fix: cross-site user management and auth hardening

assets/src/components/CreateUser.tsx

@@ -4,20 +4,19 @@
 import { useState, useEffect, useCallback } from '@wordpress/element';
 import { __ } from '@wordpress/i18n';
 import {
 	Card,
 	CardHeader,
 	CardBody,
 	TextControl,
 	SelectControl,
 	Button,
 	Modal,
 	CheckboxControl,
 	Notice,
 	__experimentalGrid as Grid,
 	__experimentalHStack as HStack,
 	__experimentalVStack as VStack,
 	Dashicon,
-	Snackbar,
 	SnackbarList,
 	Icon,
 } from '@wordpress/components';
@@ -60,6 +59,9 @@
 	role: 'subscriber',
 };
 
+// Id of the general (non per-site) notice within the snackbar list.
+const GENERAL_NOTICE_ID = 'create-user-notice';
+
 const CreateUser = ( {
 	availableSites,
 }: {
@@ -82,12 +84,7 @@
 		StrengthLevel | 'default'
 	>( 'default' );
 	const [ userCreationNotices, setUserCreationNotices ] = useState<
-		Array<
-			Omit< React.ComponentProps< typeof Snackbar >, 'children' > & {
-				id: string;
-				content: string;
-			}
-		>
+		Array< { id: string; content: string; className: string } >
 	>( [] );
 
 	const fetchStrongPassword = useCallback( async () => {
@@ -186,12 +183,19 @@
 			);
 
 			if ( ! response.ok ) {
+				const errorData = ( await response
+					.json()
+					.catch( () => null ) ) as {
+					message?: string;
+				} | null;
 				setNotice( {
 					type: 'error',
-					message: __(
-						'Failed to create user. Please try again later.',
-						'oneaccess'
-					),
+					message:
+						errorData?.message ||
+						__(
+							'Failed to create user. Please try again later.',
+							'oneaccess'
+						),
 				} );
 				throw new Error( 'Failed to create user' );
 			}
@@ -201,6 +205,7 @@
 				message?: string;
 				data?: {
 					response_data?: CreateUserResult[];
+					error_log?: { site_name?: string; message?: string }[];
 				};
 			};
 			if ( ! data.success ) {
@@ -216,7 +221,17 @@
 				return;
 			}
 
-			const results = data?.data?.response_data || [];
+			const results: CreateUserResult[] = [
+				...( data?.data?.response_data || [] ),
+				...( data?.data?.error_log || [] ).map( ( failure ) => ( {
+					status: 'error' as const,
+					site: failure.site_name ?? '',
+					message:
+						failure.message ??
+						__( 'Failed to create user.', 'oneaccess' ),
+				} ) ),
+			];
+
 			const newNotices = results.map(
 				( result: CreateUserResult, index: number ) => ( {
 					id: `notice-${ Date.now() }-${ index }`,
@@ -497,26 +512,32 @@
 						</Grid>
 					</form>
 
-					{ notice && notice.message && (
-						<Snackbar
-							className={
-								notice.type === 'error'
-									? 'oneaccess-error-notice'
-									: 'oneaccess-success-notice'
-							}
-							onRemove={ () => setNotice( null ) }
-						>
-							{ notice.message }
-						</Snackbar>
-					) }
-
-					{ userCreationNotices.length > 0 && (
+					{ ( notice?.message || userCreationNotices.length > 0 ) && (
 						<SnackbarList
-							notices={ userCreationNotices }
-							onRemove={ () => {
-								setTimeout( () => {
-									setUserCreationNotices( [] );
-								}, 3000 );
+							notices={ [
+								...( notice?.message
+									? [
+											{
+												id: GENERAL_NOTICE_ID,
+												content: notice.message,
+												className:
+													notice.type === 'error'
+														? 'oneaccess-error-notice'
+														: 'oneaccess-success-notice',
+											},
+									  ]
+									: [] ),
+								...userCreationNotices,
+							] }
+							onRemove={ ( id: string ) => {
+								if ( GENERAL_NOTICE_ID === id ) {
+									setNotice( null );
+									return;
+								}
+
+								setUserCreationNotices( ( current ) =>
+									current.filter( ( item ) => item.id !== id )
+								);
 							} }
 						/>
 					) }

assets/src/components/SharedUsers.tsx

@@ -100,6 +100,12 @@ interface GenericApiResponse {
 	message?: string;
 }
 
+interface DeleteUserResponse extends GenericApiResponse {
+	data?: {
+		error_log?: Array< { site_name?: string; message?: string } >;
+	};
+}
+
 const SharedUsers = ( {
 	availableSites,
 }: {
@@ -384,30 +390,56 @@ const SharedUsers = ( {
 				}
 			);
 
