Wapu Auth – Inicio de sesión social para WordPress y WooCommerce

Wapu Auth adds Google and Facebook social login to WordPress and WooCommerce. Provider OAuth processing is handled by the fixed Wapu Auth Broker at https://auth.wapuos.com; provider client secrets and provider tokens never enter WordPress.

On activation or update, Wapu Auth queues an asynchronous, one-shot background connection. An eligible public HTTPS site is registered, verified and checked without requiring a normal registration button click. The worker uses an expiring lock, reuses a pending broker challenge, retries temporary failures with bounded backoff and never rotates or re-registers a verified current-origin credential. Local, private, non-HTTPS and cloned origins fail closed. A protected manual retry remains available when the host, firewall or cron system needs attention.

After the connection is verified, the plugin checks local HMAC signing, broker provider availability, schema integrity, identity preflight and safe backfill before enabling new broker login starts. Existing WordPress users, roles, WooCommerce customers, orders and downloads are not recreated or deleted by this workflow.

Main Features

• Google and Facebook login through full-page broker redirects and a closed provider registry.
• Automatic background site registration and proof-of-control verification for eligible public HTTPS sites.
• Encrypted, non-autoloaded per-site broker credentials with exact-origin binding.
• HMAC-signed server requests with timestamps, fresh nonces and fixed broker paths.
• Independent, expiring local transactions for concurrent login attempts.
• Canonical provider identities with conflict-aware account linking and safe unlinking.
• Adaptive provider controls: one enabled provider uses a full button; multiple providers use accessible circular buttons.
• Shortcodes [wapu_auth_button] and [wapu_auth_login_button], plus the wapu-auth/login-button block.
• Custom login and registration forms through [wapu_auth_login_form] and [wapu_auth_register_form].
• WooCommerce login, registration, checkout return, profile autofill and My Account integration.
• Active WordPress session management, including individual revocation and closing other sessions.
• Safe return URLs, domain rules and a local sandbox allowlist.
• Local multiprovider analytics for Google, Facebook and traditional WordPress access, with provider filters and sanitized exports.
• Optional detailed Activity Log, GeoIP enrichment and GA4 event bridge.
• Identity migration diagnostics, bounded safe backfill and non-destructive broker pause/resume controls.
• Site-scoped support conversations through the broker’s audited HMAC API.
• Optional private image attachments in Support, capability-gated by the broker and proxied without exposing site credentials.
• Native WordPress login remains available when allowed by the site’s configuration.

How Broker Login Works

1. A visitor selects Google or Facebook.
2. WordPress validates the return URL and creates an expiring, provider-bound local transaction.
3. WordPress sends a signed request to /api/v1/google/sessions or /api/v1/facebook/sessions.
4. The broker returns an allowlisted provider start URL and completes provider OAuth.
5. The broker returns a one-use wxc_* code to /wapu-auth/oauth/callback on the WordPress site.
6. WordPress consumes the local transaction and exchanges the code at /api/v1/oauth/exchange.
7. The plugin requires the returned provider and subject to match the local transaction before resolving, linking or creating the WordPress user.
8. WordPress issues its normal authentication cookies and applies the validated local return URL.

Compatibility and Removed Features

The deprecated [wapu_auth_popup] and [wapu_auth_popup_button] aliases still render the normal redirect control for one compatibility cycle. They do not open a popup.

Version 2.0 removes Google One Tap, local modal authentication, emailed login links, email OTP, trusted-device bypasses and integrated SMTP configuration. Active Sessions, normal WordPress notifications through wp_mail(), the primary shortcodes, block, forms and WooCommerce flows remain available.

WordPress Multisite is not supported. Activation is stopped before identity migrations on a network installation.

Hooks & Filters

Actions

• wapu_auth_before_login — before a broker authorization session is created.
• wapu_auth_user_authenticated — after successful user resolution.
• wapu_auth_user_created — after a WordPress user is created.
• wapu_auth_provider_account_unlinked — after one provider mapping is removed.
• wapu_auth_google_account_unlinked — compatibility action after a Google mapping is removed.
• wapu_auth_analytics_event — after a local analytics event is recorded.
• wapu_auth_log — after the plugin logger records an entry.
• wp_login — standard WordPress action, fired exactly once for a successful broker login.

