Add filter for Google auth error redirect

[sanketio]

What & why

Adds a filter, rtcamp.google_login_failed_redirect, so sites can control where a user lands when Google authentication fails. Currently Login::authenticate() hardcodes a WP_Error return on failure (src/Modules/Login.php), and WordPress re-renders wp-login.php with that error — there is no way to send the user to a custom/friendly error page.

Closes #173

Approach

In the catch ( Throwable $e ) block, after building the WP_Error, apply a new filter passing the default ('') and the WP_Error. If a consumer returns a non-empty string, it is run through wp_validate_redirect() (empty fallback); only when a validated URL survives do we wp_safe_redirect() there and exit. Otherwise the original WP_Error is returned. Fully backward-compatible — default behavior is unchanged, and invalid/off-site filter values fall through to the default error rather than silently redirecting to wp-admin.

add_filter( 'rtcamp.google_login_failed_redirect', function ( $redirect_to, $error ) {
    return home_url( '/login-error/' );
}, 10, 2 );

Testing

Run the added unit test and the module suite:

composer install
./vendor/bin/phpunit --filter testAuthenticationExceptionRedirectsWhenFilterReturnsUrl tests/php/Unit/Modules/LoginTest.php
./vendor/bin/phpunit tests/php/Unit/Modules/LoginTest.php
composer cs -- src/Modules/Login.php tests/php/Unit/Modules/LoginTest.php

• New test testAuthenticationExceptionRedirectsWhenFilterReturnsUrl passes (PHP 8.3 and 8.5)
• phpcs clean on changed files
• Default path unchanged — WP_Error still returned when no filter is set (testAuthenticationCapturesExceptions still green)
• Invalid/off-site filter value falls through to WP_Error instead of redirecting (via wp_validate_redirect)
• New filter documented in README.md
• Reviewer: confirm redirect fires end-to-end on a real failed Google login with a registered filter

Note: the pre-existing testInit failure (and the wider suite's Mockery alias: cross-contamination errors) exist on develop independent of this change — this PR does not touch init().

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds a new WordPress filter to allow redirecting users to a custom URL when Google authentication fails, instead of always returning a WP_Error and re-rendering wp-login.php.

Changes:

• Introduces rtcamp.google_login_failed_redirect filter in Login::authenticate() and performs a safe redirect when it returns a non-empty URL.
• Adds a unit test to verify redirect behavior when the filter returns a URL.
• Documents the new filter in README.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/Modules/Login.php	Applies new failed-login redirect filter and redirects on non-empty URL.
tests/php/Unit/Modules/LoginTest.php	Adds unit test asserting redirect occurs when filter returns a URL.
README.md	Documents the new filter and its parameters.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sanketio]

Thanks @copilot — went through all three:

1. Validate redirect URL before use (Login.php) — Addressed in a09ddd7. A junk/off-site value would otherwise make wp_safe_redirect() fall back to admin_url(), which is surprising for this filter. Now the value is run through wp_validate_redirect( $redirect_to, '' ) first, and we only redirect when the validated result is non-empty; otherwise it falls through to the default WP_Error.

2. Tighten the filter-arg assertion (LoginTest.php) — Partially. WP_Mock::onFilter()->with() matches arguments by exact serialized value (Mockery matchers don't apply there), and the WP_Error is constructed inside authenticate(), so the test has no reference to assert against. Kept withAnyArgs() for the filter; the contract is still exercised end-to-end (default path + redirect path).

3. Mockery::mock('WP_Error') (LoginTest.php) — Kept as-is. This mirrors the existing testAuthenticationCapturesExceptions in the same class; reworking the class-wide WP_Error stubbing is out of scope for this PR.