'Hi', 'status' => 'draft']);

    $this->artisan('posts:publish', ['post' => $post->id])
        ->expectsOutputToContain('could not connect')
        ->assertExitCode(1);

    expect($post->fresh()->status)->toBe('failed');
});
```

- [ ] **Step 2: Run tests to verify they fail**

Run: `php artisan test --filter=PublishPostCommandTest`
Expected: FAIL — command `posts:publish` does not exist.

- [ ] **Step 3: Create the command**

Create `app/Console/Commands/PublishPost.php`:

```php
<?php

namespace App\Console\Commands;

use App\Models\Post;
use Illuminate\Console\Command;
use Illuminate\Http\Client\ConnectionException;
use Illuminate\Support\Facades\Http;

class PublishPost extends Command
{
    protected $signature = 'posts:publish {post}';

    protected $description = 'Publish an existing blog post to its site\'s WordPress REST API';

    public function handle(): int
    {
        $post = Post::with('site')->find($this->argument('post'));

        if (! $post) {
            return $this->fail("Post {$this->argument('post')} not found.");
        }

        if ($post->type !== 'blog') {
            return $this->fail("Post {$post->id} has type '{$post->type}', expected 'blog' to publish to a CMS.");
        }

        if (! $post->title) {
            return $this->fail("Post {$post->id} has no title, required to publish to WordPress.");
        }

        $site = $post->site;

        if ($site->cms_type !== 'wordpress') {
            return $this->fail("Site '{$site->name}' is not configured as WordPress (cms_type={$site->cms_type}).");
        }

        if (! $site->wp_username || ! $site->wp_app_password) {
            return $this->fail("Site '{$site->name}' is missing WordPress credentials.");
        }

        try {
            $response = Http::withBasicAuth($site->wp_username, $site->wp_app_password)
                ->post(rtrim($site->url, '/') . '/wp-json/wp/v2/posts', [
                    'title' => $post->title,
                    'content' => $post->body,
                    'status' => 'publish',
                ]);
        } catch (ConnectionException $e) {
            return $this->publishFailed($post, "could not connect to site: {$e->getMessage()}");
        }

        if ($response->failed()) {
            $message = $response->json('message') ?? 'unexpected response from WordPress';

            return $this->publishFailed($post, $message);
        }

        $link = $response->json('link');

        if (! $link) {
            return $this->publishFailed($post, 'unexpected response from WordPress: missing post link');
        }

        $post->update(['status' => 'published', 'published_url' => $link]);

        $this->line(json_encode(['success' => true, 'url' => $link]));

        return self::SUCCESS;
    }

    private function fail(string $message): int
    {
        $this->line(json_encode(['success' => false, 'error' => $message]));

        return self::FAILURE;
    }

    private function publishFailed(Post $post, string $message): int
    {
        $post->update(['status' => 'failed']);

        return $this->fail($message);
    }
}
```

- [ ] **Step 4: Run tests to verify they pass**

Run: `php artisan test --filter=PublishPostCommandTest`
Expected: PASS (all 8 tests).

- [ ] **Step 5: Commit**

```bash
git add app/Console/Commands/PublishPost.php tests/Feature/PublishPostCommandTest.php
git commit -m "feat: add posts:publish command for WordPress REST API publishing"
```

---

## Task 5: Sites UI — `cms_type` and WordPress credential fields

**Files:**
- Modify: `app/Livewire/Sites/Index.php`
- Modify: `resources/views/livewire/sites/index.blade.php`
- Modify: `tests/Feature/Livewire/SitesTest.php`

**Interfaces:**
- Consumes: `Site::CMS_TYPES` (Task 1).
- Produces: Livewire `Index` component public properties `cmsType`, `wpUsername`, `wpAppPassword`, `revealedId`; method `toggleReveal(int $id)`.

- [ ] **Step 1: Write the failing tests**

Add to `tests/Feature/Livewire/SitesTest.php`:

```php
test('a new WordPress site can be created with credentials', function () {
    Livewire::test(Index::class)
        ->set('name', 'WP Site')
        ->set('url', 'https://wp.example.com')
        ->set('cmsType', 'wordpress')
        ->set('wpUsername', 'admin')
        ->set('wpAppPassword', 'abcd 1234 efgh 5678')
        ->call('save');

    $site = Site::where('name', 'WP Site')->first();

    expect($site)
        ->cms_type->toBe('wordpress')
        ->wp_username->toBe('admin')
        ->wp_app_password->toBe('abcd 1234 efgh 5678');
});

test('WordPress username and app password are required together when cms_type is wordpress', function () {
    Livewire::test(Index::class)
        ->set('name', 'WP Site')
        ->set('url', 'https://wp.example.com')
        ->set('cmsType', 'wordpress')
        ->set('wpUsername', '')
        ->set('wpAppPassword', '')
        ->call('save')
        ->assertHasErrors(['wpUsername', 'wpAppPassword']);
});

test('a site defaults to custom cms_type with no WordPress fields required', function () {
    Livewire::test(Index::class)
        ->set('name', 'Plain Site')
        ->set('url', 'https://plain.example.com')
        ->call('save')
        ->assertHasNoErrors();

    expect(Site::where('name', 'Plain Site')->first()->cms_type)->toBe('custom');
});

test('editing a site loads its WordPress fields', function () {
    $site = Site::factory()->wordpress()->create(['wp_username' => 'editor']);

