Ok, I will try to explain this with code and pictures.
I have started a dummy Xero account with fake data. I went to the Xero dashboard to create some keys whereby I can access the account data with a PHP script.
I can access the Xero data with this script...
<?php
require 'vendor/autoload.php';
define ( "XRO_APP_TYPE", "Private" );
define ( "OAUTH_CALLBACK", "oob" );
$useragent = "XeroOAuth-PHP Private App Test";
$signatures = array (
'consumer_key' => "ZYYNZPJPNL3CFUYKHCPFPMLOUR7DDO",
'shared_secret' => '3NFTALYQ5GREUH6WS4TB61NHNA2RSF',
// API versions
'core_version' => '2.0',
'payroll_version' => '1.0',
'file_version' => '1.0'
);
if (XRO_APP_TYPE == "Private" || XRO_APP_TYPE == "Partner") {
$signatures ['rsa_private_key'] = 'privatekey.pem';
$signatures ['rsa_public_key'] = 'publickey.cer';
}
$XeroOAuth = new XeroOAuth ( array_merge ( array (
'application_type' => XRO_APP_TYPE,
'oauth_callback' => OAUTH_CALLBACK,
'user_agent' => $useragent
), $signatures ) );
$initialCheck = $XeroOAuth->diagnostics ();
$checkErrors = count ( $initialCheck );
if ($checkErrors > 0) {
// you could handle any config errors here, or keep on truckin if you like to live dangerously
foreach ( $initialCheck as $check ) {
echo 'Error: ' . $check . PHP_EOL;
}
} else {
// $session = persistSession ( array (
// 'oauth_token' => $XeroOAuth->config ['consumer_key'],
// 'oauth_token_secret' => $XeroOAuth->config ['shared_secret'],
// 'oauth_session_handle' => ''
// ) );
// $oauthSession = retrieveSession ();
//print_r ($XeroOAuth);
$oauthSession = array (
'oauth_token' => $XeroOAuth->config ['consumer_key'],
'oauth_token_secret' => $XeroOAuth->config ['shared_secret'],
'oauth_session_handle' => ''
);
if (isset ( $oauthSession ['oauth_token'] )) {
$XeroOAuth->config ['access_token'] = $oauthSession ['oauth_token'];
$XeroOAuth->config ['access_token_secret'] = $oauthSession ['oauth_token_secret'];
}
$contacts_url = $XeroOAuth->url("Contacts", "core");
//$timestamp = mktime(12,0,0,5,6,2015);
//$mod_since_date = array('If-Modified-Since' => gmdate("M d Y H:i:s",$timestamp));
$mod_since_date = array();
$resp = $XeroOAuth->request("GET", $contacts_url, $mod_since_date, "", "json");
$contacts = json_decode($resp['response'],true);
foreach ($contacts['Contacts'] as $contact) {
echo $contact['ContactID'] . ' ' . $contact['Name'] . PHP_EOL; // .
//$contact['UpdatedDateUTC'] . PHP_EOL;
}
//echo gettype($contacts);
print_r(array_keys($contacts['Contacts'][0]));
}
?>
and there is only one dependency and this is the composer.json file.
{
"name": "printec/xero-proxy",
"description": "Synchronise data between Epesi and Xero",
"license": "Proprietory",
"authors": [
{
"name": "Glenn Reed",
"email": "glenn@printec.co.nz"
}
],
"minimum-stability": "dev",
"require": {
"xero/xerooauth-php": "dev-master"
}
}
The output of this script looks something like the following:
804c1525-3b6f-4e11-aadd-729dd267c9df Uta
5b2f86ba-b971-47be-a517-49b4fe3b4e24 Yolanda
ee2419d1-15d1-4308-a631-19463750f47b Ferris
63f563e1-0caf-4bba-9491-9a52e9877a84 Hoyt
02947809-445e-4712-894a-98a11b4a85df Sonya
b9ceadc7-755b-40f5-83cc-556bae4ce089 Dennis
9b61927f-c981-4cf0-96f1-f785ee87faf9 Anastasia
The other fields that I haven't printed are:
Array
(
[0] => ContactID
[1] => AccountNumber
[2] => ContactStatus
[3] => Name
[4] => FirstName
[5] => LastName
[6] => EmailAddress
[7] => SkypeUserName
[8] => BankAccountDetails
[9] => Addresses
[10] => Phones
[11] => UpdatedDateUTC
[12] => ContactGroups
[13] => IsSupplier
[14] => IsCustomer
[15] => ContactPersons
[16] => HasAttachments
[17] => HasValidationErrors
)
The purpose is take this data and synchronise it with the Epesi Contacts database probably using the
UpdatedDateUTC field.
The problem I am trying to solve at the moment is where to store the key data:
'consumer_key' => "ZYYNZPJPNL3CFUYKHCPFPMLOUR7DDO",
'shared_secret' => '3NFTALYQ5GREUH6WS4TB61NHNA2RSF',
We also will need a way to upload to key certificate files:
[list:1m4ckbwe][*:1m4ckbwe]privatekey.pem[/*:m:1m4ckbwe][*:1m4ckbwe]publickey.cer[/*:m:1m4ckbwe][/list:u:1m4ckbwe]
I don't want to hard code it in the php code as that ties the module to only one possible Xero account. Especially if we plan to distribute this module at a later date. We would like a data entry screen to capture this key data but have it only visible to the Epesi administrator. I imagine there will only be one Xero account associated with each Epesi installation but a different Epesi installation may (and likely will) need its own Xero account to sync too.
The problem we are trying to solve at the moment is how to provide a data entry form to enter these keys in a secure way. Is this possible?
Regards
Glenn @ Printec
