-
-
-
-
-
@@ -796,4 +848,53 @@ public function get_user_saved_payment_methods() {
return [];
}
}
+
+ /**
+ * Get OAuth connection status HTML.
+ *
+ * Displays either the connected status with account ID and disconnect button,
+ * or a "Connect with Stripe" button for new connections.
+ *
+ * @since 2.x.x
+ * @return string HTML content for the OAuth connection status
+ */
+ protected function get_oauth_connection_html(): string {
+ $is_oauth = $this->is_using_oauth();
+ $account_id = $this->oauth_account_id;
+
+ if ($is_oauth && ! empty($account_id)) {
+ // Connected state
+ return sprintf(
+ '
+
+
+ %s
+
+
%s %s
+
%s
+
',
+ esc_html__('Connected via Stripe Connect', 'ultimate-multisite'),
+ esc_html__('Account ID:', 'ultimate-multisite'),
+ esc_html($account_id),
+ esc_url($this->get_disconnect_url()),
+ esc_html__('Disconnect', 'ultimate-multisite')
+ );
+ }
+
+ // Disconnected state - show connect button
+ return sprintf(
+ '
',
+ esc_html__('Connect your Stripe account with one click.', 'ultimate-multisite'),
+ esc_url($this->get_oauth_init_url()),
+ esc_html__('Connect with Stripe', 'ultimate-multisite'),
+ esc_html__('You will be redirected to Stripe to securely authorize the connection.', 'ultimate-multisite')
+ );
+ }
}
diff --git a/inc/managers/class-gateway-manager.php b/inc/managers/class-gateway-manager.php
index ab199a5d..61244408 100644
--- a/inc/managers/class-gateway-manager.php
+++ b/inc/managers/class-gateway-manager.php
@@ -112,6 +112,22 @@ function () {
* Waits for webhook signals and deal with them.
*/
add_action('admin_init', [$this, 'maybe_process_v1_webhooks'], 21);
+
+ /*
+ * AJAX endpoint for payment status polling (fallback for webhooks).
+ */
+ add_action('wp_ajax_wu_check_payment_status', [$this, 'ajax_check_payment_status']);
+ add_action('wp_ajax_nopriv_wu_check_payment_status', [$this, 'ajax_check_payment_status']);
+
+ /*
+ * Action Scheduler handler for payment verification fallback.
+ */
+ add_action('wu_verify_stripe_payment', [$this, 'handle_scheduled_payment_verification']);
+
+ /*
+ * Schedule payment verification after checkout.
+ */
+ add_action('wu_checkout_done', [$this, 'maybe_schedule_payment_verification'], 10, 5);
}
/**
@@ -567,4 +583,193 @@ public function get_auto_renewable_gateways() {
return (array) $this->auto_renewable_gateways;
}
+
+ /**
+ * AJAX handler for checking payment status.
+ *
+ * This is used by the thank you page to poll for payment completion
+ * when webhooks might be delayed or not working.
