SSO: Add integration with JSON API authorization

[ebinnion]

It was reported by @m and @beaulebens that the SSO form was not displaying when using Jetpack JSON API authorization. This seems to be because the action used was not login.

This patch adds the jetpack_json_api_authorization action and provides a mechanism so plugins can add extra actions where the SSO form would show.

This PR also adds integration for SSO and JSON API authorization. From what I could tell, the two never worked well together since they use separate values for the $action global.

To test:

• Install Google Docs addon: https://chrome.google.com/webstore/detail/wordpresscom-for-google-d/baibkfjlahbcogbckhjljjenalhamjbp
• Go to "Add-ons > WordPress.com for Google Docs > Open"
• Authorize a Jetpack site that has this PR applied and SSO enabled
• Ensure that clicking the "Login with WordPress.com" button allows you to connect your site to Google Docs
• Do lots of regression testing. Make sure that bypassing the login form works as expected, that the SSO form displays when logging out, etc.

Here is an example of the various filters I use to test:

//add_filter( 'jetpack_sso_require_two_step', '__return_true' );
//add_filter( 'jetpack_remove_login_form', '__return_true' );
//add_filter( 'jetpack_sso_display_disclaimer', '__return_false' );
//add_filter( 'jetpack_sso_match_by_email', '__return_false' );
//add_filter( 'jetpack_sso_new_user_override', '__return_true' );
//add_filter( 'jetpack_sso_allowed_username_generate_retries', '__return_zero' );
//add_filter( 'jetpack_sso_bypass_login_forward_wpcom', '__return_true' );

[georgestephanis]

Sounds reasonable. We had problems in the past not accounting for changed actions when the action is register or forgotpassword or the like.

[ebinnion]

As is, this PR makes the SSO form visible. But, I'm now trying to figure out how to integrate with the JSON API authorization flow.

[ebinnion]

At this point, the PR is functional. BUT... it's definitely hacky since we're overriding superglobals. 🎉

From what I can tell, I'm not sure that JSON API auth and SSO ever worked together since SSO uses a completely different action when doing its auth. So, the hooks that are initialized for the jetpack_json_api_authorization login action don't get fired for SSO.

[beaulebens]

When I tried this out, I got to the point of the first request to log in/authorize access and saw the SSO button/UI (yay!) so I clicked to Log in with WordPress.com, and then it seemed to just reload the screen, but this time I was logged out of WP.com (I think, no avatar/name shown), but then it showed the SSO button again. So I clicked it again, and it loaded for a while, then just came back to that same state again, and now seems to be in a loop there (e.g. successive clicks of the SSO button just reload this page, asking me to log in and authorize access to my site's data).

So: I clicked to Authorize access to one of my sites, and WP.com shows me this:

Then I pick my site from the list and click Authorize, so I'm sent to that (Jetpack) site to authorize:

but when I click to "Log in with WordPress.com", it just reloads to here:

[ebinnion]

I believe I found the issue that @beaulebens was running in to. When the $token was not set for a client in user meta, the API just redirects the user back to the login form.

I didn't catch this in my testing because I had previously used the standard username/password login form which set the $token in my user meta.

Moving this back to 4.6 since this flow would be really nice to get in with the Google Docs add-on.

[enejb]

should we have a stricter comparison here?

[ebinnion]

We could do !==, but I'm not sure it's necessary here since we're comparing strings.

[lezama]

since we're comparing strings.

sure sure?

[beaulebens]

From a user-testing perspective, this is working perfectly for me now!

[lezama]