Merge pull request #25 from bordoni/fix/unknown-email-creates-new-account

fix(auth): Per-form magic-code registration toggle with anti-enumeration [CONS-350]

Author: bordoni

CHANGELOG.md

@@ -17,6 +17,10 @@
   - 7 new activity-log event types: `email_change.initiated|confirmed|cancelled|expired|conflict_blocked|commit_failed|admin_bypass`.
   - 40 new WPUnit tests across 6 suites under `tests/wpunit/ChangeEmail*Test.php`.
   - See [`docs/change-email.md`](docs/change-email.md).
+- **Per-form magic-code registration toggles** ([CONS-350](https://linear.app/nexcess/issue/CONS-350)) (#25) — two independent per-environment checkboxes on the WorkOS settings page gate whether an unknown email signing in with a magic code provisions a new account.
+  - **Email Code Registration** controls the default sign-in form (`/login/`); **Legacy Email Code Registration** controls the legacy form (`/login/legacy/`). The legacy profile slug (`legacy` by default) is filterable via `workos_legacy_profile_slug` and resolved from the `$profile` that `BaseEndpoint::resolve_profile()` already produces.
+  - When a form's toggle is off, `POST /auth/magic/send` skips the WorkOS call for unknown addresses and still returns `200 ok: true`, and `POST /auth/magic/verify` early-returns a generic `400 workos_authkit_invalid_code` instead of proceeding to `LoginCompleter`/`UserSync` — closing the account-enumeration leak where `send` previously returned `404 workos_authkit_no_account`.
+  - New options `allow_magic_code_registration` and `allow_legacy_magic_code_registration` (both default `true`, preserving historical behavior). `render_checkbox()` now honors a `default` key so the boxes render checked before first save.
 
 ### Fixed
 

readme.txt

@@ -178,6 +178,7 @@ WorkOS is provided by WorkOS, Inc.
 = 1.0.6 - Unreleased =
 
 * New: WorkOS-verified change-email flow. Self-service `[workos:change-email]` shortcode + admin row action on `wp-admin/users.php` + panel on the user-edit screen. The new address must be confirmed via a hashed token emailed by the plugin (because WorkOS's `email_verification` endpoints can't verify a *pending* change); the old address simultaneously receives a one-click cancel link. Configurable conflict policy (`block` default, `allow_orphan`, `merge_request`) keeps the new email from silently overwriting another local WP user. Commits to WorkOS first (`update_user`) and then mirrors into WordPress, with a 60-second in-progress transient that short-circuits the webhook fan-back. Eight new filters, five new actions, seven new activity-log events, and 40 new WPUnit tests. See `docs/change-email.md`. (#22)
+* New: Per-form magic-code registration toggles. Two independent per-environment checkboxes — Email Code Registration (default sign-in form, `/login/`) and Legacy Email Code Registration (legacy `/login/legacy/` form) — gate whether an unknown email signing in with a magic code provisions a new account. When a form's toggle is off, `POST /auth/magic/send` silently skips the WorkOS call for unknown addresses and still returns `200 ok: true`, and `POST /auth/magic/verify` returns a generic `400 workos_authkit_invalid_code` instead of creating the user — closing the account-enumeration leak where the endpoint previously returned `404 workos_authkit_no_account`. Both toggles default on to preserve existing behavior. ([CONS-350](https://linear.app/nexcess/issue/CONS-350)) (#25)
 
 = 1.0.5 - 2026-05-18 =
 

src/WorkOS/Admin/Settings.php

@@ -678,6 +678,32 @@ static function (): void {
 			]
 		);
 
+		add_settings_field(
+			'workos_env_allow_magic_code_registration',
+			__( 'Email Code Registration', 'integration-workos' ),
+			[ $this, 'render_checkbox' ],
+			'workos',
+			'workos_auth',
+			[
+				'name'    => $this->env_option( 'allow_magic_code_registration' ),
+				'label'   => __( 'Allow creating a new account when someone signs in with an email code for an address that has no account. When off, unknown emails receive no code and no account is created.', 'integration-workos' ),
+				'default' => true,
+			]
+		);
+
+		add_settings_field(
+			'workos_env_allow_legacy_magic_code_registration',
+			__( 'Legacy Email Code Registration', 'integration-workos' ),
+			[ $this, 'render_checkbox' ],
+			'workos',
+			'workos_auth',
+			[
+				'name'    => $this->env_option( 'allow_legacy_magic_code_registration' ),
+				'label'   => __( 'Allow creating a new account when a legacy customer signs in with an email code for an address that has no account. When off, unknown emails receive no code and no account is created.', 'integration-workos' ),
+				'default' => true,
+			]
+		);
+
 		// --- Audit Logging section ---
 		add_settings_section(
 			'workos_audit',
@@ -1268,10 +1294,16 @@ public function render_select( array $args ): void {
 	/**
 	 * Render a checkbox.
 	 *
-	 * @param array $args Field arguments.
+	 * @param array $args {
+	 *     Field arguments.
+	 *
+	 *     @type string $name    Option name (supports `group[key]` syntax).
+	 *     @type string $label   Checkbox label.
+	 *     @type bool   $default Value shown when the option has never been saved. Defaults to false.
+	 * }
 	 */
 	public function render_checkbox( array $args ): void {
-		$value = $this->get_field_value( $args['name'], false );
+		$value = $this->get_field_value( $args['name'], $args['default'] ?? false );
 		printf(
 			'<input type="hidden" name="%s" value="0" />',
 			esc_attr( $args['name'] )
@@ -2037,7 +2069,7 @@ public function sanitize_environment_options( $input ): array {
 		}
 
