Cover the OAuth flows and add WordPress.org assets - #5
Merged
Conversation
The Authorization Code flow had no test coverage at all, despite being the path where a mistake either locks a site out of Procore permanently or lets an attacker attach their own Procore account to the site. Adds 18 tests across both grants and the token store: - the token request goes to the login host, not the API host - a valid token is reused rather than re-requested - missing credentials fail before any network call - Procore's own rejection reason reaches the administrator - the authorize URL carries client_id, response_type, redirect_uri and state - a callback with an unknown, empty or replayed state is refused - a valid exchange stores both tokens - a refresh persists the ROTATED refresh token, since Procore invalidates the old one on use and losing the replacement is unrecoverable - a rejected refresh token clears the connection instead of retrying forever - tokens are encrypted at rest, carry an expiry margin, and do not leak between production and sandbox - the refresh lock is exclusive and releasable Adds .wordpress-org/ with the banner and icon at both required sizes, generated rather than hand-drawn so they can be reproduced. The mark is three rising bars on a baseline, chosen to stay legible at the 32px size the plugin list uses. Removes the == Screenshots == section from readme.txt. It declared six files that were never produced, which renders as six broken slots on the plugin page. Screenshots for this plugin should come from a site connected to a real Procore account — a gallery of invented project names would be misleading, and the connection-test screen only means anything when it is probing genuine tool permissions. .wordpress-org/README.md records the six to capture, the order, and what to redact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two of the items from the "what's next" list. No open PRs existed to merge — all four earlier ones were already in
main.1. OAuth test coverage
The Authorization Code flow had zero tests, despite being the path where a mistake either locks a site out of Procore permanently or lets someone attach their own Procore account to the site. Adds 18 tests across both grants and the token store.
The one that matters most: refresh token rotation. Procore invalidates a refresh token the instant it's exchanged, so failing to persist the replacement is unrecoverable — now asserted directly, along with the reconnect path when a refresh is rejected outright.
Also covered: token request hits the login host (the 1.x bug, now locked down); valid tokens are reused; missing credentials fail before any network call; unknown / empty / replayed state is refused; tokens are encrypted at rest, carry an expiry margin, and don't leak between production and sandbox; the refresh lock is exclusive.
80 tests, 335 assertions, all green.
2. WordPress.org assets
.wordpress-org/with banner and icon at both required sizes, generated from a script so they're reproducible. The mark is three rising bars on a baseline — chosen to stay legible at the 32px size the installed-plugins list uses, which rules out anything with text or fine detail. Excluded from the release ZIP, since wordpress.org reads these from SVN.3. Removed a false claim from readme.txt
readme.txtdeclared six screenshots that don't exist — that renders as six broken slots on the plugin page. I removed the section rather than satisfying it with fabricated ones.I did try to capture real screenshots: rebuilt WordPress 7.0.3, seeded demo data, ran a dev server. The browser pane wouldn't composite frames and navigation kept dropping the path, so it wasn't achievable. On reflection that's the better outcome anyway — screenshots should come from a site on a real Procore account, because a gallery of invented project names is misleading, and the connection-test screen only means anything when it's probing genuine permissions.
.wordpress-org/README.mdrecords the six to capture, in order, and what to redact.Not done, and why
CI caching was on the list; I checked and skipped it.
ramsey/composer-installalready caches Composer dependencies. The slow job is Plugin Check (~2 min), which spends its time provisioning WordPress inside the action — not something the workflow controls. Marginal gain, added complexity.🤖 Generated with Claude Code