From a71f81a8161eadebe61402a2e8223d1e73d36f35 Mon Sep 17 00:00:00 2001
From: Tim Carr <tim@n7studios.co.uk>
Date: Fri, 10 Apr 2026 19:41:18 +0800
Subject: [PATCH] Remove v3 API Key and Secret on Plugin Update

---
 ...ass-integrate-convertkit-wpforms-setup.php | 45 +++++++++++++++++++
 tests/EndToEnd/general/UpgradePathsCest.php   | 44 ++++++++++++++++--
 2 files changed, 86 insertions(+), 3 deletions(-)

diff --git a/includes/class-integrate-convertkit-wpforms-setup.php b/includes/class-integrate-convertkit-wpforms-setup.php
index 137dae6..1845093 100644
--- a/includes/class-integrate-convertkit-wpforms-setup.php
+++ b/includes/class-integrate-convertkit-wpforms-setup.php
@@ -52,11 +52,56 @@ public function update() {
 			$this->migrate_form_settings();
 		}
 
+		// Actions that should run regardless of the version number
+		// whenever the Plugin is updated.
+		$this->remove_v3_api_key_and_secret_from_settings();
+
 		// Update the installed version number in the options table.
 		update_option( 'integrate_convertkit_wpforms_version', INTEGRATE_CONVERTKIT_WPFORMS_VERSION );
 
 	}
 
+	/**
+	 * Remove v3 API key and Secret from settings.
+	 *
+	 * @since   1.9.2
+	 */
+	private function remove_v3_api_key_and_secret_from_settings() {
+
+		// Bail if the wpforms_get_providers_options() function isn't available.
+		if ( ! function_exists( 'wpforms_get_providers_options' ) ) {
+			return;
+		}
+
+		// Get providers.
+		$providers = wpforms_get_providers_options();
+
+		// Bail if no providers exist.
+		if ( ! $providers ) {
+			return;
+		}
+
+		// Bail if no Kit connections exist.
+		if ( ! array_key_exists( 'convertkit', $providers ) ) {
+			return;
+		}
+
+		// Iterate through providers.
+		foreach ( $providers['convertkit'] as $account_id => $settings ) {
+			// Remove v3 API Secret from settings.
+			$settings['api_key']    = '';
+			$settings['api_secret'] = '';
+
+			// Save settings.
+			wpforms_update_providers_options(
+				'convertkit',
+				$settings,
+				$account_id
+			);
+		}
+
+	}
+
 	/**
 	 * 1.7.2: Prefix any connection form settings with `form:`, now that
 	 * the Plugin supports adding a subscriber to a Form, Tag or Sequence.
diff --git a/tests/EndToEnd/general/UpgradePathsCest.php b/tests/EndToEnd/general/UpgradePathsCest.php
index f1898f2..a8cefb4 100644
--- a/tests/EndToEnd/general/UpgradePathsCest.php
+++ b/tests/EndToEnd/general/UpgradePathsCest.php
@@ -39,11 +39,8 @@ public function testMigrateFormSettingsToIntegration(EndToEndTester $I)
 
 		// Get first integration for ConvertKit, and confirm it has the expected array structure and values.
 		$account = reset( $providers['convertkit'] );
-		$I->assertArrayHasKey('api_key', $account);
-		$I->assertArrayHasKey('api_secret', $account);
 		$I->assertArrayHasKey('label', $account);
 		$I->assertArrayHasKey('date', $account);
-		$I->assertEquals($_ENV['CONVERTKIT_API_KEY'], $account['api_key']);
 		$I->assertEquals('Kit', $account['label']);
 	}
 
@@ -149,4 +146,45 @@ public function testFormSettingsPrefixAddedToSettingsOnUpgrade(EndToEndTester $I
 			]
 		);
 	}
+
+	/**
+	 * Tests that the v3 API Key and Secret are removed from settings when upgrading to 1.9.2 or later.
+	 *
+	 * @since   1.9.2
+	 *
+	 * @param   EndToEndTester $I  Tester.
+	 */
+	public function testV3APIKeyAndSecretRemovedFromSettings(EndToEndTester $I)
+	{
+		// Setup Plugin's settings with an API Key and Secret.
+		$I->setupWPFormsIntegrationWithAPIKeyAndSecret($I);
+
+		// Define an installation version older than 1.9.2.
+		$I->haveOptionInDatabase('integrate_convertkit_wpforms_version', '1.9.0');
+
+		// Activate Plugins.
+		$I->activateThirdPartyPlugin($I, 'wpforms-lite');
+		$I->activateConvertKitPlugin($I);
+
+		// Confirm the provider connections no longer have a value for the v3 API Key and Secret.
+		$settings   = $I->grabOptionFromDatabase('wpforms_providers');
+		$connection = reset($settings['convertkit']);
+		$I->assertEmpty($connection['api_key']);
+		$I->assertEmpty($connection['api_secret']);
+	}
+
+	/**
+	 * Deactivate and reset Plugin(s) after each test, if the test passes.
+	 * We don't use _after, as this would provide a screenshot of the Plugin
+	 * deactivation and not the true test error.
+	 *
+	 * @since   1.9.2
+	 *
+	 * @param   EndToEndTester $I  Tester.
+	 */
+	public function _passed(EndToEndTester $I)
+	{
+		$I->deactivateConvertKitPlugin($I);
+		$I->deactivateThirdPartyPlugin($I, 'wpforms-lite');
+	}
 }