v0.10.4 - JWT Clock Skew Fix

🐛 JWT Clock Skew Fix

Major fix: Resolved "Cannot handle token with iat prior to..." authentication errors

Problem

• Google OAuth authentication failed with error: "Cannot handle token with iat prior to 2026-01-26T06:44:59+0000"
• JWT tokens rejected due to clock skew between Supabase and WordPress servers
• Minor time differences (1-5 seconds) caused valid tokens to be rejected
• Users unable to authenticate via OAuth providers

Root Cause

• JWT verification without leeway tolerance
• Supabase server clock ahead of WordPress server clock by a few seconds
• Token iat (issued at) timestamp appeared "in the future" to WordPress
• firebase/php-jwt library rejects tokens with future timestamps by default

Solution

• Added JWT::$leeway = 60 seconds tolerance for clock skew
• Allows up to 60 seconds difference between server clocks
• Industry standard practice for distributed systems
• No security impact (tokens still validated for signature, expiration, audience)

Production Results

• ✅ Google OAuth authentication working
• ✅ Facebook OAuth authentication working
• ✅ Magic Link authentication working
• ✅ No impact on token security

Files Modified

• supabase-bridge.php - Added JWT leeway for clock skew tolerance

---

Full Changelog: v0.10.3...v0.10.4

v0.10.3 - Critical Bug Fixes (MySQL Lock & Plugin Activation)

v0.10.3 - Critical Bug Fixes

🐛 Critical Bug Fixes

Major fixes: Plugin activation fatal error and JavaScript SyntaxError resolved

Issue #24 - Fatal Error on Plugin Activation

• Problem: Plugin failed to activate on clean WordPress installations
• Error: Fatal error: Failed opening required 'tests/helpers/test-functions.php'
• Root Cause: Test file incorrectly loaded in production autoload section
• Solution: Moved test-functions.php from autoload to autoload-dev in composer.json
• Impact: Plugin now activates successfully on all WordPress installations ✅

Issues #25, #13 - JavaScript SyntaxError in Auth Form

• Problem: Browser console error: SyntaxError: Invalid character '#'
• Root Cause: WordPress content filters convert && to && in inline JavaScript
• Solution: Added output buffering hook to fix HTML entities in <script> tags
• Impact: JavaScript executes correctly, auth form fully functional ✅

MySQL Lock Deadlock Fix

• Problem: Users unable to retry login after first failed attempt (HTTP 409 "duplicate")
• Root Cause: MySQL lock not released on authentication errors
• Solution:
  • Increased lock timeout from 0 to 30 seconds
  • Moved lock acquisition AFTER early returns
  • CRITICAL FIX: Added explicit lock release in catch block
  • Lock now releases on ANY error, not just successful auth
• Impact: Eliminated infinite 409 loop ✅

WordPress Native Auth Fallback

• Added /login/ links to timeout and error screens
• Added "Classic login (email + password)" link to primary auth form
• Users can use WordPress Forgot Password flow as emergency fallback
• Handles edge cases: Cloudflare blocks, network timeouts, ISP issues

📊 Production Results

• ✅ MySQL lock automatically released on ANY error
• ✅ 30-second timeout allows retries on slow networks
• ✅ WordPress /login/ fallback for edge cases
• ✅ Eliminated infinite 409 "duplicate" loop
• ✅ 0% authentication failure rate
• ✅ All auth methods working (Google, Facebook, Magic Link)

🔗 GitHub Issues Closed

#13, #14, #15, #23, #24, #25

📝 Files Modified

• supabase-bridge.php - MySQL lock timeout, release in catch block, output buffering
• callback.html - Timeout override fix, /login/ fallback links
• auth-form.html - Classic login link
• composer.json - Autoload configuration fix

🎯 Tested on Production

https://alexeykrol.com

v0.10.2 - Auth UX Improvements & Email Deliverability

v0.10.2 - Auth UX Improvements & Email Deliverability

🔧 Major Fixes

Eliminated 76% authentication failure rate and fixed email spam issues

Problems Solved

• ❌ 76% auth failure rate caused by otp_expired errors
• ❌ Users clicking submit multiple times when emails landed in spam
• ❌ Each click invalidated previous OTP tokens
• ❌ Magic Link emails landing in spam folder (100% spam rate)
• ❌ No protection against double-clicks on auth buttons

Solution

Frontend In-Flight Guards (auth-form.html)

• ✅ Added button disable logic during email submission
• ✅ Loading states: "Отправляем..." (Sending), "Перенаправляем..." (Redirecting)
• ✅ Prevents multiple simultaneous requests
• ✅ Visual feedback for ongoing operations