Filters

• wapu_auth_user_data — presentation fields only; provider identity fields remain immutable.
• wapu_auth_redirect_url — final redirect, subject to same-origin validation.
• wapu_auth_error_message — local user-facing error copy.
• wapu_auth_button_html — rendered provider control HTML.
• wapu_auth_geoip_enabled — optional GeoIP enrichment.

The legacy wapu_auth_auth_params, wapu_auth_redirect_uri and wapu_auth_oauth_base_url filters are compatibility notifications. They cannot change the broker host, callback, provider, state, nonce, signature, ticket or one-use code.

External Services

1. Wapu Auth Broker (required for social login)

Fixed origin: https://auth.wapuos.com

When used: after activation or update for background registration/verification and provider health; when a visitor starts or completes social login; when an administrator deliberately rotates a credential or uses the Support section.

Endpoints used:

• POST /api/v1/sites/register/init and POST /api/v1/sites/register/verify for proof-of-control registration.
• GET /health for a public, secret-free provider availability snapshot.
• POST /api/v1/google/sessions or POST /api/v1/facebook/sessions to begin login.
• POST /api/v1/oauth/exchange to exchange the callback’s one-use code.
• Browser paths under /oauth/google/* or /oauth/facebook/* during provider authorization.
• Site-scoped /api/v1/support/* operations only when an administrator uses Support.
• Signed binary support-image upload plus private thumbnail/content delivery only when the broker capability flag is enabled.

Registration data: canonical site URL, fixed local callback URL, short-lived verification URL and registration identifier. The broker performs a public GET of the verification URL, which returns only the active short-lived challenge.

Login data: site ID, HMAC timestamp/nonce/signature headers, provider-bound local state, validated return context and the one-use exchange code. Sensitive protocol values are not written to plugin logs.

Identity data received: provider, provider subject, email and verification state, and optional name/avatar fields. Provider tokens, refresh tokens, provider authorization codes and provider client secrets are not returned to WordPress.

Support data: the subject, allowlisted category, public messages and optional JPEG/PNG/WebP evidence deliberately entered by an administrator. Images are normalized to remove EXIF/GPS and unnecessary metadata, remain in private broker storage and are returned only through authorized proxy requests. Internal broker notes and private agent data are not exposed to WordPress.

Documents: About | Privacy | Terms

2. Google OAuth / OpenID Connect (indirect)

When used: only after a visitor actively selects Google.

The visitor reaches Google through the broker. Google receives normal OAuth request and browser/network metadata under its own policies. Provider tokens stay at the broker and are not returned to WordPress.

Policies: Google Privacy Policy | Google Terms

3. Meta / Facebook Login (indirect)

When used: only after a visitor actively selects Facebook.

The visitor reaches Facebook through the broker. Meta may receive normal OAuth request and browser/network metadata under its own policies. Provider tokens stay at the broker and are not returned to WordPress.

Policies: Meta Privacy Policy | Meta Terms

4. GeoIP providers (optional, disabled by default)

Services: https://ipapi.co/, with https://ipwho.is/ as fallback.

Data sent: visitor IP address and normal HTTP metadata.

When used: only when the administrator enables GeoIP enrichment. The site owner is responsible for an appropriate legal basis and consent where required.

Policies: ipapi.co Privacy | ipwho.is Privacy

5. Google Analytics 4 event bridge (optional, disabled by default)

The plugin can call a site’s existing gtag function with provider-aware social-login events and limited status metadata. It does not load Google Analytics itself. The site administrator is responsible for consent and the site’s Analytics configuration.

Privacy & Data Retention

Wapu Auth stores local configuration, encrypted broker credentials, a one-way verified-origin fingerprint, hashed and expiring transaction state, canonical provider mappings, compatibility metadata, WordPress session data and any enabled analytics or Activity Log records. Depending on settings, detailed logs can contain account email, IP address and derived location.

The automatic-connection state contains only sanitized status codes, counters, timestamps, provider availability and a one-way origin hash. It never contains the broker challenge, registration ID, site secret, signature, request payload or remote response.

