fix: make passwordless login opt-in by superdav42 · Pull Request #1399 · Ultimate-Multisite/ultimate-multisite

superdav42 · 2026-06-10T18:09:53Z

Summary

Add a disabled-by-default Use Passwordless Login setting under Login & Registration.
Gate passwordless assets, markup, wp-login injection, checkout dependencies, and AJAX handlers behind the setting.
Restore username/password login as the default WP login, custom login form, and checkout inline-login experience.

Follow-up to #1358.

Verification

php -l inc/class-settings.php inc/auth/class-passwordless-auth-manager.php inc/ui/class-login-form-element.php inc/checkout/class-checkout.php views/checkout/partials/inline-login-prompt.php tests/WP_Ultimo/Settings_Test.php tests/WP_Ultimo/Auth/Passwordless_Auth_Test.php
bash bin/check-env.sh
vendor/bin/phpcs inc/class-settings.php inc/auth/class-passwordless-auth-manager.php inc/ui/class-login-form-element.php inc/checkout/class-checkout.php views/checkout/partials/inline-login-prompt.php tests/WP_Ultimo/Settings_Test.php tests/WP_Ultimo/Auth/Passwordless_Auth_Test.php
./node_modules/.bin/eslint tests/e2e/cypress/integration/login.spec.js --max-warnings=0
vendor/bin/phpunit --filter Settings_Test
vendor/bin/phpunit --filter Passwordless_Auth_Test
vendor/bin/phpunit --filter Login_Form_Element_Test
git diff --check

Notes

PHPUnit still emits an existing PHP 8.4 deprecation notice in inc/sso/jasny/Broker/Session.php.
ESLint still emits the existing Browserslist data-age advisory.

aidevops.sh v3.20.49 plugin for OpenCode v1.17.1 with gpt-5.5 spent 16h 54m and 2,784,885 tokens on this with the user in an interactive session.

Summary by CodeRabbit

New Features
- Added a passwordless login toggle in Login & Registration settings. When disabled (default), users see the standard username/password login form. When enabled, passwordless authentication becomes available.

coderabbitai · 2026-06-10T18:10:07Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 680e488e-8f15-4ea6-855f-c6ca8bea062d

📥 Commits

Reviewing files that changed from the base of the PR and between df8c7af and 75de135.

📒 Files selected for processing (8)

inc/auth/class-passwordless-auth-manager.php
inc/checkout/class-checkout.php
inc/class-settings.php
inc/ui/class-login-form-element.php
tests/WP_Ultimo/Auth/Passwordless_Auth_Test.php
tests/WP_Ultimo/Settings_Test.php
tests/e2e/cypress/integration/login.spec.js
views/checkout/partials/inline-login-prompt.php

📝 Walkthrough

Walkthrough

Add a use_passwordless_login settings toggle (disabled by default) and gate all passwordless functionality behind is_enabled(). When disabled, the manager skips hook registration, early-returns from asset enqueuing and markup rendering, AJAX endpoints short-circuit with a passwordless_login_disabled error, and UI surfaces fall back to standard username/password forms.

Changes

Passwordless Login Enablement Setting

Layer / File(s)	Summary
Settings registration and defaults `inc/class-settings.php`, `tests/WP_Ultimo/Settings_Test.php`	New `use_passwordless_login` toggle field added to login-and-registration section with default `0` (disabled); `Settings::get_setting_defaults()` includes the key in the fallback map; two new tests verify the field and default exist.
Passwordless manager enablement check `inc/auth/class-passwordless-auth-manager.php`	`is_enabled()` method reads the `use_passwordless_login` setting; `init()` returns early when disabled, preventing hook and AJAX action registration.
UI rendering and asset enqueuing guards `inc/auth/class-passwordless-auth-manager.php`	`enqueue_assets()`, `enqueue_login_assets()`, `render_wp_login_form()`, and `get_login_form_markup()` early-return when disabled, preventing script/style/markup emission.
AJAX endpoint enablement validation `inc/auth/class-passwordless-auth-manager.php`, `tests/WP_Ultimo/Auth/Passwordless_Auth_Test.php`	New `ensure_enabled_for_ajax()` sends `passwordless_login_disabled` error when disabled; all five AJAX handlers call this check before nonce verification; new test verifies AJAX endpoints return the error when disabled; test setup/teardown enables/disables the setting.
Conditional passwordless asset enqueuing `inc/ui/class-login-form-element.php`, `inc/checkout/class-checkout.php`	`Login_Form_Element` and `Checkout` conditionally call `enqueue_assets()` and register `wu-passwordless-auth` dependency only when `is_enabled()` returns true; login form output branches on enablement to render passwordless or standard fields.
Inline login prompt conditional UI `views/checkout/partials/inline-login-prompt.php`	Template now branches on `is_enabled()`: when enabled, shows passwordless helper and markup; when disabled, shows password field and forgot-password/sign-in controls.
E2E test expectations `tests/e2e/cypress/integration/login.spec.js`	Updated Cypress spec to expect standard username/password form visible by default and passwordless auth element absent, aligning with disabled-by-default setting.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Ultimate-Multisite/ultimate-multisite#1282: Changes to cy.loginByForm() helper affect the e2e login flows used in the main PR's updated login spec.
Ultimate-Multisite/ultimate-multisite#1397: Hardens passwordless login helper assertions in Cypress, directly connected to the main PR's login spec expectations around passwordless UI.