Resend Cooldown System

• ✅ 60-second cooldown timer on resend button
• ✅ Countdown display: "Повторная отправка через 60 сек"
• ✅ Automatic re-enable after cooldown expires
• ✅ Prevents OTP token invalidation from rapid resends

Critical User Messaging

• ✅ Added prominent warning: "⚠️ ВАЖНО: используйте САМОЕ НОВОЕ письмо"
• ✅ Updated error messages to discourage immediate retry
• ✅ Clear instructions about using newest email
• ✅ Reduces user confusion during auth flow

Email Deliverability Fix

• ✅ Analyzed spam filter triggers in Magic Link email template
• ✅ Optimized Amazon SES email template content
• ✅ Removed spam-triggering phrases and formatting
• ✅ Result: 100% spam rate → 0% spam rate

Callback Timeout Monitoring

• ✅ Added silent 20-second timeout safeguard
• ✅ Diagnostic stage tracking (loading, extracting, authenticating)
• ✅ Fallback UI: "Вход занял слишком много времени" + retry button
• ✅ Backend logging endpoint: sb_ajax_log_auth_timeout
• ✅ Logs to wp-content/debug.log for analysis

Provider Tracking Telemetry

• ✅ Added provider tracking: magic_link, google, facebook
• ✅ Helps identify which auth method has issues
• ✅ Integrated into callback timeout monitoring
• ✅ Analytics for auth success/failure by provider

File Cleanup

• ✅ Renamed test-no-elem-2-wordpress-paste.html → callback.html
• ✅ Removed internal Supabase files from GitHub repository
• ✅ Cleaner repository structure

Production Results

Metric	Before	After
Failure Rate	12 failures/45min (76%)	0 failures/20min+ (0%)
Email Delivery	100% spam	0% spam (inbox)
User Experience	Confusing errors	Smooth flow, clear recovery

Root Cause Analysis

• 37 users (16%) made multiple Magic Link requests
• One user clicked 8 times in rapid succession
• Each new request invalidated previous OTP token
• Flow: Email in spam → User clicks resend → Token expired → otp_expired error
• Lack of cooldown and in-flight guards enabled this behavior

Files Modified

• auth-form.html - In-flight guards, cooldown timer, critical messaging
• callback.html - Timeout monitoring, provider tracking, fallback UI
• supabase-bridge.php - Timeout logging endpoint, telemetry support
• Amazon SES email template - Spam filter optimization

Deployment

✅ Deployed to production (alexeykrol.com) on 2026-01-11
✅ All auth methods working (Magic Link, Google OAuth, Facebook OAuth)
✅ Zero failures observed post-deployment
✅ Email inbox delivery confirmed

v0.10.1 - Landing URL Marketing Tracking

v0.10.1 - Landing URL Marketing Tracking

📊 Major New Feature

Track landing page URLs with UTM parameters for complete marketing attribution.

Problem Solved

• Track which Facebook ads/posts drive user registrations
• Measure effectiveness of different landing pages
• Preserve UTM parameters (e.g., ?utm=fb1) through authentication flow
• Remove Facebook/Google tracking parameters (fbclid, gclid) for privacy

Implementation

Database Schema

• Added landing_url TEXT column to wp_user_registrations table
• Created index for analytics queries
• Migration: supabase/add-landing-url-field.sql

Frontend (auth-form.html)

• cleanTrackingParams() - Removes fbclid, gclid, msclkid, gbraid, wbraid
• Captures document.referrer on auth form page
• Magic Link: passes landing_url via URL parameter (cross-device compatible)
• OAuth: saves landing_url to localStorage (same-device)

Callback Handler (callback.html)

• Priority 1: Read from URL query param (Magic Link)
• Priority 2: Read from localStorage (OAuth)
• Priority 3: null (direct auth form access)

Backend (supabase-bridge.php)

• Modified sb_log_registration_to_supabase() - added optional $landing_url parameter
• Validates via sb_validate_url_path()
• Backward compatible with existing code

Use Cases

1. Paid Traffic: User clicks Facebook ad → lands on /page/?utm=fb1 → registers → landing_url saved
2. SEO/Organic: User finds closed content → auth form → registers → landing_url = content page
3. Direct Auth: User goes to auth form directly → registers → landing_url = null

Production Testing

✅ Deployed to production (alexeykrol.com)
✅ Tested with real Facebook ads traffic
✅ Verified UTM parameters: ?utm=afb_0003, ?utm=fbp_001, ?utm=pfb_0003
✅ Facebook tracking parameters removed correctly
✅ 100% landing URL attribution for new registrations
✅ Works with multiple landing pages and UTM codes