While one proof-of-control operation is pending, its registration ID and challenge are held separately in a short-lived WordPress transient only until verification, explicit recovery or expiry; they are not copied to plugin logs.

Wapu Auth does not store provider access tokens, provider refresh tokens, provider authorization codes, raw HMAC signatures, broker tickets or one-use exchange codes. Legacy Google Client ID/Secret values from 1.x are retained only in separate authenticated encrypted storage until an administrator completes the protected removal flow.

Optional GeoIP and GA4 features are disabled by default. Administrators should update their own privacy notice and select a retention period appropriate to their jurisdiction.

Optional Support images are disabled until the broker advertises the compatible WAPU-SUPPORT-ATTACHMENT-V1 capability. Pending images are temporary and pruned after expiry; linked images are retained only for the broker support workflow and removed under its ticket/site retention policy. They are not attached to WhatsApp or administrative email notifications. The broker strips EXIF, GPS and unnecessary image metadata during normalization. Site administrators should avoid uploading secrets or unrelated personal information and describe this support processing in their own privacy notice when the feature is enabled.

Automatic Installation

1. In WordPress, open Plugins > Add New and search for Wapu Auth – Inicio de sesión social para WordPress y WooCommerce.
2. Install and activate the plugin.
3. Keep WordPress cron enabled and allow outbound HTTPS requests to https://auth.wapuos.com.
4. Ensure the site’s canonical URL and REST API are publicly reachable over HTTPS without Basic Auth, maintenance HTML or a redirect between apex and www.
5. Open Wapu Auth > Connection to monitor the background state. No normal registration or verification click is required.
6. Configure enabled providers, appearance, local access rules and WooCommerce placement.
7. Validate Google, Facebook and traditional login end to end on staging before production rollout.

Manual Installation

1. Upload the release ZIP through Plugins > Add New > Upload Plugin, or extract the wapu-auth-social-login directory into /wp-content/plugins/.
2. Activate Wapu Auth – Inicio de sesión social para WordPress y WooCommerce.
3. Follow the automatic-connection and staging-validation steps above.

Updating from 1.x or a prerelease

1. Back up the database and test the update on staging first.
2. The versioned upgrade creates or verifies plugin-owned identity and transaction tables, preserves users and commerce records, and retains legacy Google credentials in encrypted non-autoloaded storage.
3. The asynchronous worker analyzes legacy identity metadata and backfills only unambiguous mappings for the same WordPress user ID.
4. Critical conflicts leave broker login paused for review; no accounts are merged automatically.
5. A verified credential for the current origin is reused. The updater does not rotate it or create another broker registration.
6. A database clone whose credential is bound to another origin remains blocked until an administrator deliberately resolves the environment.

Do I enter Google or Facebook client credentials in WordPress?

No. Provider OAuth configuration stays in Wapu Auth Broker. WordPress stores only its encrypted per-site broker credential.

Why is the automatic connection waiting or blocked?

The normal causes are a non-public or non-HTTPS URL, localhost or a reserved hostname, Basic Auth, maintenance mode, a firewall blocking the verification endpoint, disabled WP-Cron, outbound HTTPS restrictions, DNS mismatch, or a cloned database carrying credentials for another origin. Correct the environment and use Retry automatic connection. Do not paste broker secrets into support requests.

Will an update rotate or duplicate an existing broker credential?

No. A verified credential bound to the current origin short-circuits registration. Pending proof-of-control work is reused under a lock. An ambiguous one-time verification response stops for explicit recovery instead of starting a replacement automatically.

Does the local HMAC diagnostic prove the remote credential is active?

No. It proves that WordPress can decrypt the local secret and build a valid signature. The current broker contract has no authenticated credential-health endpoint. Provider availability and an end-to-end staging login remain separate checks.

Can one WordPress account link both providers?

Yes. Canonical mappings are provider-specific and enforce one subject per provider and one provider identity per WordPress user. Cross-provider linking requires an authenticated user and a fresh broker flow.

What happens when Facebook does not return an email address?

Wapu Auth follows the broker’s nullable Facebook-email contract. It does not invent or silently trust an email. The account-linking flow must resolve safely under the configured local policy.

Does Wapu Auth replace the normal WordPress login?

