fix: auto-login after checkout when no password field is present#956
fix: auto-login after checkout when no password field is present#956superdav42 merged 1 commit intomainfrom
Conversation
The simple preset (and any form using auto_generate_password) collects only an email address — no password field is rendered or submitted. After creating the WP user and customer record, the checkout's auto- login block called wp_signon() with an empty password, which silently returned a WP_Error and left the user logged out. On the subsequent redirect to the finish-checkout page the checkout element checked is_user_logged_in(), found false, and displayed the 'You need to be logged in to complete a payment' error. Fix: extract the auto-login logic into a protected login_customer_after_checkout() method. When a password is available (standard form), wp_signon() is used as before. When no password was collected, the method logs the user in directly via wp_set_auth_cookie() since the user was just created in this very request, then fires the wp_login action for consistency. Tests: four new cases in Checkout_Test cover the no-password path, the with-password path, the already-logged-in no-op, and the graceful handling of a customer whose user_id is 0.
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
|
Performance Test Results Performance test results for 88be131 are in 🛎️! Note: the numbers in parentheses show the difference to the previous (baseline) test run. Differences below 2% or 0.5 in absolute values are not shown. URL:
|
1 participant
What
Fixes the "You need to be logged in to complete a payment" error shown on the finish-checkout page when using the simple preset or any checkout form with
auto_generate_passwordenabled.Root cause
The simple preset's password field has
auto_generate_password: true, so no password input is rendered or submitted. After signup, the auto-login block inprocess_checkout()calledwp_signon()withuser_password => false(therequest_or_session('password')default). WordPress silently rejects that credential and returns aWP_Error, leaving the user logged out. On the subsequent redirect towu-finish-checkout,is_user_logged_in()returns false and the element shows the login-required error instead of the success state.Fix
Extract the auto-login block into a new protected method
login_customer_after_checkout().wp_signon()unchanged.auto_generate_passwordforms): logs the user in directly viawp_set_auth_cookie()using the customer'suser_id. The user was just created in this very request so no credential round-trip is needed.do_action('wp_login', ...)is fired for consistency with the normal path.Files changed
EDIT: inc/checkout/class-checkout.php— replace inline auto-login block with$this->login_customer_after_checkout()call; add the new protected method.EDIT: tests/WP_Ultimo/Checkout/Checkout_Test.php— four new tests forlogin_customer_after_checkout: no-password path fireswp_login, with-password path fireswp_login, already-logged-in is a no-op, and zero user_id is handled gracefully.Testing
The four new cases all pass:
test_login_customer_after_checkout_no_password_fires_wp_logintest_login_customer_after_checkout_with_password_fires_wp_logintest_login_customer_after_checkout_noop_when_logged_intest_login_customer_after_checkout_missing_wp_user_is_safeaidevops.sh v3.13.1 plugin for OpenCode v1.3.17 with claude-sonnet-4-6 spent 11h 32m and 30,592 tokens on this with the user in an interactive session.