Merge branch 'feature/authkit-custom-paths-shortcode' into main

Author: bordoni

AGENTS.md

@@ -100,7 +100,7 @@ Per-environment constants (take priority over generic):
 | `src/WorkOS/Auth/AuthKit/LoginCompleter.php` | Post-auth finalizer (EntitlementGate + MFA policy) |
 | `src/WorkOS/Auth/AuthKit/LoginTakeover.php` | wp-login.php `action=login` takeover |
 | `src/WorkOS/Auth/AuthKit/FrontendRoute.php` | `/workos/login/{profile}` rewrite + static `register_rewrite()` |
-| `src/WorkOS/Auth/AuthKit/Shortcode.php` | `[workos_login_v2]` shortcode |
+| `src/WorkOS/Auth/AuthKit/Shortcode.php` | `[workos:login]` shortcode |
 | `src/WorkOS/Auth/AuthKit/Renderer.php` | HTML shell + React bundle enqueue. Fires `workos_authkit_enqueue_assets` action and applies `workos_authkit_branding` / `workos_authkit_profile_data` / `workos_authkit_body_classes` filters — see `docs/extending-the-login-ui.md` |
 | `src/WorkOS/Auth/AuthKit/Nonce.php` | Profile-scoped CSRF nonces |
 | `src/WorkOS/Auth/AuthKit/RateLimiter.php` | Per-IP / per-email transient buckets |
@@ -114,8 +114,7 @@ Per-environment constants (take priority over generic):
 | `src/WorkOS/ActivityLog/EventLogger.php` | Logs WordPress events to local DB table |
 | `src/WorkOS/ActivityLog/AdminPage.php` | Activity log viewer in admin |
 | **UI (Login Button)** | |
-| `src/WorkOS/UI/Controller.php` | UI controller, registers shortcode/block/widget |
-| `src/WorkOS/UI/Shortcode.php` | `[workos_login]` shortcode |
+| `src/WorkOS/UI/Controller.php` | UI controller, registers block/widget |
 | `src/WorkOS/UI/Block.php` | Gutenberg block registration |
 | `src/WorkOS/UI/Widget.php` | Classic widget |
 | `src/WorkOS/UI/Renderer.php` | Shared login button renderer |

CHANGELOG.md

@@ -21,9 +21,8 @@ browser only ever talks to `/wp-json/workos/v1/auth/*`.
   `logout`, `register`, `lostpassword`, `resetpass`, `confirmaction`,
   `postpass`, `?fallback=1`, `?workos=0` still pass through to WP
   defaults.
-- **Entry points** — `[workos_login_v2]` shortcode, `workos/login-form`
-  block, and `/workos/login/{profile}` rewrite all render the same
-  shell.
+- **Entry points** — `[workos:login]` shortcode and
+  `/workos/login/{profile}` rewrite both render the same shell.
 - **Profile routing rules** — ordered `redirect_to` glob /
   `referrer_host` / `user_role` matchers pick which profile applies to
   a request; first match wins, falls back to the `default` profile.

README.md

@@ -10,7 +10,7 @@ Enterprise identity management for WordPress powered by [WorkOS](https://workos.
 
