Mediagraph

Description

This plugin connects your WordPress site to your Mediagraph digital asset
library. Editors browse collections, storage folders, and lightboxes from inside
the editor and insert assets in a couple of clicks.

This plugin is a client for Mediagraph, a paid third-party digital asset
management service. It does nothing on its own: a Mediagraph account is required,
and the plugin is only useful to organizations that already have a library there.

Assets you choose are copied into the WordPress media library and inserted as
standard WordPress blocks. That is the important part: a Mediagraph image is an
ordinary attachment, so cropping, rotation, alignment, image sizes, captions,
alt text, srcset, and the Replace button all behave exactly as they do for a
file you uploaded yourself.

Features

• Secure OAuth 2.0 with PKCE — no client secret stored on your site
• Browse collections, storage folders, and lightboxes with lazy-loaded trees
• Full-text search plus filters for file type, rights status, creator, capture
  date, and custom metadata
• A Mediagraph option beside Upload and Media Library in every media block
• Multi-select for galleries and the classic editor
• Automatic file-type narrowing — a Video block only offers videos
• A Mediagraph tab in the standard WordPress media modal
• Usage reporting back to Mediagraph when a post is published
• Assets are never downloaded twice; re-inserting reuses the existing file

Supported blocks

Image, Gallery, Audio, Video, Cover, File, Media & Text, Site Logo, and any
third-party block built on the standard WordPress media placeholder.

External Service

This plugin relies on Mediagraph, a third-party digital asset management
service operated by Mediagraph (https://www.mediagraph.io). The plugin is a
client for that service and cannot function without an account on it.

Nothing is sent anywhere until an administrator explicitly connects the site
under Settings → Mediagraph. Connecting starts an OAuth 2.0 authorization at
mediagraph.io; you sign in there and approve access, and the site stores the
resulting access and refresh tokens. No password ever reaches WordPress, and no
client secret is stored on your site.

Once connected, the plugin contacts https://mediagraph.io in these cases:

• When an editor opens the picker, to list collections, storage folders and
  lightboxes, and to load the filter options for your library.
• When an editor searches or filters, sending the search text and the chosen
  filters so the service can return matching assets.
• When an editor inserts an asset, to fetch that asset’s metadata and download
  the file into your WordPress media library. Mediagraph records this as a
  download against your account.

• When a post containing Mediagraph assets is published or updated, so the
  library can record where an asset has been used. This report is the most
  substantial thing the plugin sends, and it includes: which assets appear and
  how they are used, your site name, the post’s title, permalink, publication
  date, excerpt and author display name, and the post’s body as plain text.

  The body is included so newsrooms can find the story an asset ran in from
  inside Mediagraph. It is capped at 100,000 characters, and you can shorten or
  disable it with the mediagraph_article_text_limit filter — setting it to 0
  sends no body text. Posts with no Mediagraph assets are never reported.

• Periodically, to exchange an expired access token for a fresh one.

The site’s own admin URL is sent as part of the OAuth redirect so the service
can return the browser to your site after authorization.

Nothing is sent about visitors to your site, no analytics or telemetry are
collected, and the plugin adds no markup, links or credits to your public pages.

Mediagraph’s terms and privacy policy govern the data handled by the service:

• Terms of Service: https://www.mediagraph.io/terms-of-service
• Privacy Policy: https://www.mediagraph.io/privacy-policy

Building From Source

Development happens in the open at
https://github.com/mediagraph-io/mediagraph-wordpress — that repository is the
canonical source, and it is also where to report a bug or send a patch.

You do not need it to verify this plugin, though. The JavaScript in
admin/js/dist/ is compiled, so this package ships the unminified sources it is
built from, along with the tooling needed to reproduce them. Nothing is
obfuscated and no build step is hidden.

• Sources: admin/js/src/ (the picker and the block editor integration)
• Tooling: webpack.config.js, babel.config.js, package.json,
  package-lock.json
• Tests: admin/js/__tests__/

From the plugin directory, with Node.js 18 or newer:

npm ci
npm run build

That regenerates admin/js/dist/mediagraph-picker.bundle.js and
admin/js/dist/mediagraph-blocks.bundle.js. npm run lint and npm test also
run against the shipped sources. React and the WordPress packages are treated as
externals and are not bundled — the plugin uses the copies WordPress provides.

Support

https://docs.mediagraph.io or support@mediagraph.io