+ *
+ * @since 2.x.x
+ * @return void
+ */
+ public function ajax_check_payment_status(): void {
+
+ $payment_hash = wu_request('payment_hash');
+
+ if (empty($payment_hash)) {
+ wp_send_json_error(['message' => __('Payment hash is required.', 'ultimate-multisite')]);
+ }
+
+ $payment = wu_get_payment_by_hash($payment_hash);
+
+ if (! $payment) {
+ wp_send_json_error(['message' => __('Payment not found.', 'ultimate-multisite')]);
+ }
+
+ // If already completed, return success
+ if ($payment->get_status() === \WP_Ultimo\Database\Payments\Payment_Status::COMPLETED) {
+ wp_send_json_success(
+ [
+ 'status' => 'completed',
+ 'message' => __('Payment completed.', 'ultimate-multisite'),
+ ]
+ );
+ }
+
+ // Only try to verify Stripe payments
+ $gateway_id = $payment->get_gateway();
+
+ if (empty($gateway_id)) {
+ // Check membership gateway as fallback
+ $membership = $payment->get_membership();
+ $gateway_id = $membership ? $membership->get_gateway() : '';
+ }
+
+ if (! in_array($gateway_id, ['stripe', 'stripe-checkout'], true)) {
+ wp_send_json_success(
+ [
+ 'status' => $payment->get_status(),
+ 'message' => __('Non-Stripe payment, cannot verify.', 'ultimate-multisite'),
+ ]
+ );
+ }
+
+ // Get the gateway instance and verify
+ $gateway = $this->get_gateway($gateway_id);
+
+ if (! $gateway || ! method_exists($gateway, 'verify_and_complete_payment')) {
+ wp_send_json_success(
+ [
+ 'status' => $payment->get_status(),
+ 'message' => __('Gateway does not support verification.', 'ultimate-multisite'),
+ ]
+ );
+ }
+
+ $result = $gateway->verify_and_complete_payment($payment->get_id());
+
+ if ($result['success']) {
+ wp_send_json_success(
+ [
+ 'status' => $result['status'] ?? 'completed',
+ 'message' => $result['message'],
+ ]
+ );
+ } else {
+ wp_send_json_success(
+ [
+ 'status' => $result['status'] ?? 'pending',
+ 'message' => $result['message'],
+ ]
+ );
+ }
+ }
+
+ /**
+ * Handle scheduled payment verification from Action Scheduler.
+ *
+ * @since 2.x.x
+ *
+ * @param int $payment_id The payment ID to verify.
+ * @param string $gateway_id The gateway ID.
+ * @return void
+ */
+ public function handle_scheduled_payment_verification($payment_id, $gateway_id = ''): void {
+
+ // Support both old (single arg) and new (array) formats
+ if (is_array($payment_id)) {
+ $gateway_id = $payment_id['gateway_id'] ?? '';
+ $payment_id = $payment_id['payment_id'] ?? 0;
+ }
+
+ if (empty($payment_id)) {
+ wu_log_add('stripe', 'Scheduled payment verification: No payment ID provided', LogLevel::WARNING);
+ return;
+ }
+
+ $payment = wu_get_payment($payment_id);
+
+ if (! $payment) {
+ wu_log_add('stripe', sprintf('Scheduled payment verification: Payment %d not found', $payment_id), LogLevel::WARNING);
+ return;
+ }
+
+ // Already completed - nothing to do
+ if ($payment->get_status() === \WP_Ultimo\Database\Payments\Payment_Status::COMPLETED) {
+ wu_log_add('stripe', sprintf('Scheduled payment verification: Payment %d already completed', $payment_id));
+ return;
+ }
+
+ // Determine gateway if not provided
+ if (empty($gateway_id)) {
+ $gateway_id = $payment->get_gateway();
+
+ if (empty($gateway_id)) {
+ $membership = $payment->get_membership();
+ $gateway_id = $membership ? $membership->get_gateway() : '';
+ }
+ }
+
+ if (! in_array($gateway_id, ['stripe', 'stripe-checkout'], true)) {
+ wu_log_add('stripe', sprintf('Scheduled payment verification: Payment %d is not a Stripe payment', $payment_id));
+ return;
+ }
+
+ $gateway = $this->get_gateway($gateway_id);
+
+ if (! $gateway || ! method_exists($gateway, 'verify_and_complete_payment')) {
+ wu_log_add('stripe', sprintf('Scheduled payment verification: Gateway %s not found or does not support verification', $gateway_id), LogLevel::WARNING);
+ return;
+ }
+
+ $result = $gateway->verify_and_complete_payment($payment_id);
+
+ wu_log_add(
+ 'stripe',
+ sprintf(
+ 'Scheduled payment verification for payment %d: %s - %s',
+ $payment_id,
+ $result['success'] ? 'SUCCESS' : 'PENDING',
+ $result['message']
+ )
+ );
+ }
+
+ /**
+ * Schedule payment verification after checkout for Stripe payments.
+ *
+ * @since 2.x.x
+ *
+ * @param \WP_Ultimo\Models\Payment $payment The payment object.
+ * @param \WP_Ultimo\Models\Membership $membership The membership object.
+ * @param \WP_Ultimo\Models\Customer $customer The customer object.
+ * @param \WP_Ultimo\Checkout\Cart $cart The cart object.
