Verbum Comments: enable social login inside the iframe via Storage Access API

[arcangelini]

Proposed changes

Follow-up to #50396 (the minimal dead-end fix). This actually enables WordPress.com / Facebook social login inside the cross-origin Verbum comment iframe on Atomic/Jetpack sites.

Verbum runs in a third-party iframe (jetpack.wordpress.com) embedded in the site's own domain, so it can't read/write the .wordpress.com auth cookies — which is why social login was suppressed. This uses the Storage Access API to restore first-party cookie access:

• useSocialLogin: on the login-button gesture (iframe only), call document.requestStorageAccess() before opening the login popup.
• logged-out: render the social buttons in the iframe even when the cookie test currently fails, so there's a button to click; the top-level login-link fallback now only applies outside the iframe.
• state: userLoggedIn also flips on a fresh access_token (delivered by the login popup via postMessage), so the UI reflects login even before cookies become readable.

Graceful degradation: where Storage Access is denied/unsupported, the popup + postMessage flow still authenticates for the current session and the comment POST (a top-level navigation) still carries the credential — only cross-reload persistence is lost.

Related product discussion/links

• n/a

Does this pull request change what data or activity we track or use?

No. It requests browser storage access to read existing first-party auth cookies; no new data is collected.

Testing instructions

Stacked on #50396 — review/merge that first.

1. On an Atomic (WoA) site, open a post as a logged-out visitor.
2. Before: no WordPress.com/Facebook login options render in the comment form.
3. After: the WordPress.com and Facebook buttons render. Click one → (browser may prompt to allow access) → the login popup completes → the form reflects the logged-in user, and you can post a comment.
4. Verify with comment_registration both on and off.
5. Test across Safari, Chrome, Firefox — behavior differs by third-party-cookie policy. Confirm that when access is denied, login still works for the current session (posting succeeds) and there's no dead end.
6. Confirm Simple sites (first-party, non-iframe) are unchanged.

Known items to verify

• Gesture/popup-blocker interaction: requestStorageAccess() and window.open() both need the user gesture — confirm the popup isn't blocked; reorder if needed.
• Safari grants storage access only after a recent first-party interaction with wordpress.com, so persistence there is best-effort.

[github-actions]

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

• To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (WordPress.com Site Helper), and enable the verbum/iframe-social-login-storage-access branch.
• To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack-mu-wpcom-plugin verbum/iframe-social-login-storage-access

Interested in more tips and information?

• In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
• Read more about our development workflow here: PCYsg-eg0-p2
• Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• 🔴 Add a "[Status]" label (In Progress, Needs Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

Follow this PR Review Process:

1. Ensure all required checks appearing at the bottom of this PR are passing.
2. Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
3. You can use GitHub's Reviewers functionality to request a review.
4. When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

[jp-launch-control]

Code Coverage Summary

No summary data is available for parent commit 9e1a144, so cannot calculate coverage changes. 😴

If that commit is a feature branch rather than a trunk commit, this is expected. Otherwise, this should be updated once coverage for 9e1a144 is available.

Full summary · PHP report · JS report