OAuth: Fix Broken Access Control

[n7studios]

Summary

Validates OAuth authorization requests before exchanging the authorization code for an access token:

• The user must be logged in with the manage_options capability.
• The request must include a valid nonce, which proves the same user started the Connect flow.

Kit's OAuth redirect only keeps the page, tab and section parameters from the return URL, so the nonce is sent and returned in section (section=kit-oauth-{nonce}).

The OAuth callback handler is only registered when the Plugin has no access token, so this affects connecting a not-yet-connected site; an already-connected site's credentials cannot be overwritten via this flow. convertkit_get_oauth_url() is added to build the OAuth URL with the nonce, and is used by the Connect button, the "authorization failed" admin notice and the no-credentials meta box.

Testing

• testAuthorizationCodeNotExchangedWhenUnauthenticated: confirms no authorization code is exchanged, and no access token is stored, for requests from logged-out users (via admin-post.php, which runs admin_init for unauthenticated requests).
• testAuthorizationCodeNotExchangedWithoutNonce: confirms the same when an Administrator's request has a missing or invalid nonce.
• testNoCredentials, PostCest and PageCest: updated to decode the OAuth state parameter and check the return URL includes the nonce.
• Checked manually: connecting to Kit through OAuth still works.

Checklist

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR (if you're not sure who to assign, we can do this step for you)

[github-actions]

WordPress Playground

🚀 Your PR has been built and is ready for testing in WordPress Playground!

Click here to test your changes in WordPress Playground