fix(theme): pass Zitadel given_name + family_name to auto-provisioned WP Subscriber#178
fix(theme): pass Zitadel given_name + family_name to auto-provisioned WP Subscriber#178JohnRDOrazio wants to merge 1 commit into
Conversation
… WP Subscriber Phase 5 auto-provision only read the OIDC `name` claim and only mapped it to `display_name`. A new sign-up where Zitadel returned `given_name` + `family_name` (but no aggregate `name`) produced a WP user row whose WP-admin profile showed empty First/Last Name fields and display_name falling back to the email. Resolution + auto-provision now take a `$profile` array carrying `display_name` (OIDC `name`), `first_name` (OIDC `given_name`), and `last_name` (OIDC `family_name`). Empty given/family fields are *omitted* from the wp_insert_user args rather than passed as '' so partial-profile sign-ups don't actively blank-out the WP fields (WP keeps its own defaults). Tests: existing display_name happy/fallback paths extended to assert first_name/last_name behaviour; +1 new test for the given_name + family_name (no aggregate name) sign-up shape. Theme suite: 458/458, 1063 assertions. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
PR changed again? Review this PR in Change Stack to compare snapshots and stay oriented. 📝 WalkthroughWalkthroughZitadel authentication now passes a structured profile array containing display_name, first_name, and last_name fields through user resolution and auto-provisioning. Auto-provisioning conditionally populates WordPress user first_name and last_name when present, with display_name computed from profile or falling back to email. ChangesZitadel Bearer Profile Handling
🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 8 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@wordpress/themes/cdcf-headless/includes/auth/zitadel-bearer.php`:
- Around line 286-289: Normalize OIDC name claims by trimming whitespace before
checking for emptiness: for the array keys 'display_name', 'first_name', and
'last_name' in zitadel-bearer.php (the block building the user data passed to
wp_insert_user()), call trim() on the incoming claims (e.g., $userinfo['name'],
$userinfo['given_name'], $userinfo['family_name']) and only use the value if the
trimmed string is non-empty; otherwise omit the key or fall back to the
email/default. Apply the same trim-and-empty check logic to the other similar
block around the 403-410 region so whitespace-only claims won't overwrite WP
defaults.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a119611a-ec31-4c6c-8d4d-2f997ce1cf6c
📒 Files selected for processing (2)
wordpress/themes/cdcf-headless/includes/auth/zitadel-bearer.phpwordpress/themes/cdcf-headless/tests/ZitadelBearerTest.php
| [ | ||
| 'display_name' => is_string($userinfo['name'] ?? null) ? $userinfo['name'] : '', | ||
| 'first_name' => is_string($userinfo['given_name'] ?? null) ? $userinfo['given_name'] : '', | ||
| 'last_name' => is_string($userinfo['family_name'] ?? null) ? $userinfo['family_name'] : '', |
There was a problem hiding this comment.
Normalize the OIDC name claims before the empty-string checks.
These values come through as raw strings, so whitespace-only claims still pass the !== '' guards here. A token with name = ' ' or given_name = ' ' will write a blank display_name/first_name into wp_insert_user() instead of falling back to the email or omitting the key, which breaks the "don't blank WP defaults" behavior this PR is aiming for.
Proposed fix
[
- 'display_name' => is_string($userinfo['name'] ?? null) ? $userinfo['name'] : '',
- 'first_name' => is_string($userinfo['given_name'] ?? null) ? $userinfo['given_name'] : '',
- 'last_name' => is_string($userinfo['family_name'] ?? null) ? $userinfo['family_name'] : '',
+ 'display_name' => is_string($userinfo['name'] ?? null) ? sanitize_text_field($userinfo['name']) : '',
+ 'first_name' => is_string($userinfo['given_name'] ?? null) ? sanitize_text_field($userinfo['given_name']) : '',
+ 'last_name' => is_string($userinfo['family_name'] ?? null) ? sanitize_text_field($userinfo['family_name']) : '',
]Also applies to: 403-410
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@wordpress/themes/cdcf-headless/includes/auth/zitadel-bearer.php` around lines
286 - 289, Normalize OIDC name claims by trimming whitespace before checking for
emptiness: for the array keys 'display_name', 'first_name', and 'last_name' in
zitadel-bearer.php (the block building the user data passed to
wp_insert_user()), call trim() on the incoming claims (e.g., $userinfo['name'],
$userinfo['given_name'], $userinfo['family_name']) and only use the value if the
trimmed string is non-empty; otherwise omit the key or fall back to the
email/default. Apply the same trim-and-empty check logic to the other similar
block around the 403-410 region so whitespace-only claims won't overwrite WP
defaults.
2 participants
Summary
Why
Reported on staging after PR #176 + the AUTH_ZITADEL_ORG_ID Org-scoping (PR #177): registering a new user successfully landed them in the CDCF Org and auto-provisioned a WP Subscriber, but the WP user row had empty First Name + Last Name (`display_name` had fallen back to the email). The OIDC standard claims `given_name` + `family_name` were being discarded.
Tests
Theme suite: 458 / 458 (+1), 1063 assertions.
Deploy
WP theme change. After merge needs `gh workflow run deploy.yml -f environment=production` so the new shape reaches live WP. Independent of PR #177 (no overlap in files).
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
Bug Fixes
Tests