fix: cross-site user management and auth hardening

assets/src/components/CreateUser.tsx

@@ -4,20 +4,19 @@
 import { useState, useEffect, useCallback } from '@wordpress/element';
 import { __ } from '@wordpress/i18n';
 import {
 	Card,
 	CardHeader,
 	CardBody,
 	TextControl,
 	SelectControl,
 	Button,
 	Modal,
 	CheckboxControl,
 	Notice,
 	__experimentalGrid as Grid,
 	__experimentalHStack as HStack,
 	__experimentalVStack as VStack,
 	Dashicon,
-	Snackbar,
 	SnackbarList,
 	Icon,
 } from '@wordpress/components';
@@ -60,6 +59,9 @@
 	role: 'subscriber',
 };
 
+// Id of the general (non per-site) notice within the snackbar list.
+const GENERAL_NOTICE_ID = 'create-user-notice';
+
 const CreateUser = ( {
 	availableSites,
 }: {
@@ -82,12 +84,7 @@
 		StrengthLevel | 'default'
 	>( 'default' );
 	const [ userCreationNotices, setUserCreationNotices ] = useState<
-		Array<
-			Omit< React.ComponentProps< typeof Snackbar >, 'children' > & {
-				id: string;
-				content: string;
-			}
-		>
+		Array< { id: string; content: string; className: string } >
 	>( [] );
 
 	const fetchStrongPassword = useCallback( async () => {
@@ -186,21 +183,29 @@
 			);
 
 			if ( ! response.ok ) {
+				const errorData = ( await response
+					.json()
+					.catch( () => null ) ) as {
+					message?: string;
+				} | null;
 				setNotice( {
 					type: 'error',
-					message: __(
-						'Failed to create user. Please try again later.',
-						'oneaccess'
-					),
+					message:
+						errorData?.message ||
+						__(
+							'Failed to create user. Please try again later.',
+							'oneaccess'
+						),
 				} );
-				throw new Error( 'Failed to create user' );
+				return;
 			}
 
 			const data = ( await response.json() ) as {
 				success: boolean;
 				message?: string;
 				data?: {
 					response_data?: CreateUserResult[];
+					error_log?: { site_name?: string; message?: string }[];
 				};
 			};
 			if ( ! data.success ) {
@@ -216,7 +221,17 @@
 				return;
 			}
 
-			const results = data?.data?.response_data || [];
+			const results: CreateUserResult[] = [
+				...( data?.data?.response_data || [] ),
+				...( data?.data?.error_log || [] ).map( ( failure ) => ( {
+					status: 'error' as const,
+					site: failure.site_name ?? '',
+					message:
+						failure.message ??
+						__( 'Failed to create user.', 'oneaccess' ),
+				} ) ),
+			];
+
 			const newNotices = results.map(
 				( result: CreateUserResult, index: number ) => ( {
 					id: `notice-${ Date.now() }-${ index }`,
@@ -497,26 +512,32 @@
 						</Grid>
 					</form>
 
-					{ notice && notice.message && (
-						<Snackbar
-							className={
-								notice.type === 'error'
-									? 'oneaccess-error-notice'
-									: 'oneaccess-success-notice'
-							}
-							onRemove={ () => setNotice( null ) }
-						>
-							{ notice.message }
-						</Snackbar>
-					) }
-
-					{ userCreationNotices.length > 0 && (
+					{ ( notice?.message || userCreationNotices.length > 0 ) && (
 						<SnackbarList
-							notices={ userCreationNotices }
-							onRemove={ () => {
-								setTimeout( () => {
-									setUserCreationNotices( [] );
-								}, 3000 );
+							notices={ [
+								...( notice?.message
+									? [
+											{
+												id: GENERAL_NOTICE_ID,
+												content: notice.message,
+												className:
+													notice.type === 'error'
+														? 'oneaccess-error-notice'
+														: 'oneaccess-success-notice',
+											},
+									  ]
+									: [] ),
+								...userCreationNotices,
+							] }
+							onRemove={ ( id: string ) => {
+								if ( GENERAL_NOTICE_ID === id ) {
+									setNotice( null );
+									return;
+								}
+
+								setUserCreationNotices( ( current ) =>
+									current.filter( ( item ) => item.id !== id )
+								);
 							} }
 						/>
 					) }

assets/src/components/SharedUsers.tsx

@@ -100,6 +100,12 @@ interface GenericApiResponse {
 	message?: string;
 }
 
+interface DeleteUserResponse extends GenericApiResponse {
+	data?: {
+		error_log?: Array< { site_name?: string; message?: string } >;
+	};
+}
+
 const SharedUsers = ( {
 	availableSites,
 }: {
@@ -384,30 +390,56 @@ const SharedUsers = ( {
 				}
 			);
 
-			if ( ! response.ok ) {
-				throw new Error( 'Failed to delete user from sites' );
+			const data = ( await response
+				.json()
+				.catch( () => null ) ) as DeleteUserResponse | null;
+
+			if ( ! response.ok || ! data ) {
+				setNotice( {
+					type: 'error',
+					message:
+						data?.message ||
+						__( 'Failed to delete user.', 'oneaccess' ),
+				} );
+				return;
 			}
 
