Appearance
Social Login
Sign-in with Google or GitHub on the site; the accounts are linked to WordPress users.
kitloom/social-accounts · admins: kitloom/social-accounts-filament, kitloom/social-accounts-nova
Video lessons
Recorded in the Filament admin; the Nova admin works the same way.
Sign-in with Google or GitHub on the site, as Nextend Social Login gives a WordPress site: a visitor presses "Continue with Google", comes back signed in. The account is linked to a WordPress user; a site that comes from WordPress with the plugin keeps every account its visitors linked there. The admin is kitloom/social-accounts-filament or kitloom/social-accounts-nova.
It is for the site's visitors. The admins keep their own sign-in.
Setting it up
Social Login → Settings, for each service:
- Make an OAuth app at the service — Google: Google Cloud console → Create credentials → OAuth client ID → Web application; GitHub: Settings → Developer settings → OAuth Apps → New OAuth App.
- Give it the redirect URI the settings page shows:
https://your-site/auth/google/callback,https://your-site/auth/github/callback. A site that moved from Nextend hadwp-login.php?loginSocial=googlethere: add the new address (or replace the old one). - Copy the app's client ID and client secret into the settings and switch the service on.
A service shows a button only when it is switched on and has both keys. The secret is stored encrypted with the application key and never shown again; a field left empty keeps the saved one. If the application key changes, enter the secret again.
Other settings:
| Setting | Default | What |
|---|---|---|
| Link accounts by email address | on | A visitor whose Google or GitHub address belongs to a user signs in as that user, and the account is linked. Only an address the service has verified counts, and only a user whose address is theirs: one who signed up on the site, or changed the address on the account page, opens a password reset link first |
| Login page | empty | The theme's page with the login form: a sign-in that went wrong comes back here. Empty — back to the page the button was pressed on |
New visitors become users only while Settings → General → «Anyone can register» is on, with the «New User Default Role». Otherwise only existing users can sign in this way.
Who signs in
When a visitor comes back from the service:
- The account is linked to a user — that user signs in.
- A user has the address the service vouches for — the account is linked to them and they sign in (unless linking by address is off). A user who typed that address in themselves at the site's sign-up, the shop's or the checkout's, or whose address was changed afterwards — on the account page, a profile page of an admin, or by an admin — is not joined until a password reset link sent there is opened (
kitloom_email_unverifiedinwp_usermeta,Kitloom\WpSchema\Users\EmailProof): whoever signed up first with someone else's address would otherwise share that person's account. Users an admin made, imported ones and those a service made keep linking as before. - Registration is open — a new user is made from the account's name and address, and signs in.
- Otherwise the visitor goes back to the login page — or the page they pressed the button on — with a reason.
A user with two-factor authentication (kitloom/two-factor) still types the code: the sign-in waits for it, the visitor is sent to the code page. A social sign-in is remembered, as the plugin does.
A signed-in user who presses a button links that account to themselves; an account linked to someone else is refused. One account per service per user. A deleted user's accounts are deleted with them.
For the theme
GET /auth/google?redirect=/account/ the button: off to Google, back to /account/
GET /auth/google/callback where Google sends the visitor back
DELETE /auth/google unlink from the signed-in user (JSON: {"unlinked": true})On a site in several languages (kitloom/languages) a button on a French page carries ?lang=fr: a visitor with no redirect comes back to the French front page, /fr/, and a refusal comes back there too.
The buttons, with their addresses — for the services that are on:
php
use Kitloom\SocialAccounts\Facades\SocialLogin;
SocialLogin::buttons('/account/');
// [['provider' => 'google', 'label' => 'Google', 'url' => '…/auth/google?redirect=%2Faccount%2F',
// 'linked' => null, 'unlinkUrl' => null], …] linked: true/false for a signed-in user[nextend_social_login] in content gives the theme the same buttons; provider="google,github" picks and orders them, redirect is where to come back to, heading, style and align are passed as written.
Every page also carries the part socialLogin (Kitloom\SocialAccounts\Site\SocialLoginPart): the same buttons, coming back to that page — for the theme's own sign-in form. The Vue themes here draw both: the shortcode in a page's text, the part under the sign-in form of the shop's account page (Pantry).
On the site's Account page (Settings → Reading, kitloom/site) a signed-in user has the section Linked accounts (?section=linked-accounts) while a service is on: the same buttons in its data, coming back to the section.
What went wrong comes back as ?social_error=:
| Reason | What happened |
|---|---|
denied | The visitor cancelled at the service, or the sign-in was not started in this browser |
failed | The service could not be asked: wrong keys, no connection (the error is logged) |
no_account | A new visitor, and registration is closed |
no_email | A new visitor whose service gave no verified address |
email_taken | A user has that address and it may not be linked by it: sign in with the password, then link the account |
linked_elsewhere | The account is linked to another user |
Where it is kept
| What | Where |
|---|---|
| Linked accounts | social_users, Nextend Social Login's table (the site's table prefix in front): ID the user, type google/github, identifier the account's id at the service, register_date, login_date, link_date. Accounts of services the module does not know (Facebook, X) stay in the table and are listed |
| Settings | wp_options: social_accounts_{google,github}_enabled, …_client_id, …_client_secret (encrypted), social_accounts_link_by_email, social_accounts_login_url |
| Model | Kitloom\SocialAccounts\Models\SocialAccount; an application swaps it with ModelRegistry::use(SocialAccount::KEY, …) |
Personal data
With kitloom/privacy, Tools → Export Personal Data lists the accounts linked to the user the address belongs to — the service, the account's id there, when it was linked, signed up with and last signed in with. Erase Personal Data unlinks them all: the rows go from social_users, as when the user is deleted. The user stays and signs in with their password; pressing a button again links the account anew.
Configuration
php artisan vendor:publish --tag=kitloom-social-accounts-config: routes turns the addresses off, shortcodes.register the shortcode, privacy.register the personal data export and erasure, filament.register and nova.register the admins' sections.
Tests
From the application that installs the package: php vendor/bin/phpunit --testsuite SocialAccounts.