fix: cross-site user management and auth hardening

assets/src/components/CreateUser.tsx

@@ -1,35 +1,35 @@
 /**
  * WordPress dependencies
  */
-import { useState, useEffect, useCallback } from '@wordpress/element';
-import { __ } from '@wordpress/i18n';
 import {
+	Button,
 	Card,
-	CardHeader,
 	CardBody,
-	TextControl,
-	SelectControl,
-	Button,
-	Modal,
+	CardHeader,
 	CheckboxControl,
-	Notice,
+	Dashicon,
 	__experimentalGrid as Grid,
 	__experimentalHStack as HStack,
-	__experimentalVStack as VStack,
-	Dashicon,
+	Icon,
+	Modal,
+	Notice,
+	SelectControl,
 	Snackbar,
 	SnackbarList,
-	Icon,
+	TextControl,
+	__experimentalVStack as VStack,
 } from '@wordpress/components';
+import { useCallback, useEffect, useState } from '@wordpress/element';
+import { __ } from '@wordpress/i18n';
 
 /**
  * Internal dependencies
  */
 import {
-	isValidEmail,
 	checkPasswordStrength,
-	strengthWidths,
 	getStrengthColor,
+	isValidEmail,
+	strengthWidths,
 	type StrengthLevel,
 } from '../js/utils';
 
@@ -186,12 +186,19 @@
 			);
 
 			if ( ! response.ok ) {
+				const errorData = ( await response
+					.json()
+					.catch( () => null ) ) as {
+					message?: string;
+				} | null;
 				setNotice( {
 					type: 'error',
-					message: __(
-						'Failed to create user. Please try again later.',
-						'oneaccess'
-					),
+					message:
+						errorData?.message ||
+						__(
+							'Failed to create user. Please try again later.',
+							'oneaccess'
+						),
 				} );
 				throw new Error( 'Failed to create user' );
 			}
@@ -201,6 +208,7 @@
 				message?: string;
 				data?: {
 					response_data?: CreateUserResult[];
+					error_log?: { site_name?: string; message?: string }[];
 				};
 			};
 			if ( ! data.success ) {
@@ -216,7 +224,17 @@
 				return;
 			}
 
-			const results = data?.data?.response_data || [];
+			const results: CreateUserResult[] = [
+				...( data?.data?.response_data || [] ),
+				...( data?.data?.error_log || [] ).map( ( failure ) => ( {
+					status: 'error' as const,
+					site: failure.site_name ?? '',
+					message:
+						failure.message ??
+						__( 'Failed to create user.', 'oneaccess' ),
+				} ) ),
+			];
+
 			const newNotices = results.map(
 				( result: CreateUserResult, index: number ) => ( {
 					id: `notice-${ Date.now() }-${ index }`,

assets/src/css/admin.scss

@@ -3,28 +3,26 @@
 #oneaccess-settings-page,
 #oneaccess-manage-user {
 
-	&:has(.components-snackbar-list) {
-
-		.components-snackbar-list {
-			position: fixed;
-			bottom: 20px;
-			right: 20px;
-			z-index: 1000000;
-			align-items: flex-end;
-			justify-content: flex-end;
-			display: flex;
-			flex-direction: column;
-		}
+	.components-snackbar-list,
+	.components-snackbar {
+		position: fixed;
+		bottom: 20px;
+		right: 20px;
+		z-index: 1000000;
+		width: auto;
 	}
 
-	&:not(:has(.components-snackbar-list)) {
+	.components-snackbar-list {
+		align-items: flex-end;
+		justify-content: flex-end;
+		display: flex;
+		flex-direction: column;
 
+		/* Snackbars in a list are laid out by the list itself. */
 		.components-snackbar {
-			position: fixed;
-			bottom: 20px;
-			right: 20px;
-			z-index: 1000000;
-			width: auto;
+			position: static;
+			bottom: auto;
+			right: auto;
 		}
 	}
 