-			const data = ( await response.json() ) as GenericApiResponse;
-			if ( ! data.success ) {
-				throw new Error(
-					data.message || 'Failed to delete user from sites'
-				);
+			if ( data.success ) {
+				setNotice( {
+					type: 'success',
+					message: __( 'User deleted successfully.', 'oneaccess' ),
+				} );
+				return;
 			}
 
+			// Partial failure: list each site's error after the summary.
+			const siteErrors = ( data.data?.error_log || [] )
+				.filter( ( failure ) => !! failure.message )
+				.map( ( { site_name: siteName = '', message = '' } ) =>
+					! siteName || message.includes( siteName )
+						? message
+						: `${ siteName }: ${ message }`
+				);
+
 			setNotice( {
-				type: 'success',
-				message: __( 'User deleted successfully.', 'oneaccess' ),
+				type: 'error',
+				message: [
+					data.message ||
+						__(
+							'User could not be deleted from some sites.',
+							'oneaccess'
+						),
+					...siteErrors,
+				].join( ' ' ),
 			} );
-
-			// Refresh users list
-			await fetchUsers();
 		} catch {
 			setNotice( {
 				type: 'error',
 				message: __( 'Failed to delete user.', 'oneaccess' ),
 			} );
 		} finally {
+			// Refresh even on failure, since some sites may have been deleted.
+			await fetchUsers();
 			setIsDeletingUser( false );
 			setShowUserDeletionModal( false );
 			setSelectedUser( null );

assets/src/components/SiteModal.tsx

@@ -114,6 +114,8 @@ const SiteModal = ( {
 					headers: {
 						'Content-Type': 'application/json',
 						'X-OneAccess-Token': formData.api_key,
+						'X-OneAccess-Site-URL':
+							window.OneAccessSettings.siteUrl,
 					},
 				}
 			);

assets/src/css/admin.scss

@@ -3,28 +3,26 @@
 #oneaccess-settings-page,
 #oneaccess-manage-user {
 
-	&:has(.components-snackbar-list) {
-
-		.components-snackbar-list {
-			position: fixed;
-			bottom: 20px;
-			right: 20px;
-			z-index: 1000000;
-			align-items: flex-end;
-			justify-content: flex-end;
-			display: flex;
-			flex-direction: column;
-		}
+	.components-snackbar-list,
+	.components-snackbar {
+		position: fixed;
+		bottom: 20px;
+		right: 20px;
+		z-index: 1000000;
+		width: auto;
 	}
 
-	&:not(:has(.components-snackbar-list)) {
+	.components-snackbar-list {
+		align-items: flex-end;
+		justify-content: flex-end;
+		display: flex;
+		flex-direction: column;
 
+		/* Snackbars in a list are laid out by the list itself. */
 		.components-snackbar {
-			position: fixed;
-			bottom: 20px;
-			right: 20px;
-			z-index: 1000000;
-			width: auto;
+			position: static;
+			bottom: auto;
+			right: auto;
 		}
 	}
 
@@ -41,8 +39,6 @@
 		background-color: #e11d1d;
 		color: #fff;
 	}
-
-
 }
 
 .toplevel_page_oneaccess {
@@ -52,7 +48,6 @@
 	}
 }
 
-
 body {
 
 	&.oneaccess-missing-brand-sites,

assets/src/types/global.d.ts

@@ -12,6 +12,7 @@ interface OneAccessSettings {
 	api_key: string;
 	setupUrl: string;
 	siteType: SiteType;
+	siteUrl: string;
 }
 
 export interface OneAccessOnboarding {

inc/Modules/Core/Assets.php

@@ -72,6 +72,7 @@ public static function get_localized_data(): array {
 				'restUrl'  => esc_url( home_url( '/wp-json' ) ),
 				'setupUrl' => esc_url( admin_url( 'admin.php?page=oneaccess-settings' ) ),
 				'siteType' => Settings::get_site_type(),
+				'siteUrl'  => esc_url( get_site_url() ),
 			];
 		}
 

inc/Modules/Core/Rest.php

@@ -30,16 +30,13 @@ public function register_hooks(): void {
 	 * @return array<int, string> Modified headers.
 	 */
 	public function allowed_cors_headers( $headers ): array {
-		// Skip if the headers are already present.
-		if ( in_array( 'X-OneAccess-Token', $headers, true ) ) {
-			return $headers;
+		// Append only the headers not already present so the list stays de-duplicated.
+		foreach ( [ 'X-OneAccess-Token', 'X-OneAccess-Site-URL' ] as $header ) {
+			if ( ! in_array( $header, $headers, true ) ) {
+				$headers[] = $header;
+			}
 		}
 
-		return array_merge(
-			$headers,
-			[
-				'X-OneAccess-Token',
-			]
-		);
+		return $headers;
 	}
 }