Fix Sign in with Google for accounts using the WordPress Two-Factor plugin#13118
Open
shervElmi wants to merge 10 commits into
Open
Fix Sign in with Google for accounts using the WordPress Two-Factor plugin#13118shervElmi wants to merge 10 commits into
shervElmi wants to merge 10 commits into
Conversation
When the Two-Factor plugin is active, turn off two-factor authentication for accounts that Sign in with Google creates, and return an error instead of linking an existing account that already uses two-factor. An account created with two-factor left on breaks the later sign-in, and linking one would remove its challenge while its password still works.
Cover the new authenticator behavior with a test double that fakes the Two-Factor plugin state, since the test environment has no Two-Factor plugin.
Confirm the login screen adds the two-factor message for the new error code, and leaves an unrecognized code untouched.
🎭 Playwright reports for 83e5d1f: 📦 Build files for 83e5d1f:
|
Modify the assertion in the login error handling test to check for the specific error message related to existing accounts using two-factor authentication. This ensures that the test accurately reflects the expected behavior when two-factor authentication is enabled.
shervElmi
marked this pull request as ready for review
July 16, 2026 17:34
Update the `authenticate_user` method to streamline user creation logic and enhance readability. Adjust the `user_has_two_factor` method to simplify the conditional checks for two-factor plugin activation.
eugene-manuilov
requested changes
Jul 20, 2026
This change allows users to sign in with Google without being blocked by the Two-Factor plugin's login challenge. It modifies the Authenticator class to remove the two-factor login check during authentication. Additionally, tests are updated to verify this behavior for both new and returning users.
2 tasks
eugene-manuilov
requested changes
Jul 21, 2026
This change modifies the authentication process to bypass the Two-Factor plugin's login challenge when users sign in with Google. It ensures that the two-factor providers are cleared for the signed-in user while leaving other users' settings intact.
eugene-manuilov
requested changes
Jul 22, 2026
Comment on lines
+336
to
+338
| protected function user_has_two_factor( int $user_id ) { | ||
| return $this->is_two_factor_plugin_active() && \Two_Factor_Core::is_user_using_two_factor( $user_id ); // @phpstan-ignore class.notFound (Two_Factor_Core comes from the optional Two-Factor plugin, and is_two_factor_plugin_active() confirms it exists.) | ||
| } |
Collaborator
There was a problem hiding this comment.
So, if we want to prevent users from signing in with their Google accounts if two-factor security is enabled and their accounts are not linked, then we need to check whether their accounts are linked to correctly validate whether the user can sign in or not.
Collaborator
There was a problem hiding this comment.
@shervElmi, did you miss this one? If the user already has their accounts linked, we should allow them to continue signing in, right?
Collaborator
Author
There was a problem hiding this comment.
@eugene-manuilov I rely on the lookup order here, since find_user() matches the hashed Google ID first, so a linked 2FA user signs in fine and only an unlinked email match reaches the block.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses issue:
Relevant technical choices
TWO_FACTOR_ENABLED_PROVIDERS_META_KEYconstant for the_two_factor_enabled_providersmeta key instead of repeating the literal.FakeTwoFactorAuthenticatorfile instead of an inline subclass.Authenticator, soWooCommerce_Authenticatorinherits it.authenticate_user()instead of a duplicate one.user_has_two_factor()and the test double's override as single returns.PR Author Checklist
Do not alter or remove anything below. The following sections will be managed by moderators only.
Code Reviewer Checklist
Merge Reviewer Checklist