Signature: Move HTTP request signing to a filter

[obenland]

Follow up to #1986 and #1991.

Moves double-knock into a filter that's always set.
With Signature getting an init callback, we can now also move the signing logic into a hook callback.

Proposed changes:

• Moved HTTP request signing to a filter in Signature::init and removed direct calls from Http class.
• Updated Signature class to add filters for signing and double knock logic.
• Adjusted tests to use filter-based approach for signature verification.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Go to '..'

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Moved HTTP request signing to a filter instead of calling it directly.

[Copilot]

Pull Request Overview

This PR refactors HTTP request signing logic from direct method calls to a filter-based approach, improving code organization and consistency. The changes move signature handling into filters that are automatically applied to all HTTP requests.

• Moves HTTP request signing from direct calls in Http class to a filter in Signature::init()
• Implements automatic double-knock fallback logic through HTTP response filtering
• Updates test infrastructure to work with the new filter-based approach

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
activitypub.php	Adds Signature::init() to the initialization sequence
includes/class-signature.php	Implements init() method with filters for request signing and double-knock logic
includes/class-http.php	Removes direct Signature::sign_request() calls and redundant method specifications
tests/includes/class-test-signature.php	Updates test to use specific filter removal instead of remove_all_filters

Comments suppressed due to low confidence (1)

includes/class-signature.php:38

• The removed wp_parse_args() call that sets default method and Date header is essential for signature generation. Without these defaults, the signing process may fail when these values are not provided by the caller.

	public static function sign_request( $args, $url ) {

[pfefferle]

You remove the method from the $args but it seems that Http_Signature_Draft is still using it in line 49.

I wonder why the tests are green 🤔

[pfefferle]

Ah, the test is still adding the method in the $args array!

[obenland]

Yes, that would be expected. Tests create signatures manually to sign "incoming" requests and they need the method provided.

When signing outgoing requests, http_request_args has a method set in those request args, GET by default, and any specific method based on the type of request is sent (post, head ).

[pfefferle]

nice job!