Forms: Add REST API endpoint for exporting responses #45275

lezama · 2025-09-23T01:02:55Z

Proposed changes

This PR replaces the legacy AJAX-based CSV export with a modern REST API endpoint for Jetpack Forms responses.

Changes:

Add new /wp/v2/feedback/export REST endpoint for CSV exports
Remove legacy AJAX handler wp_ajax_feedback_export and the download_feedback_as_csv() method
Update Jetpack Forms dashboard to use REST API with @wordpress/api-fetch
Support all existing filters: selected items, search, status, date ranges, and source/parent

Other information

Testing instructions

Navigate to Jetpack → Forms in WP Admin
Test exporting with various filters:
- Export all responses (no selection)
- Select specific responses and export
- Filter by source/form and export
- Apply search filters and export
- Filter by date range and export
Verify CSV downloads correctly with expected data
Confirm permission checks work (test with non-admin user)

Product impact

No user-facing changes - export functionality remains the same
Improved reliability and error handling for exports
Better compatibility with modern WordPress environments

Does this pull request change what data or activity we track or use?

No

Checklist

I have written a clear PR title and description
I have tested my changes
My code follows the WordPress coding standards
My code passes the linter

github-actions · 2025-09-23T01:03:53Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack), and enable the forms/add-rest-export-endpoint branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack forms/add-rest-export-endpoint

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2025-09-23T01:04:04Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
🔴 Add a "[Status]" label (In Progress, Needs Review, ...).
🔴 Add a "[Type]" label (Bug, Enhancement, Janitorial, Task).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Jetpack plugin:

The Jetpack plugin has different release cadences depending on the platform:

WordPress.com Simple releases happen as soon as you deploy your changes after merging this PR (PCYsg-Jjm-p2).
WoA releases happen weekly.
Releases to self-hosted sites happen monthly:
- Scheduled release: October 7, 2025
- Code freeze: October 6, 2025

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

jp-launch-control · 2025-09-23T01:18:46Z

Code Coverage Summary

Coverage changed in 4 files.

File	Coverage	Δ%	Δ Uncovered
projects/packages/forms/src/contact-form/class-contact-form-plugin.php	425/1318 (32.25%)	-0.24%	12 💔
projects/packages/forms/src/dashboard/hooks/use-export-responses.ts	0/53 (0.00%)	0.00%	11 💔
projects/packages/forms/src/contact-form/class-contact-form-endpoint.php	673/756 (89.02%)	0.22%	10 💔
projects/packages/forms/src/dashboard/inbox/export-responses/csv.tsx	0/7 (0.00%)	0.00%	-9 💚

Full summary · PHP report · JS report

_{If appropriate, add one of these labels to override the failing coverage check:

Covered by non-unit tests
Use to ignore the Code coverage requirement check when E2Es or other non-unit tests cover the code

Coverage tests to be added later
Use to ignore the Code coverage requirement check when tests will be added in a follow-up PR

I don't care about code coverage for this PR
Use this label to ignore the check for insufficient code coveage.}

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php

manzoorwanijk · 2025-09-23T05:59:45Z

Isn't it a convention that the REST endpoints always return JSON?

What was the problem with AJAX method that we are trying to solve here?

We could also make use of the admin_post_{$action} action.

manzoorwanijk · 2025-09-23T06:03:44Z

Core REST API Handbook mentions

The REST API uses JSON exclusively as the request and response format, including error responses.

It also says

The WordPress REST API provides an interface for applications to interact with your WordPress site by sending and receiving data as JSON (JavaScript Object Notation) objects.

lezama · 2025-09-23T13:03:24Z

@manzoorwanijk Thanks for the feedback. You are right about REST conventions.

In this version, we return JSON for errors and CSV on success. While admin_post_{$action} is conventional, clients using @wordpress/api-fetch benefit from REST’s built-in auth handling, instead of adding boilerplate for an AJAX nonce. Is there a helper or way to use existing AJAX endpoints within @wordpress packages?

projects/packages/forms/src/contact-form/class-contact-form-plugin.php

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php

enejb · 2025-09-23T19:22:30Z

I tested this and it works as expected. 🥳

I tested exporting.
selected, all, inbox, spam, trash.
Filters by selected date, by selected source.

Exporting Google Sheets ( for regressions )

It would be good to add an endpoint test for this PR. So that we have something that checks for regressions.

manzoorwanijk · 2025-09-24T06:06:36Z

In this version, we return JSON for errors and CSV on success. While admin_post_{$action} is conventional, clients using @wordpress/api-fetch benefit from REST’s built-in auth handling, instead of adding boilerplate for an AJAX nonce. Is there a helper or way to use existing AJAX endpoints within @wordpress packages?

If you wish to laverage the REST authentication for api-fetch, then you can return a URL to admin-post action mentioned above. So, it can pass only the $feedback_ids and $post_id to the admin post which should make the admin post action simpler. You can also add a nonce to the URL.