    Livewire::test(Index::class)
        ->call('edit', $site->id)
        ->assertSet('cmsType', 'wordpress')
        ->assertSet('wpUsername', 'editor');
});

test('WordPress app password can be revealed and hidden in the table', function () {
    $site = Site::factory()->wordpress()->create();

    Livewire::test(Index::class)
        ->call('toggleReveal', $site->id)
        ->assertSet('revealedId', $site->id)
        ->call('toggleReveal', $site->id)
        ->assertSet('revealedId', null);
});
```

- [ ] **Step 2: Run tests to verify they fail**

Run: `php artisan test --filter=SitesTest`
Expected: FAIL — `cmsType`/`wpUsername`/`wpAppPassword`/`toggleReveal` do not exist on the component.

- [ ] **Step 3: Update the Livewire component**

Replace `app/Livewire/Sites/Index.php` contents with:

```php
<?php

namespace App\Livewire\Sites;

use App\Models\Site;
use Livewire\Attributes\Layout;
use Livewire\Component;

#[Layout('components.layouts.app')]
class Index extends Component
{
    public bool $showForm = false;

    public ?int $editingId = null;

    public ?int $revealedId = null;

    public string $name = '';

    public string $url = '';

    public ?string $description = null;

    public string $cmsType = 'custom';

    public string $wpUsername = '';

    public string $wpAppPassword = '';

    public function render()
    {
        return view('livewire.sites.index', [
            'sites' => Site::orderBy('name')->get(),
            'cmsTypes' => Site::CMS_TYPES,
        ]);
    }

    public function create(): void
    {
        $this->resetForm();
        $this->showForm = true;
    }

    public function edit(int $id): void
    {
        $site = Site::findOrFail($id);
        $this->editingId = $site->id;
        $this->name = $site->name;
        $this->url = $site->url;
        $this->description = $site->description;
        $this->cmsType = $site->cms_type;
        $this->wpUsername = $site->wp_username ?? '';
        $this->wpAppPassword = $site->wp_app_password ?? '';
        $this->showForm = true;
    }

    public function save(): void
    {
        $validated = $this->validate([
            'name' => ['required', 'string', 'max:255'],
            'url' => ['required', 'string', 'max:255'],
            'description' => ['nullable', 'string'],
            'cmsType' => ['required', 'string', 'in:' . implode(',', Site::CMS_TYPES)],
            'wpUsername' => ['required_if:cmsType,wordpress', 'nullable', 'string', 'max:255'],
            'wpAppPassword' => ['required_if:cmsType,wordpress', 'nullable', 'string', 'max:255'],
        ]);

        Site::updateOrCreate(['id' => $this->editingId], [
            'name' => $validated['name'],
            'url' => $validated['url'],
            'description' => $validated['description'],
            'cms_type' => $validated['cmsType'],
            'wp_username' => $validated['cmsType'] === 'wordpress' ? $validated['wpUsername'] : null,
            'wp_app_password' => $validated['cmsType'] === 'wordpress' ? $validated['wpAppPassword'] : null,
        ]);

        $this->resetForm();
        $this->showForm = false;
    }

    public function delete(int $id): void
    {
        Site::findOrFail($id)->delete();
    }

    public function toggleReveal(int $id): void
    {
        $this->revealedId = $this->revealedId === $id ? null : $id;
    }

    public function resetForm(): void
    {
        $this->editingId = null;
        $this->name = '';
        $this->url = '';
        $this->description = null;
        $this->cmsType = 'custom';
        $this->wpUsername = '';
        $this->wpAppPassword = '';
        $this->resetValidation();
    }
}
```

- [ ] **Step 4: Update the view**

Replace `resources/views/livewire/sites/index.blade.php` contents with:

```blade
<div>
    <div class="flex justify-between items-center mb-4">
        <h1 class="text-xl font-semibold">Sites</h1>
        <button wire:click="create" class="bg-blue-600 text-white px-4 py-2 rounded">Add Site</button>
    </div>

