feat: reactivation flow for cancelled memberships

inc/checkout/class-cart.php

@@ -836,6 +836,88 @@ protected function build_from_membership($membership_id): bool {
 			return true;
 		}
 
+		/*
+		 * Reactivation flow: detect cancelled/expired memberships.
+		 *
+		 * When a customer with a cancelled or expired membership submits a checkout,
+		 * this is a reactivation — not an upgrade. We set the cart_type accordingly
+		 * and ensure the product list includes the full plan + any addons from the
+		 * original membership.
+		 *
+		 * @since 2.5.0
+		 */
+		$inactive_statuses = [
+			Membership_Status::CANCELLED,
+			Membership_Status::EXPIRED,
+			'on-hold',
+			'suspended',
+		];
+
+		if (in_array($membership->get_status(), $inactive_statuses, true)) {
+
+			$this->cart_type = 'reactivation';
+
+			/*
+			 * Mark the customer as having trialed in memory only.
+			 *
+			 * This prevents has_trial() from returning true during THIS
+			 * checkout session. The flag is NOT persisted to the database
+			 * here — it will be saved when the membership is renewed after
+			 * payment completes. This avoids permanently removing trial
+			 * eligibility if the user abandons checkout.
+			 *
+			 * @since 2.5.0
+			 */
+			if ($this->customer && method_exists($this->customer, 'set_has_trialed')) {
+				$this->customer->set_has_trialed(true);
+			}
+
+			/*
+			 * Always rebuild products from the membership, ignoring any
+			 * user-supplied products in the request. This prevents a
+			 * malicious user from injecting arbitrary product IDs into
+			 * a reactivation cart.
+			 *
+			 * @since 2.5.0
+			 */
+			$plan_id = $membership->get_plan_id();
+
+			if ($plan_id) {
+				$this->attributes->products = [$plan_id];
+
+				$addon_ids = $membership->get_addon_ids();
+
+				if (! empty($addon_ids)) {
+					$this->attributes->products = array_merge($this->attributes->products, $addon_ids);
+				}
+			}
+
+			// Set up country and currency, then add products and return
+			$this->country = $this->country ?: $this->customer->get_country();
+
+			$this->set_currency($membership->get_currency());
+
+			if (empty($this->attributes->products)) {
+				$this->errors->add('no_plan', __('This membership has no plan to reactivate.', 'ultimate-multisite'));
+
+				return true;
+			}
+
+			foreach ($this->attributes->products as $product_id) {
+				$this->add_product($product_id);
+			}
+
+			// Set duration from the plan
+			$plan_product = $membership->get_plan();
+
+			if ($plan_product && ! $membership->is_free()) {
+				$this->duration      = $plan_product->get_duration();
+				$this->duration_unit = $plan_product->get_duration_unit();
+			}
+
+			return true;
+		}
+
 		/*
 		 * Adds the country to calculate taxes.
 		 */
@@ -2052,7 +2134,7 @@ public function add_product($product_id_or_slug, $quantity = 1): bool {
 			return true;
 		}
 
-		$add_signup_fee = 'renewal' !== $this->get_cart_type();
+		$add_signup_fee = ! in_array($this->get_cart_type(), ['renewal', 'reactivation'], true);
 
 		/**
 		 * Filters whether or not the signup fee should be applied.
@@ -2144,6 +2226,18 @@ public function get_tax_breakthrough() {
 	 */
 	public function has_trial() {
 
+		/*
+		 * Reactivation carts never get a trial period.
+		 *
+		 * A customer reactivating a cancelled membership has already used
+		 * their trial. Offering another trial would be a revenue loss.
+		 *
+		 * @since 2.5.0
+		 */
+		if ('reactivation' === $this->cart_type) {
+			return false;
+		}
+
 		$products = $this->get_all_products();
 
 		if (empty($products)) {
@@ -2576,6 +2670,18 @@ public function get_billing_start_date() {
 			return null;
 		}
 
+		/*
+		 * Reactivation carts have no trial period, so billing starts now.
+		 *
+		 * Return null so downstream consumers (Stripe subscription setup,
+		 * date_trial_end, etc.) don't receive a trial-derived start date.
+		 *
+		 * @since 2.5.0
+		 */
+		if ('reactivation' === $this->cart_type) {
+			return null;
+		}
+
 		/*
 		 * Set extremely high value at first to prevent any change of errors.
 		 */

inc/checkout/class-checkout.php

@@ -1332,11 +1332,22 @@ protected function maybe_create_site() {
 		 */
 		if ( ! empty($sites)) {
 			/*
-			 * Returns the first site on that list.
-			 * This is not ideal, but since we'll usually only have
-			 * one site here, it's ok. for now.
+			 * Return the first site that has a valid blog ID.
+			 *
+			 * We explicitly check for a site with a positive ID rather
+			 * than blindly using current($sites), which could return a
+			 * pending or stale entry if the array pointer was moved.
+			 *
+			 * @since 2.5.0
 			 */
-			return current($sites);
+			foreach ($sites as $site) {
+				if ($site && method_exists($site, 'get_id') && 0 < $site->get_id()) {
+					return $site;
+				}
+			}
+
+			// Fallback to actual first entry if no valid site found
+			return reset($sites);
 		}
 