Results

• Complete marketing attribution for Facebook ad campaigns
• Track which specific posts drive conversions
• UTM parameters preserved through entire auth flow
• Privacy-friendly: only same-domain referrers, removes ad platform IDs
• Cross-device Magic Link captures landing URL
• Zero breaking changes

Files Modified

• supabase/add-landing-url-field.sql - Database migration (NEW)
• auth-form.html - Landing URL capture and cleaning (lines 849-891)
• callback.html - Landing URL extraction (lines 371-391)
• supabase-bridge.php - Backend integration (lines 602, 618-625, 663, 1633-1641, 1736)

v0.10.0 - Course Access Auto-Enrollment

🎓 Course Access Auto-Enrollment System

Major new feature: Automatically enroll users in LearnDash courses when they purchase MemberPress memberships

Key Features:

• ✅ New Course Access admin tab with modal popup UI
• ✅ Map memberships to courses (one membership → multiple courses)
• ✅ Triggers on MemberPress transactions and subscriptions
• ✅ Preserves user progress on renewals
• ✅ Course access controlled by membership status

Bug Fixes:

• 🐛 Fix LearnDash courses loading (use get_posts instead of learndash_get_posts_by_args)
• 🎨 Redesign UI from inline form to modal popup

Installation:

Download supabase-bridge-v0.10.0.zip and install via WordPress Admin → Plugins → Add New → Upload Plugin

See CHANGELOG.md for full details.

v0.9.12 - Data Integrity & Error Handling

2026-01-04 22:45 - Error Handling Enhancement

Fixed: Supabase error detection on callback page - Users stuck on "Welcome! Wait..." message

• Added error detection BEFORE token extraction in callback handler
• Parse Supabase errors from URL hash (#error=otp_expired, etc.)
• Show user-friendly error messages with specific instructions
• Provide "Return to form" button with link to registration_url
• Handles common errors:
  • otp_expired - "Link expired, request new one"
  • otp_disabled - "Email login unavailable, use Google/Facebook"
  • access_denied - "Access denied, contact support"
  • Generic errors - Show Supabase error description

Error message format:

⚠️ [Specific error message]

Чтобы войти снова, перейдите к форме входа:
[Перейти к форме входа] → {registration_url}

2026-01-04 14:30 - Critical Infrastructure Changes

CRITICAL: SMTP Provider Migration - Migrated from Supabase SMTP to Amazon SES

• Root cause: Supabase built-in SMTP hit rate limits during high traffic (European morning registrations)
• Impact: Magic Link emails stopped sending, blocking new user registrations
• Solution: Migrated to Amazon SES (Simple Email Service)
• Implementation:
  • Created AWS account and configured SES
  • Verified domain ownership (DKIM, SPF records)
  • Updated Supabase Dashboard → Authentication → SMTP Settings
  • Tested email delivery at scale
• IMPORTANT: Supabase SMTP is ONLY for MVP/testing. Production REQUIRES external SMTP provider.
• Recommended providers: Amazon SES (used here), SendGrid, Mailgun, Postmark

2026-01-04 10:15 - Data Integrity Fixes

Fixed: Magic Link cross-device registration URL loss - ~46% of Magic Link registrations losing pair_id

• Root cause: OAuth redirects lose localStorage when user opens email on different device/browser
• Solution: Pass registration_url via URL query parameter in Magic Link emails
• Modified auth-form.html to include registration_url in emailRedirectTo callback URL
• Modified callback page (test-no-elem-2-wordpress-paste.html) to read from URL param with localStorage fallback
• Priority-based detection: URL param → localStorage → current page path
• Fixes ~46% data loss in marketing analytics

Fixed: Registration pair sync bug - WordPress pairs not syncing to Supabase

• Added missing sb_sync_pair_to_supabase() call in sb_ajax_save_pair()
• Added missing sb_delete_pair_from_supabase() call in sb_ajax_delete_pair()
• Registration pairs now properly sync from WordPress to Supabase table

Added

• Data Integrity Monitoring System - Local bash script for verifying registration tracking
  • monitoring/check-integrity.sh - Compares auth.users vs wp_user_registrations
  • Checks for lost registrations (not tracked in analytics)
  • Checks for missing landing page attribution (pair_id = NULL)
  • Configurable time period (default: 1 hour, supports custom periods)
  • Exit code 0 = all checks passed, exit code 1 = issues detected
  • Safe read-only queries (no data modifications)
• Monitoring Documentation
  • monitoring/README.md - Complete setup and usage guide
  • monitoring/.env.example - Credential template with clear instructions
  • Scheduling examples for automated checks
  • Security notes (credentials in .gitignore)

