advausro_render_oauth2_login_button_markup(); } public function advausro_add_oauth2_login_button(string $advausro_which = 'top'): void { if ($advausro_which !== 'top') { return; } $this->advausro_render_oauth2_login_button_markup(); } private function advausro_render_oauth2_login_button_markup(): void { $advausro_url = $this->advausro_get_authorize_url(); // Only show the button if we have a valid authorize URL if (empty($advausro_url)) { return; } ?> 'code', 'client_id' => $client_id, 'redirect_uri' => $advausro_redirect_uri, 'scope' => 'openid profile email', 'state' => $advausro_state, 'prompt' => 'select_account', ]); } public function advausro_handle_oauth2_callback(): void { // This is an OAuth2 callback endpoint, which does not originate from within WordPress. // Instead of using nonce verification, we use the `state` parameter for CSRF protection. // phpcs:disable WordPress.Security.NonceVerification.Recommended $advausro_oauth2_action = sanitize_text_field(wp_unslash($_GET['oauth2'] ?? '')); if ('callback' !== $advausro_oauth2_action) { return; } $advausro_state = sanitize_text_field(wp_unslash($_GET['state'] ?? '')); $advausro_code = sanitize_text_field(wp_unslash($_GET['code'] ?? '')); // Verify state parameter (OAuth2 security mechanism) if (empty($advausro_code) || empty($advausro_state) || !get_transient('advausro_oauth2_state_' . $advausro_state)) { wp_die(esc_html__('OAuth2 callback failed: Invalid state parameter.', 'advanced-use-role-management')); } // phpcs:enable WordPress.Security.NonceVerification.Recommended delete_transient('advausro_oauth2_state_' . $advausro_state); $advausro_settings = get_option('advausro_oauth2_settings', []); // Check if settings exist and are properly configured if (empty($advausro_settings) || !is_array($advausro_settings)) { wp_die(esc_html__('OAuth2 settings not configured.', 'advanced-use-role-management')); } $advausro_redirect_uri = !empty($advausro_settings['redirect_url']) ? esc_url_raw($advausro_settings['redirect_url']) : home_url('/?oauth2=callback'); // Safely access required settings $token_url = $advausro_settings['token_url'] ?? ''; $client_id = $advausro_settings['client_id'] ?? ''; $client_secret = $advausro_settings['client_secret'] ?? ''; if (empty($token_url) || empty($client_id) || empty($client_secret)) { wp_die(esc_html__('OAuth2 settings incomplete. Please configure all required fields.', 'advanced-use-role-management')); } $advausro_response = wp_remote_post($token_url, [ 'body' => [ 'grant_type' => 'authorization_code', 'code' => $advausro_code, 'redirect_uri' => $advausro_redirect_uri, 'client_id' => $client_id, 'client_secret' => $client_secret, ], 'timeout' => 30, 'sslverify' => true, ]); if (is_wp_error($advausro_response)) { /* translators: %s: Error message returned during the OAuth token exchange. */ wp_die(esc_html(sprintf(__('OAuth token exchange failed: %s', 'advanced-use-role-management'), $advausro_response->get_error_message()))); } $advausro_body = json_decode(wp_remote_retrieve_body($advausro_response), true); if (empty($advausro_body['access_token'])) { wp_die(esc_html__('OAuth access token missing from response.', 'advanced-use-role-management')); } $this->advausro_fetch_user_info($advausro_body['access_token']); } private function advausro_fetch_user_info(string $advausro_access_token): void { $advausro_settings = get_option('advausro_oauth2_settings', []); // Check if settings exist and are properly configured if (empty($advausro_settings) || !is_array($advausro_settings)) { wp_die(esc_html__('OAuth2 settings not configured.', 'advanced-use-role-management')); } $user_info_url = $advausro_settings['user_info_url'] ?? ''; if (empty($user_info_url)) { wp_die(esc_html__('User info URL not configured in OAuth2 settings.', 'advanced-use-role-management')); } $advausro_response = wp_remote_get($user_info_url, [ 'headers' => ['Authorization' => 'Bearer ' . $advausro_access_token], 'timeout' => 30, 'sslverify' => true, ]); if (is_wp_error($advausro_response)) { /* translators: %s: Error message returned while fetching user information. */ wp_die(esc_html(sprintf(__('Failed to fetch user info: %s', 'advanced-use-role-management'), $advausro_response->get_error_message()))); } $advausro_user_info = json_decode(wp_remote_retrieve_body($advausro_response), true); if (empty($advausro_user_info['email'])) { wp_die(esc_html__('Email not provided by OAuth2 provider.', 'advanced-use-role-management')); } $this->advausro_login_user($advausro_user_info); } private function advausro_login_user(array $advausro_user_info): void { $advausro_email = sanitize_email($advausro_user_info['email']); $advausro_external_roles = $advausro_user_info['roles'] ?? []; $advausro_settings = get_option('advausro_oauth2_settings', []); $advausro_role_map = json_decode($advausro_settings['role_map'] ?? '{}', true); if (!is_array($advausro_role_map)) { $advausro_role_map = []; } if (empty($advausro_email)) { wp_die('Email is required.'); } $advausro_user = get_user_by('email', $advausro_email); if (!$advausro_user) { $advausro_password = wp_generate_password(); $advausro_user_id = wp_create_user($advausro_email, $advausro_password, $advausro_email); if (is_wp_error($advausro_user_id)) { wp_die('User creation failed: ' . esc_html($advausro_user_id->get_error_message())); } } else { $advausro_user_id = $advausro_user->ID; } $advausro_user_obj = new \WP_User($advausro_user_id); $advausro_wp_role = 'subscriber'; $advausro_mapped = false; if (isset($advausro_role_map[$advausro_email]) && get_role($advausro_role_map[$advausro_email])) { $advausro_wp_role = sanitize_text_field($advausro_role_map[$advausro_email]); $advausro_mapped = true; } if (!$advausro_mapped && is_array($advausro_external_roles)) { foreach ($advausro_external_roles as $advausro_ext_role) { if (isset($advausro_role_map[$advausro_ext_role]) && get_role($advausro_role_map[$advausro_ext_role])) { $advausro_wp_role = sanitize_text_field($advausro_role_map[$advausro_ext_role]); break; } } } $advausro_user_obj->set_role($advausro_wp_role); wp_set_auth_cookie($advausro_user_id); wp_set_current_user($advausro_user_id); if (user_can($advausro_user_id, 'list_users')) { wp_safe_redirect(admin_url('users.php')); } else { wp_safe_redirect(admin_url('profile.php')); } exit; } }