@@ -41,8 +39,6 @@
 		background-color: #e11d1d;
 		color: #fff;
 	}
-
-
 }
 
 .toplevel_page_oneaccess {
@@ -52,7 +48,6 @@
 	}
 }
 
-
 body {
 
 	&.oneaccess-missing-brand-sites,

inc/Modules/Core/Hooks.php

@@ -37,6 +37,9 @@ public function __construct() {
 	 * {@inheritDoc}
 	 */
 	public function register_hooks(): void {
+		// Needed on both site types, so it must come before the consumer check below.
+		add_filter( 'http_request_host_is_external', [ $this, 'allow_oneaccess_host' ], 10, 2 );
+
 		// Early return if this is not a consumer site.
 		if ( ! Settings::is_consumer_site() ) {
 			return;
@@ -63,4 +66,25 @@ public function register_hooks(): void {
 	public function user_deduplication(): void {
 		$this->actions_controller->send_users_for_deduplication();
 	}
+
+	/**
+	 * Allow outbound requests to the configured OneAccess sites.
+	 *
+	 * @internal Hook callback
+	 *
+	 * @param bool   $is_external Whether the host is considered external.
+	 * @param string $host        Host name of the request.
+	 */
+	public function allow_oneaccess_host( $is_external, $host ): bool {
+		$urls   = array_column( Settings::get_shared_sites(), 'url' );
+		$urls[] = (string) Settings::get_parent_site_url();
+
+		foreach ( $urls as $url ) {
+			if ( ! empty( $url ) && wp_parse_url( $url, PHP_URL_HOST ) === $host ) {
+				return true;
+			}
+		}
+
+		return (bool) $is_external;
+	}
 }

inc/Modules/Rest/Abstract_REST_Controller.php

@@ -65,55 +65,142 @@ public static function permission_callback(): bool {
 	 * @todo this should be on a hook.
 	 *
 	 * @param \WP_REST_Request<array{}> $request Request.
-	 * @return bool
 	 */
-	public function check_api_permissions( $request ) {
-		// check if the request is from same site.
-		if ( Settings::is_governing_site() ) {
-			return current_user_can( 'manage_options' );
-		}
+	public function check_api_permissions( $request ): bool {
+		$origin         = $this->parse_origin( $request->get_header( 'origin' ) );
+		$request_origin = $origin['origin'];
+		$parsed_origin  = $origin['parsed'];
+		$request_url    = $origin['url'];
+		$origin_port    = $origin['port'];
 
-		// See if the `X_ONEACCESS_TOKEN` header is present.
-		$token = $request->get_header( 'X_ONEACCESS_TOKEN' );
+		/**
+		 * Token-based auth takes priority over the Origin same-host check: cross-site
+		 * requests from sub-directory multisite installs lose the path in Origin, so
+		 * same-host detection can misfire on sibling sub-sites. Validating by key
+		 * instead avoids that false match.
+		 */
+		$token = $request->get_header( 'X-OneAccess-Token' );
 		$token = ! empty( $token ) ? sanitize_text_field( wp_unslash( $token ) ) : '';
 
-		// Bail if the token is missing or invalid.
-		if ( ! hash_equals( Settings::get_api_key(), $token ) ) {
-			return false;
+		if ( ! empty( $token ) ) {
+			/**
+			 * Origin is absent for server-side requests, so fall back to the
+			 * explicitly-sent site URL header so token auth can still proceed.
+			 */
+			if ( empty( $request_url ) ) {
+				$site_url_header = $request->get_header( 'X-OneAccess-Site-URL' );
+				if ( ! empty( $site_url_header ) ) {
+					$origin         = $this->parse_origin( $site_url_header );
+					$request_origin = $origin['origin'];
+					$parsed_origin  = $origin['parsed'];
+					$request_url    = $origin['url'];
+					$origin_port    = $origin['port'];
+				}
+			}
+
+			if ( empty( $request_url ) ) {
+				return false;
+			}
+
+			$stored_key = $this->get_stored_api_key( $request_url );
+			if ( empty( $stored_key ) || ! hash_equals( $stored_key, $token ) ) {
+				return false;
+			}
+
+			// Governing sites were checked by ::get_stored_api_key already.
+			if ( Settings::is_governing_site() ) {
+				return true;
+			}
+
+			// Non-healthcheck requests must match the site already recorded as governing.
+			$governing_site_url = Settings::get_parent_site_url();
+			if ( '/' . $this->namespace . '/health-check' !== $request->get_route() ) {
+				return ! empty( $governing_site_url ) ? $this->is_url_from_host( $governing_site_url, $parsed_origin['host'], $origin_port ) : false;
+			}
+
+			// Health-checks bootstrap the governing-site relationship since none is recorded yet.
+			Settings::set_parent_site_url( $request_origin );
+			return true;
 		}
 
-		$request_origin = $request->get_header( 'origin' );
-		$request_origin = ! empty( $request_origin ) ? esc_url_raw( wp_unslash( $request_origin ) ) : '';
-		$user_agent     = $request->get_header( 'user-agent' );
-		$user_agent     = ! empty( $user_agent ) ? sanitize_text_field( wp_unslash( $user_agent ) ) : '';
+		// No token: fall back to same-domain logged-in user check.
+		if ( empty( $request_url ) || $this->is_url_from_host( get_site_url(), $parsed_origin['host'], $origin_port ) ) {
+			return current_user_can( 'manage_options' );
+		}
 
