[batuhan]

What changed

• build the OAuth authorize URL with RFC 3986 query encoding
• preserve the complete query-bearing WordPress admin callback URI
• add a behavioral regression for the parsed redirect_uri
• release the plugin as 0.3.2

Root cause

WordPress add_query_arg() leaves newly supplied values unencoded. The plugin passed a callback URL containing its own &spacefast_oauth=callback parameter, which became a top-level authorize parameter. Spacefast therefore received a redirect_uri that did not exactly match the dynamically registered callback.

Validation

• ./bin/test.sh
• ./bin/test-wordpress.sh

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Fixed Spacefast authorization links so callback URLs containing query parameters are preserved correctly.
  • Improved URL handling to prevent callback details from being misinterpreted as separate authorization parameters.

• Release

  • Updated the plugin to version 0.3.2.
  • Added changelog information describing the callback URL preservation fix.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 92b42904-9b2e-4e57-8e70-55626cdd99f5

📥 Commits

Reviewing files that changed from the base of the PR and between 699bde1 and 7ca48db.

📒 Files selected for processing (5)

• includes/class-spacefast-oauth.php
• readme.txt
• spacefast-wordpress.php
• tests/acceptance/wordpress.php
• tests/behavior.php

---

📝 Walkthrough

Walkthrough

The OAuth authorization URL now preserves nested callback query parameters. Tests verify the complete callback URL. Plugin metadata, changelog content, and acceptance tests are updated for version 0.3.2.

Changes

OAuth callback preservation

Layer / File(s)	Summary
Preserve callback query parameters includes/class-spacefast-oauth.php, tests/behavior.php	OAuth URL construction now uses RFC 3986 encoding. Behavior tests verify that redirect_uri retains the complete callback URL.
Update release version spacefast-wordpress.php, readme.txt, tests/acceptance/wordpress.php	Plugin metadata and the stable tag use version 0.3.2. The changelog and acceptance assertion reflect the new version.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• spacefast/wordpress#1: Directly modifies OAuth URL behavior and callback query encoding.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: fixing OAuth callback URI encoding.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch batuhan/fix-oauth-callback-uri

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}