Fix #644: Expose existing 2FA revalidation flow to third-party plugins via action hook

[chetanupare]

What?

Introduces the two_factor_revalidate_session action hook which allows developers to programmatically trigger a 2FA re-authentication check.

Fixes #644

Why?

There are cases where other plugins or custom site logic need to verify that an authenticated user has recently passed a 2FA check before allowing them to perform a sensitive action (such as accessing a billing portal or publishing a high-profile post). This PR exposes the core plugin's existing re-authentication flow through a standardized, easy-to-use action hook.

How?

1. Added the action_revalidate_session( $time_window, $redirect_to ) method to Two_Factor_Core.
2. Hooked the method into a new two_factor_revalidate_session action hook.
3. The method checks is_current_user_session_two_factor() against the provided time window (defaulting to 5 minutes).
4. If the last 2FA verification is missing or older than the time window, the user is safely redirected to the plugin's revalidate_2fa screen.
5. Added PHPUnit tests to cover both the recent-session bypass and the old-session redirect flows.

Use of AI Tools

AI Assistance: No

Testing Instructions

1. Ensure your user account has a 2FA method properly configured and enabled in your profile.
2. Add a temporary testing script to your site (e.g., in mu-plugins or functions.php) to intercept the post editor:
   add_action( 'admin_init', function() { global $pagenow; if ( $pagenow === 'post.php' || $pagenow === 'post-new.php' ) { // Force re-auth if the 2FA session is older than 60 seconds do_action( 'two_factor_revalidate_session', 60 ); } } );
3. Log into the site via 2FA.
4. Immediately navigate to Posts > Add New. You should be granted access normally.
5. Wait for 60 seconds.
6. Refresh the "Add New Post" page or attempt to edit an existing post.
7. You should be intercepted and prompted with the 2FA re-authentication screen.
8. Validate your 2FA credential. Upon success, you should be safely redirected back to the post editor.

Changelog Entry

Added - two_factor_revalidate_session action hook to allow third-party code to trigger a 2FA revalidation flow for an existing user session.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: chetanupare <chetanupare@git.wordpress.org>
Co-authored-by: dd32 <dd32@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR exposes the plugin’s existing “revalidate 2FA session” login flow to third-party code by introducing a public action hook that can enforce a “recent 2FA” requirement before sensitive operations.

Changes:

• Adds a new two_factor_revalidate_session action hook wired to Two_Factor_Core::action_revalidate_session().
• Implements the revalidation check and redirects to the existing revalidate_2fa screen when the 2FA session is outside a caller-provided time window.
• Adds PHPUnit coverage for “redirect when stale” and “bypass when recent” scenarios.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
class-two-factor-core.php	Registers the new action hook and implements action_revalidate_session() to enforce a recent 2FA session via redirect to the existing revalidate flow.
tests/class-two-factor-core.php	Adds unit tests covering redirect vs. bypass behavior for the new revalidation action.

Comments suppressed due to low confidence (1)

tests/class-two-factor-core.php:2751

• update_current_user_session() depends on an auth cookie session token; without setting wp_set_auth_cookie( $user_id ) this test will always see is_current_user_session_two_factor() return false and will incorrectly redirect even for a recent session.

		$user_id = self::factory()->user->create();
		wp_set_current_user( $user_id );
		update_user_meta( $user_id, Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY, array( 'Two_Factor_Dummy' ) );

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chetanupare]

Hi @masteradhoc ,
I've pushed the fixes suggested by Copilot. The double URL encoding and time boundary issues are resolved, and I've also updated the tests to handle auth cookies and redirects properly. Please take a look!