Merge pull request #26 from bordoni/fix/users-settings-nested-form-save

[CONS-505] fix(admin): unnest Sync Roles form so Users settings save

Author: bordoni

CHANGELOG.md

@@ -18,6 +18,20 @@
   - 40 new WPUnit tests across 6 suites under `tests/wpunit/ChangeEmail*Test.php`.
   - See [`docs/change-email.md`](docs/change-email.md).
 
+### Fixed
+
+- **WorkOS → Users settings would not save** — the "Sync Roles to
+  WorkOS" button rendered its own `<form>` inside the Settings API
+  `<form action="options.php">`. Browsers don't allow nested forms:
+  the inner `</form>` closed the outer settings form early, and since
+  Role Mapping is the last section, the "Save Settings" submit button
+  was left outside the form. Clicking Save did nothing and no changes
+  (logout redirects, deprovision action, role map, etc.) persisted.
+  The sync form is now deferred to `admin_footer` (body level, like
+  the Create Organization modal) and its button is wired back via the
+  HTML5 `form="workos-role-sync-form"` attribute, so the settings form
+  stays intact and saves normally.
+
 ## [1.0.5] - 2026-05-18
 
 ### Added

src/WorkOS/Admin/Settings.php

@@ -43,6 +43,13 @@ class Settings {
 	 */
 	private bool $create_org_modal_queued = false;
 
+	/**
+	 * Whether the role-sync form has been queued for footer render.
+	 *
+	 * @var bool
+	 */
+	private bool $role_sync_form_queued = false;
+
 	/**
 	 * Constructor.
 	 */
@@ -1430,6 +1437,24 @@ public function render_create_org_modal(): void {
 		<?php
 	}
 
+	/**
+	 * Render the hidden "Sync Roles to WorkOS" form.
+	 *
+	 * Hooked to admin_footer so its <form> sits at body level rather than nested
+	 * inside the settings form on the Users tab. The visible submit button stays
+	 * in the role-map actions row and is wired to this form via the HTML5 `form`
+	 * attribute.
+	 */
+	public function render_role_sync_form(): void {
+		?>
+		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" id="workos-role-sync-form" style="display:none">
+			<?php wp_nonce_field( 'workos_sync_roles_to_workos' ); ?>
+			<input type="hidden" name="action" value="workos_sync_roles_to_workos" />
+			<input type="hidden" name="editing_env" value="<?php echo esc_attr( $this->get_editing_environment() ); ?>" />
+		</form>
+		<?php
+	}
+
 	/**
 	 * Flush the organizations transient cache.
 	 */
@@ -1650,16 +1675,19 @@ public function render_role_map(): void {
 		echo '</button>';
 
 		// Sync Roles to WorkOS button — only when plugin is enabled and org is configured.
+		// The actual <form> is deferred to admin_footer (see render_role_sync_form) so it is
+		// not nested inside the outer options.php settings form. A nested <form> closes the
+		// settings form early, orphaning the "Save Settings" button so nothing persists.
 		if ( workos()->is_enabled() && ! empty( Config::get_organization_id() ) ) {
-			echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" id="workos-role-sync-form">';
-			wp_nonce_field( 'workos_sync_roles_to_workos' );
-			echo '<input type="hidden" name="action" value="workos_sync_roles_to_workos" />';
-			echo '<input type="hidden" name="editing_env" value="' . esc_attr( $this->get_editing_environment() ) . '" />';
-			echo '<button type="submit" class="button">';
+			echo '<button type="submit" form="workos-role-sync-form" class="button">';
 			echo '<span class="dashicons dashicons-update"></span> ';
 			echo esc_html__( 'Sync Roles to WorkOS', 'integration-workos' );
 			echo '</button>';
-			echo '</form>';
+
+			if ( ! $this->role_sync_form_queued ) {
+				add_action( 'admin_footer', [ $this, 'render_role_sync_form' ] );
+				$this->role_sync_form_queued = true;
+			}
 		}
 
 		echo '</div>';