+ * @param string $type The checkout type.
+ * @return void
+ */
+ public function maybe_schedule_payment_verification($payment, $membership, $customer, $cart, $type): void {
+
+ // Only schedule for pending payments with Stripe
+ if (! $payment || $payment->get_status() === \WP_Ultimo\Database\Payments\Payment_Status::COMPLETED) {
+ return;
+ }
+
+ $gateway_id = $membership ? $membership->get_gateway() : '';
+
+ if (! in_array($gateway_id, ['stripe', 'stripe-checkout'], true)) {
+ return;
+ }
+
+ $gateway = $this->get_gateway($gateway_id);
+
+ if (! $gateway || ! method_exists($gateway, 'schedule_payment_verification')) {
+ return;
+ }
+
+ // Schedule verification in 30 seconds
+ $gateway->schedule_payment_verification($payment->get_id(), 30);
+
+ wu_log_add('stripe', sprintf('Scheduled payment verification for payment %d in 30 seconds', $payment->get_id()));
+ }
}
diff --git a/tests/WP_Ultimo/Gateways/Stripe_OAuth_E2E_Test.php b/tests/WP_Ultimo/Gateways/Stripe_OAuth_E2E_Test.php
new file mode 100644
index 00000000..c219a1b6
--- /dev/null
+++ b/tests/WP_Ultimo/Gateways/Stripe_OAuth_E2E_Test.php
@@ -0,0 +1,143 @@
+clear_all_stripe_settings();
+ }
+
+ /**
+ * Test that OAuth tokens are correctly saved from simulated callback.
+ */
+ public function test_oauth_tokens_saved_correctly() {
+ // Manually simulate what the OAuth callback does
+ wu_save_setting('stripe_test_access_token', 'sk_test_oauth_abc123');
+ wu_save_setting('stripe_test_account_id', 'acct_test_xyz789');
+ wu_save_setting('stripe_test_publishable_key', 'pk_test_oauth_abc123');
+ wu_save_setting('stripe_test_refresh_token', 'rt_test_refresh_abc123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ // Initialize gateway
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ // Verify OAuth mode is detected
+ $this->assertTrue($gateway->is_using_oauth());
+ $this->assertEquals('oauth', $gateway->get_authentication_mode());
+
+ // Verify account ID is loaded
+ $reflection = new \ReflectionClass($gateway);
+ $property = $reflection->getProperty('oauth_account_id');
+ $property->setAccessible(true);
+ $this->assertEquals('acct_test_xyz789', $property->getValue($gateway));
+ }
+
+ /**
+ * Test that Stripe client is configured with account header in OAuth mode.
+ */
+ public function test_stripe_client_has_account_header_in_oauth_mode() {
+ // Setup OAuth mode
+ wu_save_setting('stripe_test_access_token', 'sk_test_oauth_token_123');
+ wu_save_setting('stripe_test_account_id', 'acct_oauth_123');
+ wu_save_setting('stripe_test_publishable_key', 'pk_test_oauth_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ $this->assertTrue($gateway->is_using_oauth());
+
+ // Access oauth_account_id via reflection
+ $reflection = new \ReflectionClass($gateway);
+ $property = $reflection->getProperty('oauth_account_id');
+ $property->setAccessible(true);
+
+ // Verify account ID is set
+ $this->assertEquals('acct_oauth_123', $property->getValue($gateway));
+ }
+
+ /**
+ * Test the complete OAuth setup flow.