 		// Boolean fields.
-		$bool_keys = [ 'allow_password_fallback', 'audit_logging_enabled', 'wp_password_fallback_email_confirmation' ];
+		$bool_keys = [ 'allow_password_fallback', 'audit_logging_enabled', 'wp_password_fallback_email_confirmation', 'allow_magic_code_registration', 'allow_legacy_magic_code_registration' ];
 		foreach ( $bool_keys as $key ) {
 			if ( isset( $input[ $key ] ) ) {
 				$sanitized[ $key ] = rest_sanitize_boolean( $input[ $key ] );

src/WorkOS/Options/Production.php

@@ -53,6 +53,8 @@ protected function defaults(): array {
 			'change_email_require_reauth'             => true,
 			'change_email_admin_bypass_verification'  => false,
 			'change_email_confirm_path'               => 'workos/change-email',
+			'allow_magic_code_registration'           => true,
+			'allow_legacy_magic_code_registration'    => true,
 		];
 	}
 }

src/WorkOS/Options/Staging.php

@@ -53,6 +53,8 @@ protected function defaults(): array {
 			'change_email_require_reauth'             => true,
 			'change_email_admin_bypass_verification'  => false,
 			'change_email_confirm_path'               => 'workos/change-email',
+			'allow_magic_code_registration'           => true,
+			'allow_legacy_magic_code_registration'    => true,
 		];
 	}
 }

src/WorkOS/REST/Auth/MagicCode.php

@@ -97,12 +97,17 @@ public function send( WP_REST_Request $request ) {
 			return $rate_ok;
 		}
 
-		// Fire-and-forget: return 200 regardless so the client cannot enumerate
-		// registered accounts. Real errors land in the plugin log.
-		workos()->api()->send_magic_auth_code(
-			$email,
-			$this->get_radar_token( $request )
-		);
+		// If email registration is disabled, only known accounts get a code.
+		// For unknown emails, skip the WorkOS call but still return success
+		// so account existence isn't exposed.
+		if ( $this->registration_allowed( $profile ) || get_user_by( 'email', $email ) ) {
+			// Fire-and-forget on the WorkOS call: delivery errors land in the
+			// plugin log rather than being surfaced to the client.
+			workos()->api()->send_magic_auth_code(
+				$email,
+				$this->get_radar_token( $request )
+			);
+		}
 
 		return new WP_REST_Response(
 			[
@@ -162,6 +167,18 @@ public function verify( WP_REST_Request $request ) {
 			return $rate_ok;
 		}
 
+		// Ensure verify never creates accounts when registration is disabled.
+		// `send` skips unknown emails; this prevents race conditions or direct
+		// API calls from provisioning users. Return a generic invalid-code error
+		// to avoid account enumeration.
+		if ( ! $this->registration_allowed( $profile ) && ! get_user_by( 'email', $email ) ) {
+			return new WP_Error(
+				'workos_authkit_invalid_code',
+				__( 'That code is invalid or has expired.', 'integration-workos' ),
+				[ 'status' => 400 ]
+			);
+		}
+
 		$workos_response = workos()->api()->authenticate_with_magic_auth(
 			$email,
 			$code,
@@ -184,4 +201,28 @@ public function verify( WP_REST_Request $request ) {
 
 		return new WP_REST_Response( $result, 200 );
 	}
+
+	/**
+	 * Whether email-code sign-in may create a new account for the given profile.
+	 *
+	 * Scoped per form: the legacy customer profile reads its own admin toggle
+	 * (`allow_legacy_magic_code_registration`) so it can be locked down without
+	 * affecting the default sign-in, which keeps creating accounts for new
+	 * customers (`allow_magic_code_registration`). Both default to true to
+	 * preserve historical behaviour. The legacy profile slug defaults to
+	 * `legacy` (matching the portal's /login/legacy/ form) and is filterable.
+	 *
+	 * @param Profile $profile Resolved login profile for the request.
+	 *
+	 * @return bool
+	 */
+	private function registration_allowed( Profile $profile ): bool {
+		$legacy_slug = (string) apply_filters( 'workos_legacy_profile_slug', 'legacy' );
+
+		$option = $profile->get_slug() === $legacy_slug
+			? 'allow_legacy_magic_code_registration' // Legacy form toggle.
+			: 'allow_magic_code_registration'; // Default form toggle.
+
+		return (bool) workos()->option( $option, true );
+	}
 }