UR-4681 Fix - Payment Before Login not enforced for pending payments (#1361)

* UR-4681 Fix - Payment Before Login not enforced for pending payments

* Implement login gate seeding for pending paid members to ensure proper registration flow

Author: MILAN88888

includes/class-ur-user-approval.php

@@ -308,8 +308,15 @@ public function check_status_on_login( $user, $password ) {
 			return $user;
 		} elseif ( 'payment' === $login_option ) {
 
+			if ( $is_membership_active ) {
+				$members_repository       = new \WPEverest\URMembership\Admin\Repositories\MembersRepository();
+				$membership               = $members_repository->get_member_membership_by_id( $user->ID );
+				$members_order_repository = new \WPEverest\URMembership\Admin\Repositories\MembersOrderRepository();
+				$last_order               = $members_order_repository->get_member_orders( $user->ID );
+			}
+
 			$payment_status = get_user_meta( $user->ID, 'ur_payment_status', true );
-			$is_member      = $is_membership_active && ! empty( $membership );
+			$is_member      = $is_membership_active && ! empty( $membership ) && ! empty( $last_order );
 			if ( $is_member ) {
 				$payment_status            = $last_order['status'];
 				$membership_payment_method = $last_order['payment_method'];
@@ -338,7 +345,7 @@ public function check_status_on_login( $user, $password ) {
 						$payment_service = new \WPEverest\URMembership\Admin\Services\PaymentService( $payment_method, $membership_id, $user->user_email );
 						$response_data   = array(
 							'membership'      => $membership_id,
-							'subscription_id' => $membership['subscription_id'],
+							'subscription_id' => $membership[0]['subscription_id'],
 							'member_id'       => $user_id,
 						);
 						$is_upgrading    = get_user_meta( $user_id, 'urm_is_user_upgraded', true );

modules/membership/includes/Admin.php

@@ -577,6 +577,9 @@ public function process_membership_after_registration( $success_params, $valid_f
 				if ( 'free' === $data['payment_method'] ) {
 					do_action( 'urm_member_registered', $data, $member_id );
 				} else {
+					// Paid path skips user_registration_after_register_user_action (payment_process=true),
+					// so the core login-gate setters never run. Seed the gate here. UR-4681.
+					$this->set_login_gate_for_pending_member( $member_id );
 					update_user_meta( $member_id, 'ur_membership_registration_data', $data );
 				}
 
@@ -604,6 +607,39 @@ public function process_membership_after_registration( $success_params, $valid_f
 		}
 
 		/**
+		 * Seed the admin-approval / email-confirmation login gate for a paid member, since the
+		 * core setters on user_registration_after_register_user_action are skipped for paid
+		 * registrations. Writes only the gate meta (no emails), so email order is unchanged.
+		 * The 'payment' option is gated separately in UR_User_Approval::check_status_on_login().
+		 * UR-4681.
+		 *
+		 * @param int $member_id New member user ID.
+		 */
+		private function set_login_gate_for_pending_member( $member_id ) {
+			$login_option = ur_get_user_login_option( $member_id );
+
+			// Only the approval / email-confirmation gates need seeding here.
+			if ( ! in_array( $login_option, array( 'admin_approval', 'email_confirmation', 'admin_approval_after_email_confirmation' ), true ) ) {
+				return;
+			}
+
+			// Never override a status that has somehow already been written (e.g. the core hook ran).
+			if ( metadata_exists( 'user', $member_id, 'ur_user_status' ) || metadata_exists( 'user', $member_id, 'ur_confirm_email' ) ) {
+				return;
+			}
+
+			if ( 'admin_approval' === $login_option ) {
+				$user_manager = new \UR_Admin_User_Manager( $member_id );
+				$user_manager->save_status( \UR_Admin_User_Manager::PENDING, false );
+			} elseif ( 'email_confirmation' === $login_option ) {
+				update_user_meta( $member_id, 'ur_confirm_email', 0 );
+			} elseif ( 'admin_approval_after_email_confirmation' === $login_option ) {
+				update_user_meta( $member_id, 'ur_confirm_email', 0 );
+				update_user_meta( $member_id, 'ur_admin_approval_after_email_confirmation', 'false' );
+				update_user_meta( $member_id, 'ur_user_status', \UR_Admin_User_Manager::PENDING );
+			}
+		}
+		/*
 		 * Whether a payment_method="free" submission on a non-free plan is a legitimate 100%-coupon
 		 * free order. Only ONE-TIME (paid) plans qualify; the coupon is re-validated against the DB
 		 * so a forged payment_method="free" cannot bypass payment. UR-4386.