+ */
+ public function test_complete_oauth_flow_simulation() {
+ // Step 1: Start with no configuration
+ $this->clear_all_stripe_settings();
+
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ // Step 2: User clicks "Connect with Stripe" and OAuth completes
+ // (Simulating what happens after successful OAuth callback)
+ wu_save_setting('stripe_test_access_token', 'sk_test_connected_abc');
+ wu_save_setting('stripe_test_account_id', 'acct_connected_xyz');
+ wu_save_setting('stripe_test_publishable_key', 'pk_test_connected_abc');
+ wu_save_setting('stripe_test_refresh_token', 'rt_test_refresh_abc');
+
+ // Step 3: Gateway initializes and detects OAuth
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ // Verify OAuth mode
+ $this->assertTrue($gateway->is_using_oauth());
+ $this->assertEquals('oauth', $gateway->get_authentication_mode());
+
+ // Verify account ID is loaded
+ $reflection = new \ReflectionClass($gateway);
+ $account_property = $reflection->getProperty('oauth_account_id');
+ $account_property->setAccessible(true);
+ $this->assertEquals('acct_connected_xyz', $account_property->getValue($gateway));
+
+ // Step 4: Verify direct keys would still work if OAuth disconnected
+ wu_save_setting('stripe_test_access_token', ''); // Clear OAuth
+ wu_save_setting('stripe_test_pk_key', 'pk_test_direct_fallback');
+ wu_save_setting('stripe_test_sk_key', 'sk_test_direct_fallback');
+
+ $gateway2 = new Stripe_Gateway();
+ $gateway2->init();
+
+ // Should fall back to direct mode
+ $this->assertFalse($gateway2->is_using_oauth());
+ $this->assertEquals('direct', $gateway2->get_authentication_mode());
+ }
+
+ /**
+ * Clear all Stripe settings.
+ */
+ private function clear_all_stripe_settings() {
+ wu_save_setting('stripe_test_access_token', '');
+ wu_save_setting('stripe_test_account_id', '');
+ wu_save_setting('stripe_test_publishable_key', '');
+ wu_save_setting('stripe_test_refresh_token', '');
+ wu_save_setting('stripe_live_access_token', '');
+ wu_save_setting('stripe_live_account_id', '');
+ wu_save_setting('stripe_live_publishable_key', '');
+ wu_save_setting('stripe_live_refresh_token', '');
+ wu_save_setting('stripe_test_pk_key', '');
+ wu_save_setting('stripe_test_sk_key', '');
+ wu_save_setting('stripe_live_pk_key', '');
+ wu_save_setting('stripe_live_sk_key', '');
+ // Note: Platform credentials are now configured via constants/filters, not settings
+ }
+}
diff --git a/tests/WP_Ultimo/Gateways/Stripe_OAuth_Test.php b/tests/WP_Ultimo/Gateways/Stripe_OAuth_Test.php
new file mode 100644
index 00000000..e1253449
--- /dev/null
+++ b/tests/WP_Ultimo/Gateways/Stripe_OAuth_Test.php
@@ -0,0 +1,298 @@
+gateway = new Stripe_Gateway();
+ }
+
+ /**
+ * Test authentication mode detection - OAuth mode.
+ */
+ public function test_oauth_mode_detection() {
+ // Set OAuth token
+ wu_save_setting('stripe_test_access_token', 'sk_test_oauth_token_123');
+ wu_save_setting('stripe_test_account_id', 'acct_123');
+ wu_save_setting('stripe_test_publishable_key', 'pk_test_oauth_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ $this->assertEquals('oauth', $gateway->get_authentication_mode());
+ $this->assertTrue($gateway->is_using_oauth());
+ }
+
+ /**
+ * Test authentication mode detection - direct mode.
+ */
+ public function test_direct_mode_detection() {
+ // Only set direct API keys
+ wu_save_setting('stripe_test_pk_key', 'pk_test_direct_123');
+ wu_save_setting('stripe_test_sk_key', 'sk_test_direct_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ $this->assertEquals('direct', $gateway->get_authentication_mode());
+ $this->assertFalse($gateway->is_using_oauth());
+ }
+
+ /**
+ * Test OAuth takes precedence over direct API keys.
+ */
+ public function test_oauth_precedence_over_direct() {
+ // Set both OAuth and direct keys
+ wu_save_setting('stripe_test_access_token', 'sk_test_oauth_token_123');
+ wu_save_setting('stripe_test_account_id', 'acct_123');
+ wu_save_setting('stripe_test_publishable_key', 'pk_test_oauth_123');
+ wu_save_setting('stripe_test_pk_key', 'pk_test_direct_123');
+ wu_save_setting('stripe_test_sk_key', 'sk_test_direct_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ // OAuth should take precedence
+ $this->assertEquals('oauth', $gateway->get_authentication_mode());
+ $this->assertTrue($gateway->is_using_oauth());
+ }
+
+ /**
+ * Test OAuth authorization URL generation via proxy.
