fix: route sso grant attach urls

inc/sso/class-sso.php

@@ -488,6 +488,8 @@ public function handle_requests(): void {
 
 		$return_type = wp_is_jsonp_request() ? 'jsonp' : 'redirect';
 
+		$action = (string) preg_replace('/-grant\/?$/', '', $action);
+
 		$action = str_replace($this->get_url_path(), 'sso', $action);
 
 		$action = trim(wu_replace_dashes($action), '/');
@@ -654,6 +656,7 @@ private function generate_sso_token(int $user_id, string $audience): string {
 		// HMAC-signed token.
 		$hmac = hash_hmac('sha256', $payload, wp_salt('auth'));
 
+		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Encodes an HMAC-signed SSO token for URL transport.
 		return rtrim(strtr(base64_encode($hmac . '::' . $payload), '+/', '-_'), '=');
 	}
 
@@ -775,6 +778,7 @@ private function validate_sso_token(string $token) {
 			$token .= str_repeat('=', 4 - $padding);
 		}
 
+		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decodes the URL-safe HMAC-signed SSO token generated above.
 		$decoded = base64_decode($token, true);
 
 		if ( ! $decoded || false === strpos($decoded, '::') ) {

tests/WP_Ultimo/SSO/SSO_Test.php

@@ -640,7 +640,7 @@
 	 * when sso_verify is 'invalid', preventing redirect loops.
 	 */
 	public function test_handle_broker_source_sets_denied_cookie_on_invalid_verify(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -658,7 +658,7 @@
 	 * so that later code (handle_auth_redirect, enqueue_script) sees it immediately.
 	 */
 	public function test_handle_broker_source_sets_cookie_superglobal_on_invalid_verify(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -675,7 +675,7 @@
 	 * instead of leaving the user on the /sso 404 page.
 	 */
 	public function test_handle_broker_source_redirects_to_return_url_on_invalid_verify(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -698,7 +698,7 @@
 	 * causes an infinite redirect loop.
 	 */
 	public function test_handle_broker_source_returns_jsonp_error_for_unattached_broker(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -717,7 +717,7 @@
 	 * redirect -> sso_verify=invalid -> redirect -> repeat.
 	 */
 	public function test_sso_js_does_not_contain_incognito_redirect(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/assets/js/sso.js'
 		);
 
@@ -745,6 +745,21 @@
 		$this->assertTrue(true);
 	}
 
+	/**
+	 * Test handle_requests normalizes sso-grant URLs before dispatching.
+	 */
+	public function test_handle_requests_source_normalizes_sso_grant_to_server_action(): void {
+		$source = file_get_contents(
+			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
+		);
+
+		$this->assertStringContainsString(
+			"preg_replace('/-grant\\/?$/', '', \$action)",
+			$source,
+			'handle_requests() must normalize sso-grant requests to the sso server action'
+		);
+	}
+
 	// ------------------------------------------------------------------
 	// Session handler
 	// ------------------------------------------------------------------
@@ -888,7 +903,7 @@
 	 * call before the printf to guard against regressions.
 	 */
 	public function test_handle_server_source_sets_javascript_content_type_for_jsonp(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -912,7 +927,7 @@
 	 * 4. handle_main_site_logged_in_user JSONP success response
 	 */
 	public function test_handle_broker_source_sets_javascript_content_type_for_jsonp(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);