Suggested labels

status:available, review-feedback-scanned

Poem

🐰 A feature flag hops into place,
Passwordless tucked away with grace,
When toggle's off, the form falls back—
No fancy auth, just username track!
Settings dance, tests leap and bound,
Disabled by default, safe and sound! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: make passwordless login opt-in' directly and clearly summarizes the main change: converting passwordless login from default to disabled by default, requiring explicit opt-in via a new setting.
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch followup/passwordless-login-setting

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-10T18:12:15Z

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

Build: ultimate-multisite
⬇️ Download from GitHub Actions
⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password

superdav42 · 2026-06-10T18:27:17Z

Summary

Add a disabled-by-default Use Passwordless Login setting under Login & Registration.
Gate passwordless assets, markup, wp-login injection, checkout dependencies, and AJAX handlers behind the setting.
Restore username/password login as the default WP login, custom login form, and checkout inline-login experience.
Follow-up to GH#1357: feat(auth): add passwordless login with passkeys #1358.

Verification

php -l inc/class-settings.php inc/auth/class-passwordless-auth-manager.php inc/ui/class-login-form-element.php inc/checkout/class-checkout.php views/checkout/partials/inline-login-prompt.php tests/WP_Ultimo/Settings_Test.php tests/WP_Ultimo/Auth/Passwordless_Auth_Test.php
bash bin/check-env.sh
vendor/bin/phpcs inc/class-settings.php inc/auth/class-passwordless-auth-manager.php inc/ui/class-login-form-element.php inc/checkout/class-checkout.php views/checkout/partials/inline-login-prompt.php tests/WP_Ultimo/Settings_Test.php tests/WP_Ultimo/Auth/Passwordless_Auth_Test.php
./node_modules/.bin/eslint tests/e2e/cypress/integration/login.spec.js --max-warnings=0
vendor/bin/phpunit --filter Settings_Test
vendor/bin/phpunit --filter Passwordless_Auth_Test
vendor/bin/phpunit --filter Login_Form_Element_Test
git diff --check

Notes

PHPUnit still emits an existing PHP 8.4 deprecation notice in inc/sso/jasny/Broker/Session.php.
ESLint still emits the existing Browserslist data-age advisory.

aidevops.sh v3.20.49 plugin for OpenCode v1.17.1 with gpt-5.5 spent 16h 54m and 2,784,885 tokens on this with the user in an interactive session.

Merged via PR #1399 to main.
Merged by deterministic merge pass (pulse-wrapper.sh).

fix: make passwordless login opt-in

75de135

superdav42 mentioned this pull request Jun 10, 2026

[Supervisor:superdav42] 0 PRs, 0 assigned, 0 workers at 15:13 UTC #798

Open

superdav42 merged commit be2a59c into main Jun 10, 2026
11 checks passed

superdav42 mentioned this pull request Jun 11, 2026

Review followup: PR #1358 — GH#1357: feat(auth): add passwordless login with passkeys #1405

Closed

superdav42 added the review-feedback-scanned Merged PR already scanned for quality feedback label Jun 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: make passwordless login opt-in#1399

fix: make passwordless login opt-in#1399
superdav42 merged 1 commit into
mainfrom
followup/passwordless-login-setting

superdav42 commented Jun 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 10, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

github-actions Bot commented Jun 10, 2026

Uh oh!

Uh oh!

superdav42 commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

superdav42 commented Jun 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Poem

Uh oh!

github-actions Bot commented Jun 10, 2026

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

🌐 Test in WordPress Playground (Very Experimental)

Uh oh!

Uh oh!

superdav42 commented Jun 10, 2026

Summary

Verification

Notes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

superdav42 commented Jun 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 10, 2026 •

edited

Loading