 ### Custom AuthKit (WordPress-hosted login)
 
-- **React login shell** on wp-login.php, `[workos_login_v2]` shortcode, `workos/login-form` block, and a dedicated `/workos/login/{profile}` route — all driven by the same TypeScript bundle
+- **React login shell** on wp-login.php, `[workos:login]` shortcode, and a dedicated `/workos/login/{profile}` route — all driven by the same TypeScript bundle
 - **Login Profiles** — admin-defined presets (enabled methods, pinned organization, signup/invite/reset toggles, MFA policy, branding) managed through a React admin editor at **WorkOS → Login Profiles**
 - **Sign-in methods**: email + password, magic code, social OAuth (Google, Microsoft, GitHub, Apple), passkey
 - **In-app flows**: self-serve sign-up with email verification, invitation acceptance, password reset
@@ -28,7 +28,7 @@ Enterprise identity management for WordPress powered by [WorkOS](https://workos.
 - **Entitlement Gate** — require organization membership to log in
 - **Webhook Processing** — real-time sync of user, organization, and directory events
 - **REST API Authentication** — Bearer token auth for headless/decoupled WordPress
-- **Legacy Login Button** — shortcode (`[workos_login]`), Gutenberg block, and classic widget (AuthKit-redirect flow)
+- **Legacy Login Button** — Gutenberg block and classic widget (AuthKit-redirect flow)
 - **Login Bypass** — access the native WordPress login form via `?fallback=1` when WorkOS is unavailable
 - **Activity Logging** — local database table with admin viewer for tracking authentication and sync events
 - **Audit Logging** — forward WordPress events (login, logout, post changes, user changes) to WorkOS Audit Logs
@@ -105,11 +105,11 @@ renders in its place. All other actions — `logout`, `register`,
 `?workos=0` — pass through to core WP so WooCommerce, WP-CLI password
 resets, and email confirmation links keep working.
 
-The shell also mounts on `[workos_login_v2 profile="slug"]`, a `workos/login-form`
-Gutenberg block, and the `/workos/login/{profile}` rewrite. Every mount
-reads configuration from `data-*` attributes emitted by `Auth\AuthKit\Renderer`
-and talks to `/wp-json/workos/v1/auth/*` for everything — no WorkOS calls
-are proxied through the browser.
+The shell also mounts on `[workos:login profile="slug"]` and the
+`/workos/login/{profile}` rewrite. Every mount reads configuration from
+`data-*` attributes emitted by `Auth\AuthKit\Renderer` and talks to
+`/wp-json/workos/v1/auth/*` for everything — no WorkOS calls are proxied
+through the browser.
 
 ### AuthKit-Redirect Mode (legacy)
 
@@ -761,7 +761,7 @@ src/WorkOS/
       LoginCompleter.php          # Shared post-auth finalizer (entitlement + MFA)
       LoginTakeover.php           # wp-login.php takeover (action=login only)
       FrontendRoute.php           # /workos/login/{profile} rewrite
-      Shortcode.php               # [workos_login_v2] shortcode
+      Shortcode.php               # [workos:login] shortcode
       Renderer.php                # HTML shell + bundle enqueue
       Nonce.php                   # Profile-scoped CSRF nonces
       RateLimiter.php             # Per-IP / per-email transient buckets

docs/extending-the-login-ui.md

@@ -6,7 +6,7 @@ The `integration-workos` plugin renders its login screen as a single-page React
 2. **`workos_authkit_enqueue_assets` action** — enqueue per-profile CSS and/or JavaScript files alongside the AuthKit bundle.
 3. **PHP filters** — last-mile mutation of the data the shell renders.
 
-The same surfaces are available everywhere the AuthKit shell appears: the wp-login.php takeover, the `[workos_login_v2]` shortcode, the `workos/login-form` block, and the `/workos/login/{slug}` rewrite.
+The same surfaces are available everywhere the AuthKit shell appears: the wp-login.php takeover, the `[workos:login]` shortcode, and the `/workos/login/{slug}` rewrite.
 
 ---
 

readme.txt

@@ -23,7 +23,7 @@ Integration with WorkOS connects your WordPress site with [WorkOS](https://worko
 