 		$site_url   = $this->request_or_session('site_url');

inc/managers/class-site-manager.php

@@ -446,6 +446,29 @@ public function lock_site(): void {
 		}
 
 		if (false === $can_access) {
+
+			/*
+			 * Allow plugins to provide a reactivation URL for blocked sites.
+			 *
+			 * This filter fires for ALL inactive membership states (cancelled,
+			 * expired, on-hold, suspended) so that a custom reactivation page
+			 * can intercept the user before they see the generic "site not
+			 * available" message.
+			 *
+			 * @since 2.5.0
+			 *
+			 * @param string|null $reactivation_url URL to redirect to, or null to skip.
+			 * @param object|null $membership       The membership object, or null if not found.
+			 * @param object      $site             The site object.
+			 */
+			$reactivation_url = apply_filters('wu_blocked_site_reactivation_url', null, $membership, $site);
+
+			if ($reactivation_url) {
+				wp_safe_redirect($reactivation_url);
+
+				exit;
+			}
+
 			if ($redirect_url) {
 				wp_safe_redirect($redirect_url);
 

inc/models/class-membership.php

@@ -2256,9 +2256,9 @@ public function to_search_results() {
 	 * @param bool   $auto_renew  Whether or not the membership is recurring.
 	 * @param string $status     Membership status.
 	 * @param string $expiration Membership expiration date in MySQL format.
-	 * @return bool Whether or not the renewal was successful.
+	 * @return bool|\WP_Error Whether the renewal was successful, or WP_Error on failure.
 	 */
-	public function renew($auto_renew = false, $status = 'active', $expiration = ''): bool {
+	public function renew($auto_renew = false, $status = 'active', $expiration = '') {
 
 		$id = $this->get_id();
 
@@ -2310,6 +2310,18 @@ public function renew($auto_renew = false, $status = 'active', $expiration = '')
 			$this->set_status($status);
 		}
 
+		/*
+		 * Clear the cancellation date only when reactivating a previously
+		 * cancelled membership. Checks the current status (before the update)
+		 * to avoid clearing historical cancellation data on regular recurring
+		 * renewals where the membership was never in a cancelled state.
+		 *
+		 * @since 2.5.0
+		 */
+		if ('active' === $status && Membership_Status::CANCELLED === $this->get_status() && ! empty($this->get_date_cancellation())) {
+			$this->set_date_cancellation(null);
+		}
+
 		$this->set_auto_renew($auto_renew);
 
 		$this->set_date_renewed(wu_get_current_time('mysql')); // Current time.
@@ -2340,6 +2352,65 @@ public function renew($auto_renew = false, $status = 'active', $expiration = '')
 		return true;
 	}
 
+	/**
+	 * Reactivate a cancelled or expired membership.
+	 *
+	 * Clears the cancellation date BEFORE calling renew() so the membership
+	 * is saved in a single pass, avoiding race conditions where listeners
+	 * on the first save see stale "cancelled" state.
+	 *
+	 * @since 2.5.0
+	 *
+	 * @param bool   $auto_renew Whether to auto-renew.
+	 * @param string $expiration Optional expiration date in MySQL format.
+	 * @return bool Whether the reactivation was successful.
+	 */
+	public function reactivate($auto_renew = false, $expiration = ''): bool {
+
+		$id = $this->get_id();
+
+		wu_log_add("membership-{$id}", sprintf('Starting membership reactivation for membership #%d. Current status: %s', $id, $this->get_status()));
+
+		/*
+		 * Clear the cancellation date BEFORE renew() saves.
+		 * This ensures a single save path (M3 fix) and prevents
+		 * listeners from seeing stale "cancelled" state.
+		 */
+		$old_cancel_date = $this->get_date_cancellation();
+
+		if (! empty($old_cancel_date)) {
+			$this->set_date_cancellation(null);
+		}
+
+		/**
+		 * Fires before a membership is reactivated.
+		 *
+		 * @since 2.5.0
+		 *
+		 * @param int        $membership_id The membership ID.
+		 * @param Membership $membership    The membership object.
+		 */
+		do_action('wu_membership_pre_reactivate', $this->get_id(), $this);
+
+		$result = $this->renew($auto_renew, 'active', $expiration);
+
+		if ($result) {
+			wu_log_add("membership-{$id}", sprintf('Membership #%d reactivated successfully. Old cancel date: %s', $id, $old_cancel_date ?: 'none'));
+
+			/**
+			 * Fires after a membership is successfully reactivated.
+			 *
+			 * @since 2.5.0
+			 *
+			 * @param int        $membership_id The membership ID.
+			 * @param Membership $membership    The membership object.
+			 */
+			do_action('wu_membership_post_reactivate', $this->get_id(), $this);
+		}
+
+		return $result;
+	}
+
 	/**
 	 * Changes the membership status to "cancelled".
 	 *