GH#1918: prevent SSO initialization in block editor iframes

[superdav42]

Summary

• stop the SSO browser flow before it initializes inside embedded browsing contexts
• prevent redirects and history cleanup from running in Gutenberg about:srcdoc previews
• add regression coverage that keeps the iframe guard ahead of SSO initialization

Verification

• pnpm exec eslint assets/js/sso.js
• vendor/bin/phpcs tests/WP_Ultimo/SSO/SSO_Test.php
• vendor/bin/phpunit --no-coverage --filter test_sso_js_
• Chromium about:srcdoc runtime check: no page errors, existing window.wu preserved, SSO callback not initialized
• aidevops changed-file lint suite

The generated assets/js/sso.min.js remains unchanged and will be regenerated by the release build.

Resolves #1918

---

aidevops.sh v3.34.13 plugin for OpenCode v1.18.31 with gpt-5.6-sol spent 48m and 187,605 tokens on this with the user in an interactive session.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c31c7773-67ca-4086-8bbb-268c5865eb18

---

📥 Commits

Reviewing files that changed from the base of the PR and between 6cb8b65 and c80c9f7.

---

📒 Files selected for processing (2)

• assets/js/sso.js
• tests/WP_Ultimo/SSO/SSO_Test.php

---

 ________________________________________________________________
< First, solve the problem. Then, write the code. - John Johnson >
 ----------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔨 Build Complete - Ready for Testing!

📦 Download Build Artifact (Recommended)

Download the zip build, upload to WordPress and test:

• Build: ultimate-multisite
• ⬇️ Download from GitHub Actions
• ⬇️ Download without Github Account (nightly.link)

🌐 Test in WordPress Playground (Very Experimental)

Click the link below to instantly test this PR in your browser - no installation needed!
Playground support for multisite is very limitied, hopefully it will get better in the future.

🚀 Launch in Playground

Login credentials: admin / password