fix: allow SSO redirects to mapped domains

[superdav42]

Summary

• Ensure SSO startup loads the existing Domain Mapping singleton so its allowed_redirect_hosts allow-list is registered in SSO grant contexts.
• Prevent anonymous SSO denial redirects from falling back to the main-site admin URL when the broker is on a mapped domain.
• Add regression coverage that SSO startup enables mapped-domain redirect hosts via the existing Domain Mapping logic.

Verification

• php -l inc/sso/class-sso.php && php -l tests/WP_Ultimo/SSO/SSO_Coverage_Test.php
• vendor/bin/phpcs inc/sso/class-sso.php tests/WP_Ultimo/SSO/SSO_Coverage_Test.php
• wp --url=https://mygratis.site eval '$hosts = apply_filters("allowed_redirect_hosts", ["mygratis.site"], "ultimatemultisite.com"); echo implode("\n", $hosts) . "\n";' confirmed ultimatemultisite.com is allowed locally.
• Local curl chain for the reported SSO route returned broker-domain denial flow: mygratis.site/sso-grant -> ultimatemultisite.com/sso?...sso_verify=invalid -> ultimatemultisite.com/

Notes

• Targeted PHPUnit could not run because the local plugin PHPUnit install fatals with Class "PHPUnit\\TextUI\\Command" not found.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds an allow_sso_redirect_hosts() method to the SSO class, registered as an allowed_redirect_hosts filter, which normalizes redirect hosts and expands allowed hosts with www/non-www variants when the host is network-owned or domain-mapped. A corresponding coverage test is added.

Changes

SSO Redirect Host Validation

Layer / File(s)	Summary
Redirect host filter and normalization logic inc/sso/class-sso.php	Registers allowed_redirect_hosts filter in startup() and implements allow_sso_redirect_hosts() with helpers to normalize hosts, generate www/non-www variants, and detect network ownership via domain mapping (WP_Ultimo\Models\Domain::get_by_domain) or WordPress site lookup fallbacks (get_site_by_path, get_sites).
Coverage test for mapped domain redirect host tests/WP_Ultimo/SSO/SSO_Coverage_Test.php	Adds a test that creates a mapped domain fixture, clears caches, invokes allow_sso_redirect_hosts() with an uppercase domain, asserts both bare and www variants are returned, and cleans up fixtures/caches.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WordPress as WordPress Filter System
  participant SSO as SSO::allow_sso_redirect_hosts
  participant DomainModel as WP_Ultimo\Models\Domain
  participant SiteLookup as get_site_by_path/get_sites

  WordPress->>SSO: apply_filters(allowed_redirect_hosts, host)
  SSO->>SSO: normalize_redirect_host(host)
  SSO->>DomainModel: get_by_domain(normalized host)
  alt domain mapping available and matched
    DomainModel-->>SSO: mapped domain found
  else fallback
    SSO->>SiteLookup: get_site_by_path/get_sites(host)
    SiteLookup-->>SSO: site match result
  end
  SSO->>SSO: get_redirect_host_variants(host)
  SSO-->>WordPress: return expanded, deduplicated allowed_hosts

Loading

Possibly related PRs

• Ultimate-Multisite/ultimate-multisite#1450: Both PRs extend allowed_redirect_hosts for network/mapped domains, with similar domain-mapping-based host validation logic.
• Ultimate-Multisite/ultimate-multisite#1452: Both PRs extend allowed_redirect_hosts to permit redirects to mapped/network-owned domains via analogous allowlist-expansion mechanisms.
• Ultimate-Multisite/ultimate-multisite#584: Directly extends the same tests/WP_Ultimo/SSO/SSO_Coverage_Test.php suite that this PR's test builds upon.

Suggested labels: origin:interactive

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: SSO redirects now allow mapped domains.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/sso-mapped-domain-redirect-hosts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password