feat: magic links

[miguelpeixe]

All Submissions:

• Have you followed the Newspack Contributing guideline?
• Does your code follow the WordPress' coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

This PR implements magic link functionality that should only be available to a "reader", as implemented by #1655.

Magic links are single-use authentication links that are sent to the user's registered email.

This implementation limits the number of simultaneous valid tokens to 5, which should be a safe amount in case the reader attempts to authenticate multiple devices at once. The limit is also a safety measure, because magic link creation, naturally, does not require authentication.

Also as a safety measure, magic links expire 30 minutes after creation.

This feature should only be available with reader activation enabled.

Self-Served vs. Admin-Generated

Magic links can be generated and sent by an anonymous user, these are self-served. Self-served links have a salted client hash attached to them. They are formed by the following arguments:

• Random secret
• IP
• User-agent

The random secret is stored locally through a cookie for client hash validation. If the client hash does not match, the magic link fails to authenticate.

Admin-generated links do not have a client hash and can be used by anyone.

Email

The sent email is minimalistic, filterable, and highly inspired by WP's wp_new_user_notification(). It serves the purpose of the functionality but for the "reader activation" project, all reader-related messaging should be tackled separately in a unified cohesive effort.

Management

There are a few tools available for the management of a user's magic link support. An admin can:

• Manually send a new magic link to the user
• Clear all existing tokens for a user
• Disable/enable magic link support for a user

Dashboard

CLI

A magic link can also be sent with WP-CLI:

NAME

  wp newspack magic-link send

DESCRIPTION

  Send a magic link to a reader.

SYNOPSIS

  wp newspack magic-link send <email_or_id>

OPTIONS

  <email_or_id>
    The email address or user ID of the reader.

EXAMPLES

    wp newspack magic-link send 12
    wp newspack magic-link send [email protected]

How to test the changes in this Pull Request:

Make sure you have AMP Plus on, reader revenue configured with WooCommerce and a valid Stripe test account, and the experimental reader activation flag on your wp-config.php:

define( 'NEWSPACK_EXPERIMENTAL_READER_ACTIVATION', true );

Also confirm you have a way to intercept sent emails, either through Mailhog or a configured SMTP.

Admin-generated

The quickest simple test to a magic link is by sending as an admin:

1. While logged in as admin, visit the users' dashboard and mouse over a subscriber or customer (create one if you don't have any)
2. Confirm you see the "Send magic link" option
3. Click to send
4. Confirm the email was sent
5. Copy the link and paste it into an unauthenticated session (incognito)
6. Confirm you are authenticated by visiting WC's my-account page

Admin management

Clearing tokens

1. Click to edit the subscriber and scroll to "Magic Link Management"
2. Send another magic link through this page and confirm the email was sent
3. Before using the link on a new session, click on "Clear All Tokens"
4. Attempt to use the sent link and confirm you receive the generic error message

Disabling magic links for a user

1. Send another magic link as above
2. Before using the link, click on "Disable Magic Links"
3. Confirm the "Magic Link Management" section of the page now only have a button to enable support
4. Navigate back to the users' dashboard and confirm that hovering the user does not show the "Send Magic Link" link
5. Attempt to use the previously sent link and confirm you receive the generic error message

CLI

1. Make sure you have Magic Links enabled for the user
2. Open your instance CLI and type wp newspack magic-link send –help and confirm you see appropriate instructions
3. Send a magic link using the user email: wp newspack magic-link send {email}
4. Now the same using the user ID: wp newspack magic-link send {user_id}
5. Confirm both emails are sent

Self-served tokens

1. While unauthenticated, visit a page with the donation block
2. Send a test donation using an existing reader's email
3. Check your cookies and confirm you have a hashed value named np_auth_link
4. Confirm the email was sent, copy and paste it on the session above and confirm you're authenticated by accessing WC's my-account page

Client hash validation

1. Repeat the steps above, but now paste the link on a new unauthenticated session (without the np_auth_link cookie)
2. Confirm you get the generic error message

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully ran tests with your changes locally?

[adekbadek]

I love how this code utilises common WP practices (like filtering stuff), has proper documentation, and tests ❤️

[miguelpeixe]

0cf90d0 implements another small change to the token. It was using a salted hash from wp_hash(), which is not necessary, being a random and unpredictable value. This also gives us the opportunity for extra entropy so I changed its length to 60.

[matticbot]

🎉 This PR is included in version 1.86.0-alpha.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[matticbot]

🎉 This PR is included in version 1.86.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