2.1.1

Fixes every PHP warning and deprecation the plugin raised during a login on PHP 8.x. Verified against WordPress 7.0.2 on PHP 8.3 with a stubbed SSO API, before and after.

• Give the shadow user a random password instead of null. wp_insert_user() raised "The user_pass field is required when creating a new user" on every shadow user creation and put the account into the password reset flow with an empty password. The password is never usable, since WordPress login and password resets are already blocked for SSO users
• Fix "Undefined array key user_nicename" for SSO users that have a lastname but no firstname
• Take the first character of the lastname with mb_substr() instead of a byte offset, which cut Ä, Ö and Å in half. A member named Öhman produced the initial "a", now correctly "o"
• Bail out of capture_login_redirect() when get_user_data_for_wp() returns false, instead of assigning an array key on it. That is deprecated since PHP 8.1 and an error in PHP 9. It is reachable whenever the SSO service fails partway through a login, which makes about five API calls
• Guard $sso_user->id, $sso_user->idp and $sso_user->local_id before reading them, so a malformed SSO response fails cleanly instead of raising undefined property warnings
• Read the request path with wp_parse_url( ..., PHP_URL_PATH ) in capture_sso_logout(), so a REQUEST_URI without a path no longer raises an undefined key warning and passes null to rtrim()
• Fire avoine_sso_login\user\prevented_password_reset\email on the branch where the email is actually prevented. It used to fire only when the email was allowed through
• Use time() instead of wp_date( 'U' ) for the shadow user login suffix

No API changes. All hook and filter names are unchanged.

2.1.0

First release after a maintenance break. No breaking changes, all hook and filter names are unchanged.

• Fix invalid REQUEST_URI check in capture_sso_logout, which made SSO initiated logout return early on every request and never log the shadow user out, #2 (thanks @teppokoivula!)
• Move code style checks to Dude Coding Standards, replacing the copied theme ruleset that referenced sniffs which no longer exist in WPCS 3
• Add PHP lint and PHP 8.3 compatibility workflows
• Rewrite README, document all functions, filters and actions with their signatures and add the legacy hook name mapping
• Document that credentials are read with getenv() and that define() in wp-config.php does not work, which is the most common reason the login url comes out empty
• Add Requires at least, Requires PHP and License URI to the plugin header. Minimum PHP is now 8.0, which is the oldest version the plugin is actually verified against
• Add changelog and gitignore
• Remove editor generated file headers