v4 API: Exchange API Key and Secret for Access and Refresh Tokens on Plugin Upgrade

includes/class-convertkit-setup.php

@@ -44,6 +44,13 @@ public function update() {
 			return;
 		}
 
+		/**
+		 * 2.5.0: Get Access token for API version 4.0 using a v3 API Key and Secret.
+		 */
+		if ( ! $current_version || version_compare( $current_version, '2.5.0', '<' ) ) {
+			$this->maybe_get_access_token_by_api_key_and_secret();
+		}
+
 		/**
 		 * 1.6.1+: Refresh Forms, Landing Pages and Tags data stored in settings,
 		 * to get new Forms Builder Settings.
@@ -75,6 +82,54 @@ public function update() {
 
 	}
 
+	/**
+	 * 2.5.0: Fetch an Access Token, Refresh Token and Expiry for v4 API use
+	 * based on the Plugin setting's v3 API Key and Secret.
+	 *
+	 * @since   2.5.0
+	 */
+	private function maybe_get_access_token_by_api_key_and_secret() {
+
+		$convertkit_settings = new ConvertKit_Settings();
+
+		// Bail if an Access Token exists; we don't need to fetch another one.
+		if ( $convertkit_settings->has_access_token() ) {
+			return;
+		}
+
+		// Bail if no API Key or Secret.
+		if ( empty( $convertkit_settings->get_api_key() ) ) {
+			return;
+		}
+		if ( empty( $convertkit_settings->get_api_secret() ) ) {
+			return;
+		}
+
+		// Get Access Token by API Key and Secret.
+		$api    = new ConvertKit_API( CONVERTKIT_OAUTH_CLIENT_ID, admin_url( 'options-general.php?page=_wp_convertkit_settings' ) );
+		$result = $api->get_access_token_by_api_key_and_secret(
+			$convertkit_settings->get_api_key(),
+			$convertkit_settings->get_api_secret()
+		);
+
+		// Bail if an error occured.
+		if ( is_wp_error( $result ) ) {
+			return;
+		}
+
+		// Store the new credentials.
+		// We don't use update_credentials(), because the response
+		// includes an `expires_at`, not a `created_at` and `expires_in`.
+		$convertkit_settings->save(
+			array(
+				'access_token'  => $result['oauth']['access_token'],
+				'refresh_token' => $result['oauth']['refresh_token'],
+				'token_expires' => $result['oauth']['expires_at'],
+			)
+		);
+
+	}
+
 	/**
 	 * 1.9.6+: Migrate _wp_convertkit_settings[default_form] to _wp_convertkit_settings[page_form] and
 	 * _wp_convertkit_settings[post_form], now that each Post Type has its own Default Form setting

tests/acceptance/general/UpgradePathsCest.php

@@ -7,29 +7,19 @@
 class UpgradePathsCest
 {
 	/**
-	 * Run common actions before running the test functions in this class.
+	 * Check for undefined index errors for a Post when upgrading from 1.4.6 or earlier to 1.4.7 or later.
 	 *
 	 * @since   1.9.6.4
 	 *
 	 * @param   AcceptanceTester $I  Tester.
 	 */
-	public function _before(AcceptanceTester $I)
+	public function testUndefinedIndexForPost(AcceptanceTester $I)
 	{
 		// Activate and Setup ConvertKit plugin.
 		$I->activateConvertKitPlugin($I);
 		$I->setupConvertKitPlugin($I);
 		$I->setupConvertKitPluginResources($I);
-	}
 
-	/**
-	 * Check for undefined index errors for a Post when upgrading from 1.4.6 or earlier to 1.4.7 or later.
-	 *
-	 * @since   1.9.6.4
-	 *
-	 * @param   AcceptanceTester $I  Tester.
-	 */
-	public function testUndefinedIndexForPost(AcceptanceTester $I)
-	{
 		// Create a Post with Post Meta that does not include landing_page and tag keys,
 		// mirroring how 1.4.6 and earlier of the Plugin worked.
 		$postID = $I->havePageInDatabase(
@@ -64,6 +54,11 @@ public function testUndefinedIndexForPost(AcceptanceTester $I)
 	 */
 	public function testUndefinedIndexForPage(AcceptanceTester $I)
 	{
+		// Activate and Setup ConvertKit plugin.
+		$I->activateConvertKitPlugin($I);
+		$I->setupConvertKitPlugin($I);
+		$I->setupConvertKitPluginResources($I);
+
 		// Create a Page with Post Meta that does not include landing_page and tag keys,
 		// mirroring how 1.4.6 and earlier of the Plugin worked.
 		$postID = $I->havePageInDatabase(
@@ -89,6 +84,67 @@ public function testUndefinedIndexForPage(AcceptanceTester $I)
 		$I->checkNoWarningsAndNoticesOnScreen($I);
 	}
 
+	/**
+	 * Tests that an Access Token and Refresh Token are obtained using an API Key and Secret
+	 * when upgrading to 2.5.0 or later.
+	 *
+	 * @since   2.5.0
+	 *
+	 * @param   AcceptanceTester $I  Tester.
+	 */
+	public function testGetAccessTokenByAPIKeyAndSecret(AcceptanceTester $I)
+	{
+		// Setup ConvertKit Plugin's settings with an API Key and Secret.
+		$I->haveOptionInDatabase(
+			'_wp_convertkit_settings',
+			[
+				'api_key'         => $_ENV['CONVERTKIT_API_KEY'],
+				'api_secret'      => $_ENV['CONVERTKIT_API_SECRET'],
+				'debug'           => 'on',
+				'no_scripts'      => '',
+				'no_css'          => '',
+				'post_form'       => $_ENV['CONVERTKIT_API_FORM_ID'],
+				'page_form'       => $_ENV['CONVERTKIT_API_FORM_ID'],
+				'product_form'    => $_ENV['CONVERTKIT_API_FORM_ID'],
+				'non_inline_form' => '',
+			]
+		);
+
+		// Define an installation version older than 2.5.0.
+		$I->haveOptionInDatabase('convertkit_version', '2.4.0');
+
+		// Activate the Plugin, as if we just upgraded to 2.5.0 or higher.
+		$I->activateConvertKitPlugin($I);
+
+		// Confirm the options table now contains an Access Token and Refresh Token.
+		$settings = $I->grabOptionFromDatabase('_wp_convertkit_settings');
+		$I->assertArrayHasKey('access_token', $settings);
+		$I->assertArrayHasKey('refresh_token', $settings);
+		$I->assertArrayHasKey('token_expires', $settings);
+
+		// Confirm the API Key and Secret are retained, in case we need them in the future.
+		$I->assertArrayHasKey('api_key', $settings);
+		$I->assertArrayHasKey('api_secret', $settings);
+		$I->assertEquals($settings['api_key'], $_ENV['CONVERTKIT_API_KEY']);
+		$I->assertEquals($settings['api_secret'], $_ENV['CONVERTKIT_API_SECRET']);
+
+		// Go to the Plugin's Settings Screen.
+		$I->loadConvertKitSettingsGeneralScreen($I);
+
+		// Confirm the Plugin authorized by checking for a Disconnect button.
+		$I->see('ConvertKit WordPress');
+		$I->see('Disconnect');
+
+		// Check the order of the Form resources are alphabetical, with 'None' as the first choice.
+		$I->checkSelectFormOptionOrder(
+			$I,
+			'#_wp_convertkit_settings_page_form',
+			[
+				'None',
+			]
+		);
+	}
+
 	/**
 	 * Deactivate and reset Plugin(s) after each test, if the test passes.
 	 * We don't use _after, as this would provide a screenshot of the Plugin