 = Custom AuthKit =
 
-* **WordPress-hosted React login** — no redirect to WorkOS for password, magic code, signup, invitation, or MFA. Mounts on wp-login.php, a shortcode (`[workos_login_v2]`), a Gutenberg block, and a dedicated `/workos/login/{profile}` route.
+* **WordPress-hosted React login** — no redirect to WorkOS for password, magic code, signup, invitation, or MFA. Mounts on wp-login.php, a shortcode (`[workos:login]`), and a dedicated `/workos/login/{profile}` route.
 * **Login Profiles** — admin-defined presets (enabled sign-in methods, pinned organization, signup/invite toggles, MFA policy, branding) edited from **WorkOS → Login Profiles**. The organization picker loads live from WorkOS so admins pick an org by name instead of pasting raw IDs.
 * **Sign-in methods** — email + password, magic code, social OAuth (Google, Microsoft, GitHub, Apple), and passkey. Each profile chooses its own subset.
 * **MFA** — TOTP, SMS, and WebAuthn/passkey with in-app enrollment + challenge. Profile-level `mfa.enforce` (`never`/`if_required`/`always`) and factor allowlist are applied at login time.
@@ -35,7 +35,7 @@ Integration with WorkOS connects your WordPress site with [WorkOS](https://worko
 
 * **Single Sign-On (SSO)** — legacy AuthKit redirect mode, per-profile selectable for SAML/OIDC connections.
 * **Headless mode** — intercept WordPress's `authenticate` filter for custom login forms.
-* **Legacy Login Button** — Shortcode (`[workos_login]`), Gutenberg block, and classic widget (AuthKit-redirect flow).
+* **Legacy Login Button** — Gutenberg block and classic widget (AuthKit-redirect flow).
 * **Login Bypass** — Access the native WordPress login form via `?fallback=1` when WorkOS is unavailable.
 * **Password Reset Integration** — Redirect password reset to WorkOS or fall back to WordPress.
 * **Registration Redirect** — Redirect registration to WorkOS AuthKit.
@@ -86,11 +86,11 @@ Yes, if "Password Fallback" is enabled in settings. Users can access the standar
 
 = How do I add a login button to my site? =
 
-Use the `[workos_login]` shortcode, add the "WorkOS Login" Gutenberg block, or use the "WorkOS Login" classic widget. All three render a styled login button that redirects to WorkOS AuthKit.
+Add the "WorkOS Login" Gutenberg block or use the "WorkOS Login" classic widget. Both render a styled login button that redirects to WorkOS AuthKit.
 
 = How do I show the new WordPress-hosted login (Custom AuthKit) on a page? =
 
-Use `[workos_login_v2 profile="your-profile-slug"]`, add the "WorkOS Login Form" block, or link to `/workos/login/{profile}`. All three mount the same React shell. The reserved `default` Login Profile automatically takes over wp-login.php.
+Use `[workos:login profile="your-profile-slug"]` or link to `/workos/login/{profile}`. Both mount the same React shell. The reserved `default` Login Profile automatically takes over wp-login.php.
 
 = Can different login pages offer different sign-in methods? =
 
@@ -169,7 +169,7 @@ WorkOS is provided by WorkOS, Inc.
 = 1.0.0 - 2026-04-23 =
 
 Custom AuthKit (WordPress-hosted login):
-* React login shell on wp-login.php, `[workos_login_v2]` shortcode, `workos/login-form` block, and `/workos/login/{profile}` route.
+* React login shell on wp-login.php, `[workos:login]` shortcode, and `/workos/login/{profile}` route.
 * Login Profiles — admin-defined presets for enabled methods, pinned organization, signup/invite/reset flows, MFA policy, and branding, managed at WorkOS → Login Profiles.
 * Pinned-organization picker in the Profile editor reads live from WorkOS (with a "Custom ID…" fallback for legacy or unlisted orgs), and the Profiles list renders organization names instead of raw IDs.
 * Sign-in methods: email + password, magic code, social OAuth (Google, Microsoft, GitHub, Apple), passkey.
@@ -189,7 +189,7 @@ Base platform:
 * Entitlement gate — require organization membership to log in.
 * Webhook processing for user, organization, directory, membership, and connection events.
 * REST API Bearer token authentication using WorkOS access tokens.
-* Legacy login button shortcode (`[workos_login]`), Gutenberg block, and classic widget.
+* Legacy login button Gutenberg block and classic widget (AuthKit-redirect flow).
 * Login bypass via `?fallback=1` for native WordPress login when WorkOS is unavailable.
 * Activity logging with local database table and admin viewer.
 * Audit logging — forward WordPress events to WorkOS Audit Logs.