    <table class="w-full bg-white border border-gray-200 rounded">
        <thead>
            <tr class="text-left border-b border-gray-200">
                <th class="p-3">Name</th>
                <th class="p-3">URL</th>
                <th class="p-3">Description</th>
                <th class="p-3">CMS Type</th>
                <th class="p-3"></th>
            </tr>
        </thead>
        <tbody>
            @foreach ($sites as $site)
                <tr wire:key="site-{{ $site->id }}" class="border-b border-gray-100">
                    <td class="p-3">{{ $site->name }}</td>
                    <td class="p-3"><a href="{{ $site->url }}" target="_blank" class="text-blue-600">{{ $site->url }}</a></td>
                    <td class="p-3">{{ $site->description }}</td>
                    <td class="p-3">
                        {{ ucfirst($site->cms_type) }}
                        @if ($site->cms_type === 'wordpress')
                            <div class="text-xs text-gray-500">
                                {{ $site->wp_username }} /
                                @if ($revealedId === $site->id)
                                    {{ $site->wp_app_password }}
                                @else
                                    ••••••••
                                @endif
                                <button wire:click="toggleReveal({{ $site->id }})" class="text-xs text-blue-600 ml-1">
                                    {{ $revealedId === $site->id ? 'Hide' : 'Show' }}
                                </button>
                            </div>
                        @endif
                    </td>
                    <td class="p-3 text-right space-x-2">
                        <button wire:click="edit({{ $site->id }})" class="text-blue-600">Edit</button>
                        <button wire:click="delete({{ $site->id }})" wire:confirm="Delete this site?" class="text-red-600">Delete</button>
                    </td>
                </tr>
            @endforeach
        </tbody>
    </table>

    @if ($showForm)
        <div class="fixed inset-0 bg-black/30 flex items-center justify-center">
            <div class="bg-white p-6 rounded w-full max-w-md space-y-4">
                <h2 class="text-lg font-semibold">{{ $editingId ? 'Edit Site' : 'Add Site' }}</h2>

                <div>
                    <label class="block text-sm font-medium">Name</label>
                    <input type="text" wire:model="name" class="w-full border rounded p-2">
                    @error('name') <span class="text-red-600 text-sm">{{ $message }}</span> @enderror
                </div>

                <div>
                    <label class="block text-sm font-medium">URL</label>
                    <input type="text" wire:model="url" class="w-full border rounded p-2">
                    @error('url') <span class="text-red-600 text-sm">{{ $message }}</span> @enderror
                </div>

                <div>
                    <label class="block text-sm font-medium">Description</label>
                    <textarea wire:model="description" class="w-full border rounded p-2"></textarea>
                </div>

                <div>
                    <label class="block text-sm font-medium">CMS Type</label>
                    <select wire:model.live="cmsType" class="w-full border rounded p-2">
                        @foreach ($cmsTypes as $type)
                            <option value="{{ $type }}">{{ ucfirst($type) }}</option>
                        @endforeach
                    </select>
                    @error('cmsType') <span class="text-red-600 text-sm">{{ $message }}</span> @enderror
                </div>

                @if ($cmsType === 'wordpress')
                    <div>
                        <label class="block text-sm font-medium">WP Username</label>
                        <input type="text" wire:model="wpUsername" class="w-full border rounded p-2">
                        @error('wpUsername') <span class="text-red-600 text-sm">{{ $message }}</span> @enderror
                    </div>

                    <div>
                        <label class="block text-sm font-medium">WP Application Password</label>
                        <input type="text" wire:model="wpAppPassword" class="w-full border rounded p-2">
                        @error('wpAppPassword') <span class="text-red-600 text-sm">{{ $message }}</span> @enderror
                    </div>
                @endif

                <div class="flex justify-end gap-2">
                    <button wire:click="$set('showForm', false)" class="px-4 py-2">Cancel</button>
                    <button wire:click="save" class="bg-blue-600 text-white px-4 py-2 rounded">Save</button>
                </div>
            </div>
        </div>
    @endif
</div>
```

- [ ] **Step 5: Run tests to verify they pass**

Run: `php artisan test --filter=SitesTest`
Expected: PASS (all tests, existing + new).

- [ ] **Step 6: Commit**

```bash
git add app/Livewire/Sites/Index.php resources/views/livewire/sites/index.blade.php tests/Feature/Livewire/SitesTest.php
git commit -m "feat: manage cms_type and WordPress credentials in Sites UI"
```

---

## Task 6: Full suite run

**Files:** none (verification only)

- [ ] **Step 1: Run the entire test suite**

Run: `php artisan test`
Expected: All tests pass, no regressions in Sites/Posts/SocialAccounts model, API, or Livewire tests.

- [ ] **Step 2: Manual smoke check of the command against real WordPress (optional, if a test WP site is available)**

Run:
```bash
php artisan tinker --execute="
\$site = App\Models\Site::create(['name' => 'Test WP', 'url' => 'https://your-test-site.example', 'cms_type' => 'wordpress', 'wp_username' => 'your-user', 'wp_app_password' => 'your-app-password']);
\$post = App\Models\Post::create(['site_id' => \$site->id, 'type' => 'blog', 'title' => 'Test Post', 'body' => 'Hello from posts:publish', 'status' => 'draft']);
echo \$post->id;
"
php artisan posts:publish <post_id_from_above>
```
Expected: JSON `{"success":true,"url":"..."}` printed, exit code 0, and the post visible live on the test WordPress site.

This step is optional/manual since it requires a real WordPress instance with Application Passwords enabled — skip if none is available; the automated `Http::fake()` tests in Task 4 already cover the logic.