Repair client secrets damaged by 2.0.0 and 2.0.1

[ibuilder]

2.0.2 stopped the settings sanitizer adding an encryption layer on every write — but it did nothing for sites already damaged. Those installs hold cipher text a single decrypt cannot recover, so they fail to authenticate with nothing on screen to explain why. The operator would have to guess that the stored credential itself is the problem.

What this does

The upgrade routine unwraps the value back to plain text and re-stores it correctly. Encryption::decrypt_deep() peels layers with a bounded ceiling; Encryption::depth() reports how many are present.

If it can't be recovered, the secret is cleared rather than left broken, and either outcome surfaces in a one-time admin notice. The stored token is dropped too, so the next request re-authenticates with the repaired secret instead of a stale one.

Verified against a real damaged site

Installed the actual v2.0.1 release, corrupted the secret through 2.0.1's own code path — not by hand-crafting the value — then upgraded:

BEFORE  version=2.0.1  depth=3  client_secret()='pwp2:Tnd7t4TV3YLRFwvRF'
AFTER   version=2.0.3  depth=1  client_secret()='THE-REAL-SECRET'

Check
Secret recovered to its original value	✅
Stored at exactly one encryption layer	✅
Repair recorded for the admin notice	✅
Stale token cleared	✅
Other settings and client ID untouched	✅
Unrecoverable path clears + prompts re-entry	✅
Notice shows once, then clears its flag	✅
PHP notices during the upgrade	0

Tests

4 new unit tests: the repair itself, the two no-op cases (healthy secret, empty secret), and the unrecoverable path. 86 tests, 350 assertions, PHPCS clean.

One nuance worth recording

While reproducing this I confirmed the damage comes from internal writes — Settings::set() and migrate_legacy() — not from the settings form itself. A normal form submit passes raw $_POST through update_option(), so the sanitizer runs exactly once and encrypts correctly. It's the plugin's own subsequent writes that re-fed already-encrypted cipher text through it.

🤖 Generated with Claude Code