test(e2e): regression guards for #1185 (SSO bootstrap race) and #1169 (subsite password reset)

[kenedytorcatt]

Why this PR exists

A senior contributor on our side recently shipped two fixes that affected ~300+ subsites in our production network (kursopro.com), and we'd like to make sure they can't silently regress in a future refactor:

• PR fix(sso): guard against unpopulated $current_blog during early bootstrap #1185 — inc/sso/class-sso.php early-return + deterministic-secret fallback (merged 2.11.1).
• PR [URGENT] fix(checkout-pages): rewrite password reset URL on subsites (#1168) #1169 — inc/checkout/class-checkout-pages.php subsite password reset URL rewrite (merged 2.10.2).

This PR adds two Cypress specs + matching WP-CLI fixtures that lock in the behaviour of those fixes. They sit alongside your existing 060-sso-cross-domain.spec.js, 065-sso-redirect-loop.spec.js, and 050-password-strength-enforcement.spec.js and follow the same patterns (cy.wpCliFile, JSON output from fixture, cy.loginByApi, baseUrl localhost:8889).

What each spec verifies

066-sso-bootstrap-race.spec.js — guards #1185

• calculate_secret_from_date('') does not throw and returns a real hash.
• Two consecutive calls with empty input return the same hash (deterministic fallback — important so SSO state stays consistent across requests during the empty-`registered` window).
• convert_bearer_into_auth_cookies() does not throw when `$current_blog` exists with an empty `registered` property.

Driven entirely from PHP via setup-sso-bootstrap-race.php. The race is at the PHP layer (between sunrise.php and ms-settings.php), so no browser interaction is required.

011-password-reset-subsite-domain.spec.js — guards #1169

• The URL produced by the retrieve_password_message filter on a subsite uses the subsite host — not the main-site `/wp-login.php` host (the symptom of the original bug that confused zuletadia on yariglam.cl).
• The reset query args `action=rp / key / login / wp_lang` are preserved so WooCommerce my-account, BuddyPress, custom themes, and the default wp-login fallback can still complete the reset.
• The new wu_subsite_password_reset_url filter is reachable for integration overrides.

Driven via setup-password-reset-subsite.php which creates a test subsite, switches into it, and applies the filter chain directly with a synthetic raw message — no SMTP / Mailpit / cron dependency.

How they fit your existing suite

File	Type	Notes
tests/e2e/cypress/integration/066-sso-bootstrap-race.spec.js	new	Numbered after your 060/065 SSO specs
tests/e2e/cypress/integration/011-password-reset-subsite-domain.spec.js	new	Numbered next to the 010-manual-checkout-flow.spec.js group
tests/e2e/cypress/fixtures/setup-sso-bootstrap-race.php	new	Same pattern as your setup-sso-test.php
tests/e2e/cypress/fixtures/setup-password-reset-subsite.php	new	Same pattern as your setup-sso-test.php

Both specs are deterministic, single-process, and avoid any heavy setup (no Stripe, no PayPal, no Mailpit).

Honest note — please validate in your CI before merging

I authored these on Windows without Docker locally, so I was not able to run npm run cy:run:test against your wp-env setup. I verified:

• PHP -l syntax check on both fixtures.
• node --check syntax check on both specs.
• That the SSO class is a singleton (\WP_Ultimo\SSO\SSO::get_instance()) by reading inc/sso/class-sso.php.
• That replace_reset_password_link() and the wu_subsite_password_reset_url filter live where the PR diffs say they do.
• That fixture conventions match your setup-sso-test.php (JSON output, wp_json_encode, container path via cy.wpCliFile).

If anything fails in your CI I'm happy to iterate — feel free to push directly to the branch or comment with the failure output.

Production context

Bug context behind each spec, in case it helps reviewing the assertions:

• fix(sso): guard against unpopulated $current_blog during early bootstrap #1185 SSO bootstrap race: surfaced as blank admin panels inside iframes on mapped-domain subsites after a cache invalidation. Masked by full-page cache on healthy requests, reappeared every time the cache was cold. Affected 300+ subsites until 2.11.1.
• [URGENT] fix(checkout-pages): rewrite password reset URL on subsites (#1168) #1169 password reset on subsites: a customer of a subsite owner (mapped .cl TLD) requested a password reset and received an email pointing at the main network's wp-login.php. She didn't recognise the domain, treated the email as phishing, and complained to the subsite owner that the site had been hacked. Reproduced on 8/8 subsites in our staging network before patch.

Thanks David — and thank you for shipping both fixes so quickly. These specs are our way of helping keep them locked in.

[coderabbitai]

Warning

Rate limit exceeded

@superdav42 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 28 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2c169c0a-f035-459b-b312-e1505647f901

📥 Commits

Reviewing files that changed from the base of the PR and between ddd628c and 93875eb.

📒 Files selected for processing (4)

• tests/e2e/cypress/fixtures/setup-password-reset-subsite.php
• tests/e2e/cypress/fixtures/setup-sso-bootstrap-race.php
• tests/e2e/cypress/integration/011-password-reset-subsite-domain.spec.js
• tests/e2e/cypress/integration/066-sso-bootstrap-race.spec.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[superdav42]

Auto-approved by pulse runner @superdav42 — author @kenedytorcatt confirmed collaborator, pre-merge gates passed.