src/WorkOS/Auth/AuthKit/ProfileRouter.php

@@ -28,7 +28,7 @@
  *
  * Note on missing profiles: `resolve()` always returns a usable Profile,
  * never null — a request for an unknown slug (`/workos/login/nonexistent`
- * or `[workos_login_v2 profile="typo"]`) falls through to the default
+ * or `[workos:login profile="typo"]`) falls through to the default
  * profile rather than 404ing. This is deliberate: the default profile's
  * existence is not a secret, and most mis-typed references are genuine
  * configuration mistakes that are easier to debug when the UI still

src/WorkOS/Auth/AuthKit/Renderer.php

@@ -15,7 +15,7 @@
  * Shared across every entry point that surfaces the AuthKit UI:
  *
  *  - wp-login.php takeover (full-page chrome we control ourselves)
- *  - `[workos_login]` shortcode / Gutenberg block (inline card)
+ *  - `[workos:login]` shortcode (inline card)
  *  - `/workos/login/{profile}` rewrite (full-bleed template)
  *  - Admin Profile Editor (via a different React bundle in Phase 5)
  *

src/WorkOS/Auth/AuthKit/Shortcode.php

@@ -1,6 +1,6 @@
 <?php
 /**
- * [workos_login] shortcode (Custom AuthKit).
+ * [workos:login] shortcode.
  *
  * @package WorkOS\Auth\AuthKit
  */
@@ -12,13 +12,12 @@
 /**
  * Renders the AuthKit React shell inline at the shortcode location.
  *
- * This is the Custom-AuthKit shortcode (a new, differentiated short tag
- * `[workos_login_v2]`) — the legacy `[workos_login]` shortcode keeps
- * behaving as it always did (button-to-AuthKit-redirect) for back-compat.
+ * The tag uses the `workos:` colon namespace so all plugin-provided
+ * shortcodes share a single, scannable prefix.
  */
 class Shortcode {
 
-	public const TAG = 'workos_login_v2';
+	public const TAG = 'workos:login';
 
 	/**
 	 * Profile router.

src/WorkOS/UI/Controller.php

@@ -1,6 +1,6 @@
 <?php
 /**
- * UI Controller — registers shortcode, widget, block, AJAX, and frontend assets.
+ * UI Controller — registers widget, block, AJAX, and frontend assets.
  *
  * @package WorkOS\UI
  */
@@ -22,9 +22,6 @@ class Controller extends BaseController {
 	 * @return void
 	 */
 	protected function doRegister(): void {
-		$this->container->singleton( Shortcode::class );
-		$this->container->get( Shortcode::class );
-
 		$this->container->singleton( Block::class );
 		$this->container->get( Block::class );
 
@@ -57,16 +54,15 @@ public function register_widget(): void {
 	/**
 	 * Conditionally enqueue frontend assets.
 	 *
-	 * Only loads CSS/JS when the login button is actually used on the page.
+	 * Only loads CSS/JS when the login button block or widget is on the page.
 	 */
 	public function maybe_enqueue_frontend_assets(): void {
 		global $post;
 
-		$has_shortcode = $post instanceof \WP_Post && has_shortcode( $post->post_content, 'workos_login' );
-		$has_block     = $post instanceof \WP_Post && has_block( 'workos/login-button', $post );
-		$has_widget    = is_active_widget( false, false, 'workos_login_button' );
+		$has_block  = $post instanceof \WP_Post && has_block( 'workos/login-button', $post );
+		$has_widget = is_active_widget( false, false, 'workos_login_button' );
 
-		if ( ! $has_shortcode && ! $has_block && ! $has_widget ) {
+		if ( ! $has_block && ! $has_widget ) {
 			return;
 		}