fix: OAuth bearer resolver fatal before init (#127)

[ifahimreza]

Closes #127

What

Fixes a PHP fatal that killed every ChatGPT MCP request on sites where another plugin asks WordPress who is signed in during plugins_loaded — AIOSEO Pro and Internal Links Premium both do. Saddle_OAuth::resource_id() now works at any point in the bootstrap, so the bearer resolver can authenticate a token however early determine_current_user fires.

Why

Customer report (Mark Roach, staging.kesuk.net): ChatGPT completes OAuth consent, then every request is refused 401 and the connector never reaches tools/list — while the identical build works on mrr.org.uk. His WP_DEBUG log pinned it:

Call to a member function using_index_permalinks() on null  (wp-includes/rest-api.php:529)
Saddle_OAuth_Bearer::resolve() → Saddle_OAuth::resource_id() → rest_url() → get_rest_url()

resolve() is hooked on determine_current_user. When another plugin calls is_user_logged_in() at plugins_loaded, that filter fires before wp-settings.php creates $GLOBALS['wp_rewrite'] — and on a genuine Bearer MCP request all six guards pass, the RFC 8707 audience check calls resource_id(), and rest_url() fatals on the missing global. Saddle_OAuth_Store::find() had already hardened the DB half of this exact window (raw $wpdb, documented); the URL half three lines later was missed. Latent since the OAuth server landed — the site's plugin mix, not rc7, decides whether it fires — and the most likely real root cause of the whole two-week kesuk.net thread, including the diagnosis retracted in cd70a48. The rc7 Bearer probe (#123) can't see it because it targets auth-probe, not a URI containing saddle/v1/mcp.

How

• resource_id() routes through a new private Saddle_OAuth::rest_url_early(): with the rewrite global present it defers to rest_url() untouched; without it, it replicates core get_rest_url( null, $path, 'rest' ) exactly — including the rest_url filter with core's argument shape.
• The replica must be byte-identical to core's output: the value is compared against the RFC 8707 resource stored on every access token at authorize time, so any divergence would refuse every token on the site as invalid_token. It is provably identical: the only things get_rest_url() needs from $wp_rewrite are using_index_permalinks() — a pure regex on the permalink_structure option — and WP_Rewrite::$index, hard-coded 'index.php'. Anything customizing $index does so on the real instance, which only exists once the branch defers to core anyway. Existing tokens therefore keep working; kesuk.net recovers without re-consent.
• issuer()/endpoint() stay on plain rest_url() — a full call-site audit found class-saddle-oauth-bearer.php:122 is the sole pre-init-reachable rest_url() in the OAuth subsystem.
• Non-obvious: class-saddle-oauth.php was already past the ~300-line soft cap (440 lines) like most of includes/oauth/; this adds ~55 more. Splitting the class is out of scope for a bugfix.

Testing

• composer test — 612 tests, 2411 assertions, green (1 pre-existing skip). Three new regression tests, committed red first with the exact customer stack: resolution works with $wp_rewrite nulled; resource_id() is byte-identical before/after init on pretty, index and plain permalinks; the audience check still refuses a foreign token early. (No CI on this repo — results are from local runs.)
• composer lint — 0 errors; only pre-existing warnings in untouched files.
• Verified in a real install (WP Playground, mu-plugin firing is_user_logged_in() at plugins_loaded prio 5 + seeded OAuth token, Bearer POST to /wp-json/saddle/v1/mcp):
  • main: HTTP 500, using_index_permalinks() on null, stack identical to the customer's debug.log.
  • This branch: HTTP 200 with the full 40-tool tools/list; unauthenticated request gets the proper 401 + WWW-Authenticate discovery challenge.
  • This branch without the mu-plugin: HTTP 200 — the normal post-init path is unchanged.
• No new notices or warnings with WP_DEBUG on.

🤖 Generated with Claude Code

https://claude.ai/code/session_016dGNUUe36hKi5o9hzFb3Cb