Change and improve user profile #532

joshcanhelp · 2018-09-05T15:16:22Z

Improve the user profile to send password changes to Auth0 in all cases, stop password changes if they do not meet the security policy, move all in-line profile JS to an external file, TESTS. Uses the Management API framework merged in #537.

Specific Changes:

Extract all JS out of WP_Auth0_EditProfile and into an external JS file assets/js/edit-user-profile.js using wp_localize_script for PHP-generated data; add WP_Auth0_EditProfile::admin_enqueue_scripts() to load that JS on the user profile and profile edit pages.
Move WP_Auth0_EditProfile::validate_new_password() to a new method WP_Auth0_Profile_Change_Password::validate_new_password and improve to check for a failed password update and stop WordPress from updating if so; tie this to validate_password_reset so password reset attempts are sent and checked as well.
Moved WP_Auth0_EditProfile::delete_user_data() and WP_Auth0_EditProfile::delete_mfa() to WP_Auth0_Profile_Delete_Data::delete_user_data and WP_Auth0_Profile_Delete_Mfa::delete_mfa() respectively; add nonce and capability checks to both methods for more robust error handling.
Add WP_Auth0_Api_Change_Password to send password changes to Auth0.
Add WP_Auth0_Api_Delete_User_Mfa to delete an MFA provider for a user on Auth0.
Don't load Lock on the password reset screen of wp-login.php

Note to reviewers:

This is a large change but almost 60% is new tests to reach diff coverage of ~100%.

Closes #300
Closes #310
Closes #375

cocojoe · 2018-09-13T10:17:53Z

Will review once other merged and rebased.

joshcanhelp · 2018-09-17T22:50:40Z

WP_Auth0.php

@@ -123,7 +123,15 @@ public function init() {
 		$this->social_amplificator = new WP_Auth0_Amplificator( $this->db_manager, $this->a0_options );
 		$this->social_amplificator->init();

-		$edit_profile = new WP_Auth0_EditProfile( $this->db_manager, $users_repo, $this->a0_options );
+		$api_change_password = new WP_Auth0_Api_Change_Password( $this->a0_options );


Adding dependency injection to assist with testing.

joshcanhelp · 2018-09-17T22:50:56Z

WP_Auth0.php

@@ -420,7 +428,7 @@ public function render_form( $html ) {
 		// Do not show Auth0 form when ...
 		if (
 			// .. processing lost password
-			( isset( $_GET['action'] ) && $_GET['action'] == 'lostpassword' )
+			( isset( $_GET['action'] ) && in_array( $_GET['action'], array( 'lostpassword', 'rp' ) ) )


Make sure we can still reset the password if stuck.

joshcanhelp · 2018-09-17T22:51:14Z

assets/js/edit-user-profile.js

@@ -0,0 +1,81 @@
+/* global jQuery, wpa0UserProfile, alert */


Moving in all inline JS from user profile.

joshcanhelp · 2018-09-17T22:52:14Z

lib/WP_Auth0_EditProfile.php


 		if ( $pagenow == 'profile.php' || $pagenow == 'user-edit.php' ) {
-			add_action( 'admin_footer', array( $this, 'disable_email_field' ) );
+			add_action( 'admin_enqueue_scripts', array( $this, 'admin_enqueue_scripts' ) );


Move all JS to an external file, see above.

joshcanhelp · 2018-09-27T13:05:50Z

WP_Auth0.php

 		$edit_profile = new WP_Auth0_EditProfile( $this->db_manager, $users_repo, $this->a0_options );
 		$edit_profile->init();

+		$api_change_password = new WP_Auth0_Api_Change_Password( $this->a0_options, $api_client_creds );


Dependency injection for classes using the new API framework.

joshcanhelp · 2018-09-27T13:06:39Z

lib/WP_Auth0_EditProfile.php


-		add_action( 'edit_user_profile', array( $this, 'show_delete_identity' ) );


Moving to individual classes

codecov-io · 2018-09-27T17:53:11Z

Codecov Report

Merging #532 into dev will increase coverage by 2.08%.
The diff coverage is 99.18%.