No. Native login remains available unless the site owner hides it in a custom form. Pausing broker mode stops only new social-login starts.

Does WooCommerce have to be active?

No. Wapu Auth works with WordPress alone. WooCommerce hooks and My Account features are loaded only when WooCommerce is active.

Can customers manage sessions and connected providers?

Yes. When enabled, WooCommerce My Account shows active sessions and connected-account controls. Unlinking a provider does not delete the WordPress account or orders.

How do I remove plugin data?

The Security settings contain the uninstall-retention choice. If deletion is enabled before uninstall, operational settings, canonical mappings, local transactions, analytics and logs are removed. WordPress users, WooCommerce orders and unrelated data are not deleted. Retained legacy Google credentials have a separate protected irreversible-removal action.

Does an automated test prove live provider login works?

No. Automated tests mock broker and provider transport. Complete a real fresh-install and legacy-update validation on staging, including Google, Facebook, relink, unlink, traditional login and WooCommerce return flows.

What happens to images attached to a support conversation?

Support images are optional and appear only when Wapu Auth Broker advertises the compatible signed-upload capability. The initial formats are JPEG, PNG and WebP, with up to four images, 5 MB per image and 15 MB per message. WordPress validates the file before forwarding its exact bytes through a server-to-server signed request; the browser never receives the site secret or an HMAC signature.

The broker decodes and re-encodes accepted images, removes EXIF/GPS and unnecessary metadata, creates a private thumbnail and stores both files outside public web storage. Images are served back through an administrator-authorized WordPress REST proxy with private no-store responses. Pending uploads expire and are pruned; linked files follow the broker’s support-ticket retention and deletion policy. Share only evidence needed to resolve the issue and avoid passwords, payment data or sensitive personal information.

Where are the service documents?

• About Wapu Auth Broker
• Privacy Policy
• Terms of Service

2.0.0

• Added stable Google and Facebook login through the fixed Wapu Auth Broker.
• Added asynchronous connection on activation and update, with cron, admin fallback, expiring lock, bounded retries and manual recovery.
• Added verified-origin and cloned-environment protection; verified current-origin credentials are never re-registered or auto-rotated.
• Added encrypted non-autoloaded broker credential storage and local HMAC signing diagnostics.
• Added canonical multiprovider identities, provider-bound transactions and conflict-aware upgrade preflight.
• Added bounded safe backfill that preserves the same WordPress user IDs and never merges critical conflicts automatically.
• Added Google, Facebook and traditional analytics, provider activity/error metrics, provider filters and sanitized exports.
• Added adaptive provider buttons across shortcodes, the block, custom forms and WooCommerce.
• Added provider availability, local ordering and responsive provider administration.
• Added Active Sessions, account linking/unlinking, WooCommerce return handling and optional profile autofill.
• Updated the public Wapu Auth name to reflect Google and Facebook social login for WordPress and WooCommerce.
• Added a responsive administration console, identity migration review and site-scoped broker Support.
• Added capability-gated private JPEG/PNG/WebP attachments, signed binary upload, thumbnail proxy, previews and an accessible lightbox in Support.
• Preserved native WordPress users, roles, sessions and WooCommerce customer/order ownership during the versioned upgrade.
• Preserved legacy Google credentials in encrypted non-autoloaded recovery storage until a separately authorized purge.
• Removed Google One Tap, popup/modal authentication, email login links, email OTP, trusted-device bypasses and integrated SMTP settings.
• Security: fixed-origin HTTPS transport, no redirects, bounded responses, HMAC timestamps/nonces and strict callback/provider matching.
• Compatibility: deprecated popup-named shortcodes render the normal redirect control for one cycle.
• Compatibility: WordPress single-site 6.3+ and PHP 8.0+; Multisite remains fail-closed and unsupported.
• Validation note: broker/provider transport is mocked in automated tests; real fresh-install and legacy-update staging checks remain required before production rollout.

1.1.0

• Added Active Sessions and smart WooCommerce redirects.
• Added experimental authentication and mail-delivery features retired by 2.0.0.

1.0.0

• Initial Google login release with button customization, analytics, domain restrictions, sandbox, forms, WooCommerce integration and shortcodes.