-		/**
-		 * If both origin and user-agent are missing, deny access.
-		 *
-		 * Here checking both because server side requests will not have origin header.
-		 */
-		if ( empty( $request_origin ) && empty( $user_agent ) ) {
+		return false;
+	}
+
+	/**
+	 * Parses a raw Origin or X-OneAccess-Site-URL header value into its components.
+	 *
+	 * @param ?string $raw Raw header value.
+	 *
+	 * @return array{origin: string, parsed: array<string, mixed>, url: string, port: int|null}
+	 */
+	private function parse_origin( ?string $raw ): array {
+		$origin = ! empty( $raw ) ? esc_url_raw( wp_unslash( $raw ) ) : '';
+		$parsed = wp_parse_url( $origin );
+		$parsed = is_array( $parsed ) ? $parsed : [];
+		$url    = ! empty( $parsed['scheme'] ) && ! empty( $parsed['host'] )
+			? untrailingslashit( trim( $origin ) )
+			: '';
+		$port   = isset( $parsed['port'] ) ? (int) $parsed['port'] : null;
+
+		return [
+			'origin' => $origin,
+			'parsed' => $parsed,
+			'url'    => $url,
+			'port'   => $port,
+		];
+	}
+
+	/**
+	 * Check if two URLs belong to the same host.
+	 *
+	 * @param string   $url  The URL to check.
+	 * @param string   $host The host to compare against.
+	 * @param int|null $port Optional. The port to compare against.
+	 *
+	 * @return bool True if both URLs belong to the same host (and port if specified), false otherwise.
+	 */
+	protected function is_url_from_host( string $url, string $host, ?int $port = null ): bool {
+		$parsed_url = wp_parse_url( $url );
+
+		// Compare both host and port to properly handle localhost with different ports.
+		if ( ! isset( $parsed_url['host'] ) || $parsed_url['host'] !== $host ) {
 			return false;
 		}
 
-		// If it's the same domain, we're good.
-		if ( self::is_same_domain( get_site_url(), $request_origin ) ) {
-			return true;
+		// If a port was provided, also compare ports.
+		if ( null !== $port ) {
+			$url_port = $parsed_url['port'] ?? 80;
+			return $url_port === $port;
 		}
 
-		$governing_site_url = Settings::get_parent_site_url();
+		return true;
+	}
 
-		// If it's a healthcheck with no governing site, allow it and set the governing site.
-		if ( empty( $governing_site_url ) ) {
-			if ( '/' . $this->namespace . '/health-check' === $request->get_route() ) {
-				Settings::set_parent_site_url( $request_origin );
-				return true;
-			}
-			return false;
+	/**
+	 * Gets the locally-stored API key for comparison.
+	 *
+	 * @param ?string $site_url Site URL. Only used for brand->governing site requests.
+	 *
+	 * @return string The stored API key. Empty string if not found.
+	 */
+	private function get_stored_api_key( ?string $site_url = null ): string {
+		if ( Settings::is_consumer_site() ) {
+			return Settings::get_api_key();
 		}
 
-		// if token is valid and request is from different domain then check if it matches governing site url.
-		return self::is_same_domain( $governing_site_url, $request_origin ) || false !== strpos( $user_agent, $governing_site_url );
+		// If there's no brand site URL we cannot match the API key.
+		if ( ! isset( $site_url ) ) {
+			return '';
+		}
+
+		$shared_sites = Settings::get_shared_sites();
+
+		return ! empty( $shared_sites[ $site_url ]['api_key'] ) ? $shared_sites[ $site_url ]['api_key'] : '';
 	}
 
 	/**

inc/Modules/Rest/Actions_Controller.php

@@ -456,8 +456,9 @@ private function make_brand_site_request( string $site_url, string $api_key, arr
 
 		$args = [
 			'headers' => [
-				'X-OneAccess-Token' => $api_key,
-				'Cache-Control'     => 'no-cache',
+				'X-OneAccess-Token'    => $api_key,
+				'X-OneAccess-Site-URL' => get_site_url(),
+				'Cache-Control'        => 'no-cache',
 			],
 			'timeout' => 30, // phpcs:ignore WordPressVIPMinimum.Performance.RemoteRequestTimeout.timeout_timeout -- profile requests fetching take time.
 		];
@@ -1000,7 +1001,8 @@ public function rebuild_deduplicated_users_index(): WP_REST_Response {
 				trailingslashit( esc_url_raw( $site_url ) ) . 'wp-json/' . self::NAMESPACE . '/rebuild-brand-sites-index',
 				[
 					'headers' => [
-						'X-OneAccess-Token' => $api_key,
+						'X-OneAccess-Token'    => $api_key,
+						'X-OneAccess-Site-URL' => get_site_url(),
 					],
 					'timeout' => 30, // phpcs:ignore WordPressVIPMinimum.Performance.RemoteRequestTimeout.timeout_timeout -- rebuilding index take time.
 				]