+ */
+ public function test_oauth_authorization_url_generation() {
+ // Mock proxy response
+ add_filter('pre_http_request', function($preempt, $args, $url) {
+ if (strpos($url, '/oauth/init') !== false) {
+ return [
+ 'response' => ['code' => 200],
+ 'body' => wp_json_encode([
+ 'oauthUrl' => 'https://connect.stripe.com/oauth/authorize?client_id=ca_test123&state=encrypted_state&scope=read_write',
+ 'state' => 'test_state_123',
+ ]),
+ ];
+ }
+ return $preempt;
+ }, 10, 3);
+
+ $gateway = new Stripe_Gateway();
+ $url = $gateway->get_connect_authorization_url('');
+
+ $this->assertStringContainsString('connect.stripe.com/oauth/authorize', $url);
+ $this->assertStringContainsString('client_id=ca_test123', $url);
+ $this->assertStringContainsString('scope=read_write', $url);
+
+ // Verify state was stored
+ $this->assertEquals('test_state_123', get_option('wu_stripe_oauth_state'));
+ }
+
+ /**
+ * Test OAuth authorization URL returns empty on proxy failure.
+ */
+ public function test_oauth_authorization_url_requires_client_id() {
+ // Mock proxy returning error or invalid response
+ add_filter('pre_http_request', function($preempt, $args, $url) {
+ if (strpos($url, '/oauth/init') !== false) {
+ return new \WP_Error('http_request_failed', 'Connection failed');
+ }
+ return $preempt;
+ }, 10, 3);
+
+ $gateway = new Stripe_Gateway();
+ $url = $gateway->get_connect_authorization_url('');
+
+ $this->assertEmpty($url);
+ }
+
+ /**
+ * Test backwards compatibility with existing API keys.
+ */
+ public function test_backwards_compatibility_with_existing_keys() {
+ // Simulate existing installation with direct API keys
+ wu_save_setting('stripe_test_pk_key', 'pk_test_existing_123');
+ wu_save_setting('stripe_test_sk_key', 'sk_test_existing_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ // Should work in direct mode
+ $this->assertEquals('direct', $gateway->get_authentication_mode());
+ $this->assertFalse($gateway->is_using_oauth());
+
+ // Verify API keys are loaded
+ $reflection = new \ReflectionClass($gateway);
+ $secret_property = $reflection->getProperty('secret_key');
+ $secret_property->setAccessible(true);
+
+ $this->assertEquals('sk_test_existing_123', $secret_property->getValue($gateway));
+ }
+
+ /**
+ * Test OAuth account ID is loaded in OAuth mode.
+ */
+ public function test_oauth_account_id_loaded() {
+ wu_save_setting('stripe_test_access_token', 'sk_test_oauth_token_123');
+ wu_save_setting('stripe_test_account_id', 'acct_test123');
+ wu_save_setting('stripe_test_publishable_key', 'pk_test_oauth_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ $this->assertTrue($gateway->is_using_oauth());
+
+ // Verify account ID is loaded
+ $reflection = new \ReflectionClass($gateway);
+ $property = $reflection->getProperty('oauth_account_id');
+ $property->setAccessible(true);
+
+ $this->assertEquals('acct_test123', $property->getValue($gateway));
+ }
+
+ /**
+ * Test OAuth account ID is not loaded in direct mode.
+ */
+ public function test_oauth_account_id_not_loaded_for_direct() {
+ wu_save_setting('stripe_test_pk_key', 'pk_test_direct_123');
+ wu_save_setting('stripe_test_sk_key', 'sk_test_direct_123');
+ wu_save_setting('stripe_sandbox_mode', 1);
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ $this->assertFalse($gateway->is_using_oauth());
+
+ // Verify account ID is empty
+ $reflection = new \ReflectionClass($gateway);
+ $property = $reflection->getProperty('oauth_account_id');
+ $property->setAccessible(true);
+
+ $this->assertEmpty($property->getValue($gateway));
+ }
+
+ /**
+ * Test disconnect settings are cleared manually (without redirect).