@@             Coverage Diff              @@
##                dev     #532      +/-   ##
============================================
+ Coverage     12.25%   14.33%   +2.08%     
- Complexity     1666     1712      +46     
============================================
  Files            66       71       +5     
  Lines          5762     5865     +103     
============================================
+ Hits            706      841     +135     
+ Misses         5056     5024      -32

Impacted Files	Coverage Δ	Complexity Δ
lib/WP_Auth0_Api_Client.php	`1.56% <ø> (ø)`	`121 <0> (ø)`	⬇️
lib/api/WP_Auth0_Api_Client_Credentials.php	`100% <ø> (ø)`	`8 <0> (ø)`	⬇️
lib/WP_Auth0_ErrorLog.php	`68.42% <ø> (+3.42%)`	`12 <0> (-1)`	⬇️
lib/WP_Auth0_Email_Verification.php	`100% <ø> (ø)`	`4 <0> (ø)`	⬇️
lib/api/WP_Auth0_Api_Jobs_Verification.php	`100% <100%> (+62.5%)`	`7 <3> (+1)`	⬆️
lib/api/WP_Auth0_Api_Delete_User_Mfa.php	`100% <100%> (ø)`	`8 <8> (?)`
lib/profile/WP_Auth0_Profile_Delete_Data.php	`100% <100%> (ø)`	`7 <7> (?)`
lib/api/WP_Auth0_Api_Change_Password.php	`100% <100%> (ø)`	`10 <10> (?)`
lib/profile/WP_Auth0_Profile_Delete_Mfa.php	`100% <100%> (ø)`	`11 <11> (?)`
lib/WP_Auth0_EditProfile.php	`4.92% <100%> (+4.92%)`	`57 <1> (-2)`	⬇️
... and 10 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 38dab4f...9e9308e. Read the comment docs.

cocojoe

That was a long read, in general LGTM. As always the progression of tests within the SDK is great 👌
One small comment re docheader, but will approve.

cocojoe · 2018-10-01T11:05:00Z

lib/api/WP_Auth0_Api_Delete_User_Mfa.php

+	/**
+	 * Set the user_id and provider, set the authorization header, call the API, and handle the response.
+	 *
+	 * @param string|null $user_id - Auth0 user ID to delete the MFA provider.


Should we mention in docheader that the default MFA provider is google-authenticator?

@cocojoe - Function params default there and it's mostly an internally-used functionality.

joshcanhelp added this to the v3-Next milestone Sep 5, 2018

joshcanhelp added CH: Fixed and removed Ready for Review labels Sep 5, 2018

auth0 deleted a comment from codecov-io Sep 5, 2018

joshcanhelp force-pushed the fix-password-saved-to-auth0 branch from f964e10 to a746b2d Compare September 17, 2018 22:48

joshcanhelp commented Sep 17, 2018

View reviewed changes

joshcanhelp added 6 commits September 26, 2018 13:03

Change and improve user profile

ff00e12

Add tests

231c785

Revisions to allow better testing

96dcfa9

Fix failing tests

1700457

Remove classes to accept rebase

ba3e400

Merging in changes and adding tests

3dd43d0

joshcanhelp force-pushed the fix-password-saved-to-auth0 branch from 75e4066 to 3dd43d0 Compare September 26, 2018 23:44

auth0 deleted a comment from codecov-io Sep 27, 2018

joshcanhelp commented Sep 27, 2018

View reviewed changes

Add tests

9e9308e

joshcanhelp added Ready for Review and removed Do Not Merge labels Sep 27, 2018

cocojoe approved these changes Oct 1, 2018

View reviewed changes

joshcanhelp removed the Ready for Review label Oct 1, 2018

joshcanhelp merged commit 9338009 into dev Oct 1, 2018

joshcanhelp deleted the fix-password-saved-to-auth0 branch October 1, 2018 16:58

github-actions bot locked as resolved and limited conversation to collaborators Sep 19, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Change and improve user profile #532

Change and improve user profile #532

joshcanhelp commented Sep 5, 2018 •

edited

cocojoe commented Sep 13, 2018

joshcanhelp Sep 17, 2018

joshcanhelp Sep 17, 2018

joshcanhelp Sep 17, 2018

joshcanhelp Sep 17, 2018

joshcanhelp Sep 27, 2018

joshcanhelp Sep 27, 2018

codecov-io commented Sep 27, 2018 •

edited

cocojoe left a comment

cocojoe Oct 1, 2018

joshcanhelp Oct 1, 2018


		add_action( 'edit_user_profile', array( $this, 'show_delete_identity' ) );

Change and improve user profile #532

Change and improve user profile #532

Conversation

joshcanhelp commented Sep 5, 2018 • edited

cocojoe commented Sep 13, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-io commented Sep 27, 2018 • edited

Codecov Report

cocojoe left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joshcanhelp commented Sep 5, 2018 •

edited

codecov-io commented Sep 27, 2018 •

edited