Changed

• Callback URL structure for Magic Link - Now includes registration_url parameter
  • Old: https://site.com/callback
  • New: https://site.com/callback?registration_url=/landing-page/
  • Backward compatible - falls back to localStorage if param missing
• Credential management - Added Supabase section to .production-credentials
  • Consolidated credential storage for monitoring scripts
  • Already in .gitignore for security

Testing

• Verified 100% pair_id tracking accuracy after fix (SQL queries on production data)
• Tested Magic Link cross-device flow (PC → mobile email → callback)
• Tested registration pair sync (WordPress → Supabase)
• All registration methods working: Google OAuth, Facebook OAuth, Magic Link

Results

• 100% registration tracking accuracy (no more NULL pair_ids)
• Cross-device Magic Link authentication fully working
• Real-time data integrity monitoring capability
• No lost registrations for marketing attribution

v0.9.11 - Universal Membership & Enrollment

Phase 21: Universal Membership & Enrollment

Added

• Helper Functions - Check membership/enrollment status
  • sb_user_has_membership($user_id, $membership_id) - Check if user has active membership
  • sb_user_enrolled_in_course($user_id, $course_id) - Check if user is enrolled in course
• User Status Analyzer Module - Analyzes current memberships/enrollments against registration pairs
• Action Executor Module - Executes membership/course assignments with duplicate prevention

Fixed

• Redirect Logic Conflict - Registration Pairs now take priority over Return URL
  • Landing page forms → Thank You page (regardless of user type)
  • General login → Return to origin page
• Universal Flow - Membership/enrollment now works for BOTH new and existing users

Business Impact

• Supports "One Membership — Many Courses" model
• Existing users can enroll in new courses under same membership
• User flow preserved with correct redirect to Thank You pages

Production Ready - Tested with 50-100 active users on alexeykrol.com

v0.9.10 - PKCE Flow Support & OAuth Stability

🚀 What's New

PKCE Flow Support

• OAuth now works in Chrome and Safari - Fixed authentication issues caused by Supabase JS SDK @2
• Supports both OAuth flows: Implicit flow (hash fragment) and PKCE flow (query string)
• Maintains backward compatibility with Firefox
• Verified with Google OAuth and Facebook OAuth

Bug Fixes

• dotsTimer Bug - Fixed ReferenceError in callback handler (3 occurrences)
• MemberPress Compatibility - Added patch to hide duplicate login links

Testing

✅ Chrome - OAuth working
✅ Safari - OAuth working
✅ Firefox - OAuth working
✅ Magic Link - Working
✅ Russian UI - Complete

📦 Installation

Download supabase-bridge-v0.9.10.zip and install via:
WordPress Admin → Plugins → Add New → Upload Plugin

🔧 Migration from v0.9.1

No breaking changes. Simply upload the new version and activate.

📝 Full Changelog

See CHANGELOG.md for complete version history (v0.9.6-v0.9.10).

---

🤖 Generated with Claude Code

v0.9.1 - LearnDash Banner Management UI

LearnDash Banner Management UI

Added

• New "🎓 Banner" tab in WordPress Admin for one-click banner control
• Checkbox to enable/disable enrollment banner removal without CLI
• Real-time status indicator with color-coded badges (Active, Not Active, Update Needed, Not Found)
• Automatic backups before each modification for safety
• Warning notifications after LearnDash updates prompting patch reapplication
• Backward compatible with old patch versions - auto-upgrades to latest
• AJAX-powered - instant apply/restore without page reload

Changed

• LearnDash banner patch now managed via WordPress Admin UI instead of CLI script
• Integrated into plugin settings for better UX
• Patch status automatically detected and displayed

Technical Details

• New functions: sb_get_learndash_path(), sb_get_learndash_patch_status(), sb_apply_learndash_banner_patch(), sb_restore_learndash_banner_original()
• AJAX handler: sb_ajax_save_learndash_banner for asynchronous patch operations
• Status detection: Distinguishes between applied, not_applied, needs_reapply, and not_found states
• Backward compatible: Works with both old patch format and detects LearnDash updates

---

Full Changelog: https://github.com/alexeykrol/supabase-wordpress/blob/main/CHANGELOG.md

v0.9.0 - MemberPress & LearnDash Integrations

build: Update build-release.sh to v0.8.5

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>