-			if ( ! response.ok ) {
-				throw new Error( 'Failed to delete user from sites' );
+			const data = ( await response
+				.json()
+				.catch( () => null ) ) as DeleteUserResponse | null;
+
+			if ( ! response.ok || ! data ) {
+				setNotice( {
+					type: 'error',
+					message:
+						data?.message ||
+						__( 'Failed to delete user.', 'oneaccess' ),
+				} );
+				return;
 			}
 
-			const data = ( await response.json() ) as GenericApiResponse;
-			if ( ! data.success ) {
-				throw new Error(
-					data.message || 'Failed to delete user from sites'
-				);
+			if ( data.success ) {
+				setNotice( {
+					type: 'success',
+					message: __( 'User deleted successfully.', 'oneaccess' ),
+				} );
+				return;
 			}
 
+			// Partial failure: list each site's error after the summary.
+			const siteErrors = ( data.data?.error_log || [] )
+				.filter( ( failure ) => !! failure.message )
+				.map( ( { site_name: siteName = '', message = '' } ) =>
+					! siteName || message.includes( siteName )
+						? message
+						: `${ siteName }: ${ message }`
+				);
+
 			setNotice( {
-				type: 'success',
-				message: __( 'User deleted successfully.', 'oneaccess' ),
+				type: 'error',
+				message: [
+					data.message ||
+						__(
+							'User could not be deleted from some sites.',
+							'oneaccess'
+						),
+					...siteErrors,
+				].join( ' ' ),
 			} );
-
-			// Refresh users list
-			await fetchUsers();
 		} catch {
 			setNotice( {
 				type: 'error',
 				message: __( 'Failed to delete user.', 'oneaccess' ),
 			} );
 		} finally {
+			// Refresh even on failure, since some sites may have been deleted.
+			await fetchUsers();
 			setIsDeletingUser( false );
 			setShowUserDeletionModal( false );
 			setSelectedUser( null );

assets/src/css/admin.scss

@@ -3,28 +3,26 @@
 #oneaccess-settings-page,
 #oneaccess-manage-user {
 
-	&:has(.components-snackbar-list) {
-
-		.components-snackbar-list {
-			position: fixed;
-			bottom: 20px;
-			right: 20px;
-			z-index: 1000000;
-			align-items: flex-end;
-			justify-content: flex-end;
-			display: flex;
-			flex-direction: column;
-		}
+	.components-snackbar-list,
+	.components-snackbar {
+		position: fixed;
+		bottom: 20px;
+		right: 20px;
+		z-index: 1000000;
+		width: auto;
 	}
 
-	&:not(:has(.components-snackbar-list)) {
+	.components-snackbar-list {
+		align-items: flex-end;
+		justify-content: flex-end;
+		display: flex;
+		flex-direction: column;
 
+		/* Snackbars in a list are laid out by the list itself. */
 		.components-snackbar {
-			position: fixed;
-			bottom: 20px;
-			right: 20px;
-			z-index: 1000000;
-			width: auto;
+			position: static;
+			bottom: auto;
+			right: auto;
 		}
 	}
 
@@ -41,8 +39,6 @@
 		background-color: #e11d1d;
 		color: #fff;
 	}
-
-
 }
 
 .toplevel_page_oneaccess {
@@ -52,7 +48,6 @@
 	}
 }
 
-
 body {
 
 	&.oneaccess-missing-brand-sites,

inc/Modules/Core/Hooks.php

@@ -37,6 +37,9 @@ public function __construct() {
 	 * {@inheritDoc}
 	 */
 	public function register_hooks(): void {
+		// Needed on both site types, so it must come before the consumer check below.
+		add_filter( 'http_request_host_is_external', [ $this, 'allow_oneaccess_host' ], 10, 2 );
+
 		// Early return if this is not a consumer site.
 		if ( ! Settings::is_consumer_site() ) {
 			return;
@@ -63,4 +66,25 @@ public function register_hooks(): void {
 	public function user_deduplication(): void {
 		$this->actions_controller->send_users_for_deduplication();
 	}
+
+	/**
+	 * Allow outbound requests to the configured OneAccess sites.
+	 *
+	 * @internal Hook callback
+	 *
+	 * @param bool   $is_external Whether the host is considered external.
+	 * @param string $host        Host name of the request.
+	 */
+	public function allow_oneaccess_host( $is_external, $host ): bool {
+		$urls   = array_column( Settings::get_shared_sites(), 'url' );
+		$urls[] = (string) Settings::get_parent_site_url();
+
+		foreach ( $urls as $url ) {
+			if ( ! empty( $url ) && wp_parse_url( $url, PHP_URL_HOST ) === $host ) {
+				return true;
+			}
+		}
+
+		return (bool) $is_external;
+	}
 }