Verbum Comments: enable social login inside the iframe via Storage Access API

[arcangelini]

Proposed changes

Follow-up to #50396. Verbum runs in a third-party iframe (jetpack.wordpress.com) embedded in the site's own domain, so it can't read or write the .wordpress.com auth cookies — which is why social login is suppressed there. This uses the Storage Access API to try to restore first-party cookie access, so WordPress.com / Facebook login can work inside the comment iframe on Atomic/Jetpack sites.

• useSocialLogin: on the login click, open the popup first and then call document.requestStorageAccess() without awaiting it. Both want the user gesture, and the popup is the one that breaks visibly without it.
• logged-out: render the social buttons in the iframe even when the cookie test currently fails, so there is something to click. Verbum Comments: fix blocked commenting from cookies #50396's top-level login link stays on offer alongside them, and the guest form is suppressed whenever login is required (it would be rejected on submit).

Nothing here weakens comment_registration — when it works, the visitor gets a real WordPress.com session and WP.com signs the identity server-side.

Why cookie access has to actually be granted

If the session isn't readable on jetpack.wordpress.com when the form POSTs, WP.com's process_remote_comment_form_hc_post_as() falls through from case 'wordpress' to the default branch and rewrites hc_post_as to guest. The site then rejects the comment with "you must be logged in". So a denied prompt is not a soft degradation — the login silently does not count.

That's why this PR no longer flips userLoggedIn on a bare access_token: showing someone as logged in when the POST will be downgraded just moves the dead end to after they've logged in. If access is denied the visitor stays logged out and still has the login link.

Related product discussion/links

• CM-841

Does this pull request change what data or activity we track or use?

No. It requests browser storage access to read existing first-party auth cookies; no new data is collected.

Testing instructions

Stacked on #50396 — review/merge that first.

1. On an Atomic (WoA) site, enable Settings → Discussion → "Users must be registered and logged in to comment".
2. Open a post as a logged-out visitor.
3. Before: no WordPress.com/Facebook options render — just a guest form that fails on submit.
4. After: the WordPress.com and Facebook buttons render, with a "Log in" link as a fallback.
5. Click WordPress.com. Confirm the popup is not blocked — this is the main thing this revision changes. Allow the cookie prompt if one appears, complete the login, then post a comment and confirm it saves.
6. Repeat with the cookie prompt denied. Confirm you are not shown as logged in, and that the "Log in" link is still there and works.
7. Repeat with comment_registration off: the guest form should still be available as it is today.
8. Confirm Simple sites (first-party, non-iframe) are unchanged.

Still needs verifying before this is trusted

• Does the grant cover the form POST? Submitting navigates the iframe to jetpack.wordpress.com, a cross-site navigation. If the storage-access grant doesn't cause the session cookie to be attached to that request, is_user_logged_in() is false on WP.com and step 5 fails even though the prompt was allowed. This needs checking in Chrome, Safari and Firefox — it is the assumption the whole approach rests on.
• How often is the prompt even offered? Browsers generally require recent first-party interaction with wordpress.com before prompting, and otherwise deny outright. If that is rare for a typical blog visitor, most people land on the fallback path.
• Popup and prompt ordering across those same three browsers, with cold profiles.

[github-actions]

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

• To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack or WordPress.com Site Helper), and enable the verbum/iframe-social-login-storage-access branch.
• To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack verbum/iframe-social-login-storage-access

bin/jetpack-downloader test jetpack-mu-wpcom-plugin verbum/iframe-social-login-storage-access

Interested in more tips and information?

• In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
• Read more about our development workflow here: PCYsg-eg0-p2
• Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• ✅ Add a "[Status]" label (In Progress, Needs Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

Follow this PR Review Process:

1. Ensure all required checks appearing at the bottom of this PR are passing.
2. Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
3. You can use GitHub's Reviewers functionality to request a review.
4. When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

---

Jetpack plugin:

No scheduled milestone found for this plugin.

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

[jp-launch-control]

Code Coverage Summary

No summary data is available for parent commit 9e1a144, so cannot calculate coverage changes. 😴

If that commit is a feature branch rather than a trunk commit, this is expected. Otherwise, this should be updated once coverage for 9e1a144 is available.

Full summary · PHP report · JS report