3 posts tagged with "NOVI AMS"

Closes two lookup endpoints that answered anyone who asked, gets members signed in after a password reset instead of showing them a login form, and fixes several ways accounts created from an AMS came out wrong.

Adds​

• Member/Non-Member role mapping can create a role by name, the same way every other mapping type already could. Previously it could only choose from roles that already existed.
• Member Lookup remembers your last few lookups and offers them back as shortcuts. Each administrator sees only their own, and a member reached by ID, record number or email is remembered once rather than three times.

Fixes​

• [SECURITY] Two lookup endpoints answered anyone who asked. The committee and membership type lists — read from re:Members, and spending the site's API allowance to do it — were reachable by any visitor who could reach the REST API. Both now require the same permission as the screens they serve, and a test refuses any future route in the namespace that does not declare one.
• [RE:MEMBERS] Members are signed in after completing a password reset, instead of being shown the WordPress login form and asked to log in again by a site they had just proved their identity to. The return address given to re:Members was losing part of itself on the way back; it no longer has a part to lose.
• Members created from the AMS get their first and last name. The plugin was writing them to property names WordPress does not save, so every AMS-created user had blank name fields regardless of what the AMS sent. Records carrying only a combined name now have it split.
• Two members whose names produce the same username can both sign in. The second was refused a WordPress account and could never get in; the username now gets a numeric suffix, as WordPress does elsewhere.
• A failure while creating a WordPress user is reported instead of ending the login in a PHP fatal error.
• [NOVI] A role granted in WordPress, that no mapping mentions, survives the next sign-in on Novi as well as on re:Members. The code to preserve it existed but had been commented out.
• The "Role to Apply to all SSO Users" setting no longer adds a blank role when saved without choosing one, and no longer adds a role the member already has twice.

Changes​

• Login and logout no longer append a cachebuster to the address members land on. Measured against a live site, the page cache already bypasses signed-in members on its own, while every login and logout was leaving behind a cache entry keyed on a timestamp nobody would request again. Members now land on a clean URL.
• The wording of the "Manage WP Roles on AMS" setting says what turning it on actually does to roles granted in WordPress.

Introduces the Honor Effective Date setting for re:Members membership access control. Improves NOVI AMS credential validation, login redirect handling, and PHP 7.4 compatibility. Fixes a number of admin UI and error-handling issues.

Adds​

• [RE:MEMBERS] Adds an Honor Effective Date setting on the re:Members Settings page. When enabled, member role access begins only when the membership effectiveDate has been reached.

Changes​

• [RE:MEMBERS] Member access now defaults to the earlier of effectiveDate or joinDate (unless Honor Effective Date is enabled). This means members who join before their official term start date will receive access immediately by default.
• [NOVI] is_connected() now validates that all required credentials (Base URL, Client ID, and Client Secret) are present before reporting a connected state.
• [NOVI] Login redirect validation now uses wp_validate_redirect() and wp_sanitize_redirect() to correctly support both absolute and relative URLs (e.g. /my-page).

Fixes​

• [NOVI] Fixes a PHP parse error on PHP 7.4 caused by a named argument (callback:) passed to add_filter().
• [NOVI] Removes unreachable code after wp_die() in the login exception handler; login errors now redirect to the home page with a cache-buster.
• [NOVI] check_response() and get_parsed_response() now handle WP_Error and non-array HTTP responses gracefully instead of masking the original failure.
• [ADMIN] Fixes disabled AMS <select> not submitting its value by injecting a hidden input when the field is disabled via the AMSC_CONNECTED_AMS constant.
• [ADMIN] Select2 multi-role selector initialization is now guarded so it only runs on screens where the Select2 library is enqueued, preventing JS errors on other admin screens.

Improves the accuracy of re:Members expiration dates by using a fallback option. Provides post-logout routing options. Adds initial NOVI AMS SSO oAuth2.0 flow integration.

Adds​

• [RE:MEMBERS] Retrieves inactive memberships from re:Members (if there are no active ones) to use in setting the expiration date meta data.
• [RE:MEMBERS] Creates an option to route users to the WordPress homepage after logging them out of re:Members.
• [NOVI] Adds NOVI AMS SSO integration via oAuth2.0 flow. Currently only available by setting the AMSC_CONNECTED_AMS constant to novi.