+ */
+ public function test_disconnect_settings_cleared() {
+ $id = 'stripe';
+
+ // Set OAuth tokens for both test and live mode
+ wu_save_setting("{$id}_test_access_token", 'sk_test_oauth_token_123');
+ wu_save_setting("{$id}_test_account_id", 'acct_test123');
+ wu_save_setting("{$id}_test_publishable_key", 'pk_test_oauth_123');
+ wu_save_setting("{$id}_test_refresh_token", 'rt_test_123');
+ wu_save_setting("{$id}_live_access_token", 'sk_live_oauth_token_123');
+ wu_save_setting("{$id}_live_account_id", 'acct_live123');
+ wu_save_setting("{$id}_live_publishable_key", 'pk_live_oauth_123');
+ wu_save_setting("{$id}_live_refresh_token", 'rt_live_123');
+
+ // Manually clear settings (simulating disconnect without the redirect)
+ wu_save_setting("{$id}_test_access_token", '');
+ wu_save_setting("{$id}_test_refresh_token", '');
+ wu_save_setting("{$id}_test_account_id", '');
+ wu_save_setting("{$id}_test_publishable_key", '');
+ wu_save_setting("{$id}_live_access_token", '');
+ wu_save_setting("{$id}_live_refresh_token", '');
+ wu_save_setting("{$id}_live_account_id", '');
+ wu_save_setting("{$id}_live_publishable_key", '');
+
+ // Verify all OAuth tokens are cleared
+ $this->assertEmpty(wu_get_setting("{$id}_test_access_token", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_test_account_id", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_test_publishable_key", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_test_refresh_token", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_live_access_token", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_live_account_id", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_live_publishable_key", ''));
+ $this->assertEmpty(wu_get_setting("{$id}_live_refresh_token", ''));
+ }
+
+ /**
+ * Test direct API keys are independent from OAuth tokens.
+ */
+ public function test_direct_keys_independent() {
+ // Set both OAuth tokens and direct keys
+ wu_save_setting('stripe_test_access_token', 'sk_test_oauth_token_123');
+ wu_save_setting('stripe_test_pk_key', 'pk_test_direct_123');
+ wu_save_setting('stripe_test_sk_key', 'sk_test_direct_123');
+
+ // Clearing OAuth tokens shouldn't affect direct keys
+ wu_save_setting('stripe_test_access_token', '');
+
+ // Verify direct API keys are still present
+ $this->assertEquals('pk_test_direct_123', wu_get_setting('stripe_test_pk_key'));
+ $this->assertEquals('sk_test_direct_123', wu_get_setting('stripe_test_sk_key'));
+ }
+
+ /**
+ * Test live mode OAuth detection.
+ */
+ public function test_live_mode_oauth_detection() {
+ // Set live mode OAuth tokens
+ wu_save_setting('stripe_live_access_token', 'sk_live_oauth_token_123');
+ wu_save_setting('stripe_live_account_id', 'acct_live123');
+ wu_save_setting('stripe_live_publishable_key', 'pk_live_oauth_123');
+ wu_save_setting('stripe_sandbox_mode', 0); // Live mode
+
+ $gateway = new Stripe_Gateway();
+ $gateway->init();
+
+ $this->assertEquals('oauth', $gateway->get_authentication_mode());
+ $this->assertTrue($gateway->is_using_oauth());
+ }
+
+ /**
+ * Test disconnect URL has proper nonce.
+ */
+ public function test_disconnect_url_has_nonce() {
+ $gateway = new Stripe_Gateway();
+
+ $reflection = new \ReflectionClass($gateway);
+ $method = $reflection->getMethod('get_disconnect_url');
+ $method->setAccessible(true);
+
+ $url = $method->invoke($gateway);
+
+ $this->assertStringContainsString('stripe_disconnect=1', $url);
+ $this->assertStringContainsString('_wpnonce=', $url);
+ $this->assertStringContainsString('page=wu-settings', $url);
+ $this->assertStringContainsString('tab=payment-gateways', $url);
+ }
+}