Harden checkout OTP: prevent dev-tools bypass, timing-safe comparison, phone pinning

[Copilot]

The checkout OTP flow was bypassable via browser dev tools — a user could verify phone A then swap billing phone to B before placing the order. Additionally, several patterns would not pass WordPress plugin review (raw echo json_encode, timing-vulnerable === on OTP, missing SameSite cookie attribute).

Architecture change (from prior commits)

Checkout OTP rendering moved from woocommerce_review_order_before_submit (broken in block checkout / Elementor / custom themes) to a self-contained panel via wp_footer. Verification uses a session-flag pattern: AJAX verifies OTP → sets transient flag → server-side hooks check flag on checkout submission. Works with classic, block, and any page-builder checkout.

Security hardening

• Phone pinning — verified_phone_matches() compares the billing phone at order submission against the OTP-verified phone stored in the transient. Mismatch → order blocked, session cleared.

// Classic checkout
if ($this->checkout_phone_matches_verified()) { ... }

// Block checkout — uses order object directly
if ($this->verified_phone_matches($order->get_billing_phone())) { ... }

• Timing-safe OTP comparison — authenticate_otp() uses hash_equals() instead of ===

• SameSite cookie — Session cookie now sets SameSite=Lax via PHP 7.3+ options array with positional-arg fallback

• wp_send_json() — Replaced all echo wp_kses_post(json_encode(...)); wp_die(); exit; in send_otp_for_reg() and save_and_send_otp_login() with wp_send_json() (proper Content-Type, safe termination). Also fixed null object access when user lookup fails.

Nonce coverage (audit)

Endpoint	Nonce
wc_send_otp (checkout)	check_ajax_referer('alpha_sms_checkout_otp', ...)
wc_send_otp (WC/WP reg)	wp_verify_nonce(..., 'wc_reg_phone_action') / wp_reg_phone_action
alpha_sms_verify_checkout_otp	check_ajax_referer('alpha_sms_checkout_otp', ...)
save_and_send_otp_login	check_ajax_referer('ajax-login-nonce', ...)
validate_guest_checkout_otp	Server-side only (transient flag)
validate_block_checkout_otp	Server-side only (transient flag + RouteException)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.