Composer Repository

SLSWC provides a private Composer repository endpoint that allows customers to install and update plugins and themes via Composer using their license keys for authentication.

Source: includes/class-slswc-composer-repository.php

Enabling

The Composer repository is off by default (slswc_enable_composer_repository defaults to no). Enable it at WP Admin > License Server > Settings > Advanced, in the Composer Repository section (see Settings: Advanced). It can also be turned on in the advanced setup wizard.

• Check Composer repository (slswc_enable_composer_repository).
• Optionally set Composer vendor name (slswc_composer_vendor_name). When empty, the vendor name falls back to a slug of the site's host name.

Rewrite rules are flushed automatically when the setting is toggled, so the endpoints work straight away.

Endpoint URLs

Endpoint	URL	Description
packages.json	https://your-site.com/slswc-composer/packages.json	Composer repository index
Download	https://your-site.com/slswc-composer/download/{product-slug}	Authenticated ZIP download

Rewrite Rules

// packages.json
'slswc-composer/packages\.json/?$' => 'index.php?slswc-composer=packages'

// download
'slswc-composer/download/([^/]+)/?$' => 'index.php?slswc-composer=download&slswc-composer-product=$matches[1]'

Authentication

Both endpoints use HTTP Basic Authentication. The license key is used as both username and password:

# Using curl
curl -u ABCD-1234:ABCD-1234 https://your-site.com/slswc-composer/packages.json

# Using Composer auth.json
{
    "http-basic": {
        "your-site.com": {
            "username": "ABCD-1234-EFGH-5678",
            "password": "ABCD-1234-EFGH-5678"
        }
    }
}

The server validates the license key and only returns packages the customer has valid licenses for. Valid license statuses: active, inactive, expiring (filterable via slswc_composer_valid_license_statuses).

Customer Setup

1. Add the Repository to composer.json

{
    "repositories": [
        {
            "type": "composer",
            "url": "https://your-site.com/slswc-composer"
        }
    ]
}

2. Create auth.json

{
    "http-basic": {
        "your-site.com": {
            "username": "YOUR_LICENSE_KEY",
            "password": "YOUR_LICENSE_KEY"
        }
    }
}

3. Require the Package

composer require your-vendor/my-plugin

The vendor name is configurable via the slswc_composer_vendor_name option.

packages.json Structure

The endpoint returns a standard Composer packages.json format:

{
    "packages": {
        "your-vendor/my-plugin": [
            {
                "name": "your-vendor/my-plugin",
                "version": "1.2.0",
                "type": "wordpress-plugin",
                "dist": {
                    "url": "https://your-site.com/slswc-composer/download/my-plugin",
                    "type": "zip"
                },
                "require": {
                    "composer/installers": "~1.0||~2.0"
                },
                "homepage": "https://your-site.com/product/my-plugin",
                "description": "Short product description",
                "authors": [
                    { "name": "Author Name" }
                ]
            }
        ]
    }
}

Package Type Mapping

SLSWC Software Type	Composer Type
theme	wordpress-theme
plugin (or anything else)	wordpress-plugin

The composer/installers requirement ensures packages are installed to the correct WordPress directory.

Download Flow

1. Composer requests a package download URL.
2. The download endpoint authenticates via HTTP Basic Auth.
3. The server verifies the customer has a valid license for the requested product.
4. The WooCommerce downloadable file is streamed to the client.

Caching

The packages.json response is cached per-customer in a WordPress transient:

• Key: slswc_composer_packages_{customer_id}
• Default TTL: 1 hour (filterable via slswc_composer_packages_cache_expiry)

Filters

Filter	Parameters	Description
slswc_composer_packages_json	(array $output, int $customer_id)	Filter the full packages.json payload
slswc_composer_packages_cache_expiry	(int $seconds)	Filter cache TTL (default: 3600)
slswc_composer_valid_license_statuses	(array $statuses)	Filter valid statuses for inclusion (default: active, inactive, expiring)
slswc_composer_package_entry	(array $entry, WC_Product $product)	Filter a single package entry before adding to packages.json

Example: Add Custom Package Metadata

add_filter( 'slswc_composer_package_entry', function ( $entry, $product ) {
    $entry['extra'] = array(
        'installer-name' => $product->get_slug(),
    );
    return $entry;
}, 10, 2 );

Example: Change Valid License Statuses

add_filter( 'slswc_composer_valid_license_statuses', function ( $statuses ) {
    // Also include expired licenses (e.g., for bugfix-only access)
    $statuses[] = 'expired';
    return $statuses;
} );

My Account Integration

The REST API endpoint GET /my-composer-config returns ready-to-use Composer configuration for the logged-in customer, including:

• Repository URL
• auth.json snippet
• composer.json repository entry
• List of available packages
• License keys

See My Account Endpoints.