Add OAuth login

[jeffpaul]

Either in place of the existing API URL / API Key or alongside it, we'll want to look at updating the WordPress site connection to the associated Mailchimp account via OAuth: https://mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/. The first assessment here should likely be to determine the level of effort to implement this and then discuss with Mailchimp as to the feasibility to include this within the 1.6.0 release or perhaps push to a 2.0.0 release (as well as whether this replaces or augments the API URL/Key implementation).

[jeffpaul]

Noting that this is blocked until we can sort out optimal approach with Mailchimp on replacing API Key with OAuth.

[dkotter]

After multiple discussions, it has been decided that instead of building a new middleware service to help with the OAuth flow, we can use an existing solution that was built for the MailChimp for WooCommerce plugin. This simplifies what is needed here and will only require changes within the plugin instead of a brand-new service.

The following are a list of tasks that I think cover everything that will need to be done. Some of these could probably be combined into a single PR but would also be nice to keep each PR as small as possible. More details on each of these follows below.

• Utilize the mailchimpapp.com service to generate an access token
• Encrypt the access token before we store it
• Switch all API requests to use the access token instead of an API key
• Handle potential error states where an access token expires or is revoked
• Backward compatibility for sites that are currently using an API key

Utilize the mailchimpapp.com service to generate an access token

Currently right now we have an API key field that someone enters their API key into. Once this is saved, we validate that key and then store it. This key is then used for any API requests.

We'll want to remove this field and replace it with a button that triggers the new flow. The flow here will be mostly copied from the MailChimp for WooCommerce plugin (though cleaned up / integrated better into our plugin). I'd suggest installing that plugin and testing the flow out to get a sense of how this works (you click a button, a popup shows that takes you to Mailchimp, you login and authorize the app, the popup closes and the page refreshes).

From a code perspective, you can see how things are triggered mostly starting here: https://github.com/mailchimp/mc-woocommerce/blob/master/admin/js/mailchimp-woocommerce-admin.js#L270 and https://github.com/mailchimp/mc-woocommerce/blob/master/admin/class-mailchimp-woocommerce-admin.php#L970.

They're spinning up a new subdomain but for now, we can use the woocommerce.mailchimpapp.com domain to test things.

Encrypt the access token before we store it

Currently the plugin stores the API key as plaintext. Ideally we should encrypt this new access token before storing it. This does mean we'll need a specific encryption key so we can decrypt things when needed. We've solved this on a few other projects so I'd suggest referencing those.

Switch all API requests to use the access token instead of an API key

Pretty straightforward, we'll need to find all existing API requests and ensure those use the access token (when it's available) instead of an API key.

Handle potential error states where an access token expires or is revoked

The access token that Mailchimp generates supposedly doesn't expire (and doesn't come with a refresh token) but we should account for scenarios where that token no longer works. For instance, if someone revoked access on the Mailchimp side, the token wouldn't work. I think anytime we need to use the access token, if it ends up not working, we should prompt the user to go back through the setup flow to generate a new token.

Backward compatibility for sites that are currently using an API key

Initially we should look to support both an API key and access token for API requests, so all existing sites continue to work. I think this should be fairly straightforward, where we can check if an access token exists and use that and fallback to an API key if it exists. We can also hide the API key field so no new users can set that up (will need to decide if we show that for existing users, allowing them to change that key, or just hide it for everyone).

In addition, we should show an admin message prompting existing users to go through the new flow, maybe even have some language in there warning them that API key access is deprecated and will be removed soon.