內容簡介
tporret API Data Importer 是一款為 WordPress 團隊提供企業級 ETL 管道的外掛，能夠自信地導入外部 API 數據。它支持靈活的導入工作流程，讓用戶能夠輕鬆管理和擴展數據導入過程。
【主要功能】
• 多連接作業管理器，組織和擴展導入
• React 標籤式導入作業工作區
• 支援多種有效載荷格式（JSON、CSV、XML 等）
• 進階 JSON 陣列遍歷和數據過濾
• Twig 模板引擎，支援複雜邏輯和嵌套映射
• 支援多種 API 認證模式
外掛標籤
開發者團隊
原文外掛簡介
tporret API Data Importer gives WordPress teams an enterprise-grade ETL pipeline for importing external API data with confidence.
The plugin ships readable source for its generated admin assets. JavaScript and CSS source files are included in the src/ directory, compiled assets are in build/, and the maintained public source repository is available at https://github.com/tporret/enterprise-api-importer.
This readme is written for WordPress administrators and site owners evaluating or using the plugin from the Plugins screen.
Use tporret API Data Importer to run clean, repeatable import workflows without sacrificing flexibility:
Multi-Connection Job Manager for organizing and scaling imports
React Tabbed Import Job Workspace (Source/Auth, Data Rules, Mapping/Templating, Automation)
Payload Format selection per import job (JSON, iCal .ics, CSV/TSV, or XML/RSS)
Format-aware extraction controls (JSON Array Path, CSV Delimiter, XML Node Element)
Advanced JSON array traversal and pre-stage data filtering to remove noise before insertion
Twig Templating Engine for complex logic, loops, and nested object mapping without drag-and-drop limitations
Twig-powered Post Title Templates with safe sanitization and fallback handling
Optional templates for new jobs (start with connection setup, add templates later)
Multiple API auth modes: none, bearer token, custom API-key header, and basic auth
Per-import Target Post Type selection (posts, pages, and public custom post types)
Parent Mapping for hierarchical post types using imported external IDs, WordPress IDs, or slugs
Media Mappings for featured images, gallery attachment IDs, and attachment-ID custom fields
Per-import Default Target Settings (post status, post author, comment status, pingback/trackback status)
Per-import editing lock toggle for imported posts (allow editing or enforce read-only)
Time-aware batch processing via WP-Cron to reduce timeout and memory-risk scenarios
Sample-only CSV/XML previews for large feeds
Atomic per-import run locks to prevent duplicate runs of the same job
Lookup-table-backed imported item matching and media deduplication for high-volume imports
Filterable JSON payload and record caps; use pagination or CSV/XML for very large feeds
Raw API record retention is disabled by default and available only as a debug setting
Multisite support with per-site importer dashboards and an optional Network Admin summary dashboard when the plugin is also active on the primary site
[New v1.3] Deep Module Architecture (internal):
Tporapdi_Validator — single validation seam for all import job fields
Tporapdi_Import_Runner — owns the 5-stage import lifecycle (Extract → Filter → Stage → Transform → Load)
Tporapdi_Template_Engine — unified Twig rendering seam for all template fields and dry-run previews
Tporapdi_Security_Guard — centralised SSRF, CIDR, and Twig security checks shared across save and run paths
Tporapdi_Job_Repository, Tporapdi_Queue_Repository, Tporapdi_Log_Repository — domain repositories hiding all SQL and cache management
Tporapdi_Media_Ingestor — isolated image sideload, HTML rewrite, featured image, gallery, and attachment-meta mapping logic with idempotent deduplication
Tporapdi_Cleanup_Service — chunked garbage collection for staging queue and log tables
Reporter self-registration via glob discovery — adding a new dashboard metric requires zero edits to existing files
Tporapdi_Lock_Policy — single edit-lock policy seam used by all admin UI affordances
TPORAPDI_Defaults_Resolver::normalize() — single normalization seam for post status defaults shared by REST save and import runtime
[New v1.2] Tableau-Style Reporting Dashboard: Real-time metrics on environment health, security posture, and API performance with interactive charts, status indicators, and audit activity feed
[New] Credential Encryption & REST Masking:
AES-256-CBC encryption at rest for auth_token and auth_password fields
REST GET responses mask credentials; boolean flags indicate stored state
Blank credential fields on update preserve existing encrypted values
React UI shows saved-credential indicators with placeholder text
apply_filters no longer exposes raw tokens to third-party hooks
[New] Import Pipeline Sanitization:
Twig-rendered post content sanitized via wp_kses_post before wp_insert_post
Custom meta values sanitized via sanitize_text_field before update_post_meta
Admin menu pages restricted to manage_options capability (was read)
[New] Enterprise-Grade Security Hardening:
Dedicated template management capability with multisite support
Twig template security validation (disallowed tags, size/complexity limits, syntax checking)
Template change audit logging with before/after hashes and actor metadata
SSRF prevention via hostname and CIDR allowlisting with DNS resolution
Twig variable strictness is filterable, with permissive rendering used by default for resilient imports
Imported items locked read-only (no editing, deletion, or quick-edit)
Whether you import catalogs, directory records, listings, events, or custom business data, tporret API Data Importer provides a scalable framework for structured API-to-WordPress ETL.
Built for real-world production workflows:
Title templates are rendered via Twig and sanitized before save
Target post type safely falls back to post if invalid or unavailable
Attachment is excluded by default from target post type selection
Default target post settings are validated and applied at load time for consistent publishing/discussion behavior
Hierarchical post types can map parent relationships from API fields and reconcile out-of-order parent records
Media mappings can sideload featured, gallery, and meta attachments while preserving legacy featured image fallback behavior
Imports are staged and processed in queue batches for safer long-running jobs
CSV/XML feeds stream into staging chunks, and previews stop after the sample records needed by the UI
JSON feeds are intentionally non-streaming and protected by payload/record limits
Imported-item matching and media source dedupe use dedicated lookup tables with legacy postmeta fallback
Authenticated API responses are not cached in transients
Raw API records are purged unless retention is explicitly enabled for debugging
Imported items are cryptographically linked to their origin import (read-only)
Template configuration changes are audit-logged with full actor context
Endpoints validated against configurable SSRF allowlists and HTTPS enforcement
Inline API connection testing, sample payload preview, and template dry-run rendering from the edit workspace
Development
To rebuild generated admin assets from source:
Install Node.js dependencies: npm install
Build production assets: npm run build (uses @wordpress/scripts / webpack)
For a watch/dev build: npm start
JavaScript/CSS source lives in src/
Production assets are generated into build/
The public source repository is https://github.com/tporret/enterprise-api-importer
External services
This plugin connects to external APIs that you configure in each import job.
The plugin does not hardcode any third-party API vendor. Data destination, terms, and privacy practices depend on the endpoint(s) you configure.