Then update Contact_Form_Plugin::download_feedback_as_csv() to be a callback to admin_post_feedback_export, which verifies the nonce and receives the feedback IDs to export, which should be easy to sanitize. Then in API fetch, you can pass the content-type header or parse: false as you already did when you try to download the file.

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php

lezama · 2025-09-24T13:00:19Z

Thanks for the feedback @manzoorwanijk.

Updated the implementation to follow your suggestion about using admin-post for file downloads. The REST endpoint now returns JSON with a download_url that points to an admin-post handler.

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php

enejb · 2025-09-24T19:51:48Z

I retested this changes and it works well. It would be good to show some sort of in progress button while the URL is being returned. This will help the user not click the button multiple times.

Lets add a test for the new endpoint and then I think this is ready to ship! Nice work.

manzoorwanijk

Thank you for implementing the suggestions. This looks much better now. I have some further suggestions for improvement, some of which you may ignore if you prefer.

manzoorwanijk · 2025-09-25T04:20:31Z

projects/packages/forms/src/contact-form/class-contact-form-plugin.php

-		$data      = $this->get_feedback_entries_from_post();
+	public function admin_post_feedback_export() {
+		$feedback_ids_str = sanitize_text_field( wp_unslash( $_GET['feedback_ids'] ?? '' ) );
+		$post_id          = sanitize_text_field( wp_unslash( $_GET['post_id'] ?? '' ) );


We don't pass the post_id when generating the URL from the REST endpoint. Do we?

projects/packages/forms/src/contact-form/class-contact-form-plugin.php

manzoorwanijk · 2025-09-25T04:24:33Z

projects/packages/forms/src/dashboard/hooks/use-export-responses.ts

+			window.location.href = response.download_url;
+			return response;
+		}
+		throw new Error( 'Invalid response: missing download URL' );


Do we need to translate this?

I would say not yet since it would only show up in the dev console for now.

manzoorwanijk · 2025-09-25T04:27:17Z

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php

+			return new WP_Error( 'no_responses', __( 'No responses found', 'jetpack-forms' ), array( 'status' => 404 ) );
+		}
+
+		$feedback_ids = wp_list_pluck( $feedback_posts, 'ID' );


You can add 'fields' => 'ids' to $query_args above to get rid of this step and make it a bit faster.

simison · 2025-09-25T09:46:59Z

It would be good to show some sort of in progress button while the URL is being returned. This will help the user not click the button multiple times.

Button has disabled and isBusy states for this purpose, here's a PR adding isExporting flag on top of this PR, you can either merge into this or deploy separately, how you prefer:

Forms: add "is exporting" state to the export endpoint handler #45302

…ugin.php Co-authored-by: Manzoor Wani <[email protected]>

manzoorwanijk

Thank you for addressing the feedback. This looks good to me now.

👉 I would still love to improve admin_post_feedback_export method in some next iteration like this.

function admin_post_feedback_export() {
	// First check for the user permissions before we do anything.
	if ( ! current_user_can( 'export' ) ) {
		wp_die( esc_html__( 'You do not have permission to export form responses.', 'jetpack-forms' ), 403 );
	}

	// Next, let us sanitize the input parameters that we need immediately.
	$feedback_ids_str = sanitize_text_field( wp_unslash( $_GET['feedback_ids'] ?? '' ) );
	$nonce            = sanitize_text_field( wp_unslash( $_GET['nonce'] ?? '' ) );

	// Ensure we have the required parameters.
	if ( empty( $feedback_ids_str ) || empty( $nonce ) ) {
		wp_die( esc_html__( 'Invalid request parameters.', 'jetpack-forms' ), 400 );
	}

	// Verify the nonce.
	if ( ! wp_verify_nonce( $nonce, 'feedback_export_' . $feedback_ids_str ) ) {
		wp_die( esc_html__( 'Security check failed.', 'jetpack-forms' ), 403 );
	}

	// Now extract and sanitize feedback IDs.
	$feedback_ids = array_values(
		array_filter(
			array_map(
				'intval',
				explode( ',', $feedback_ids_str )
			)
		)
	);

	// Shortcircuit if we have no feedback IDs.
	if ( empty( $feedback_ids ) ) {
		wp_die( esc_html__( 'Invalid request parameters.', 'jetpack-forms' ), 400 );
	}

	// Let us get the export data.
	$export_data = $this->get_export_feedback_data( $feedback_ids );

	if ( empty( $export_data ) ) {
		wp_die( esc_html__( 'No responses found to export.', 'jetpack-forms' ), 404 );
	}

	// Now let us get the post ID as we need it now.
	$post_id = sanitize_text_field( wp_unslash( $_GET['post_id'] ?? '' ) );

	$this->download_feedback_as_csv( $export_data, $post_id );
}

taking care of it.

@simison

Introduces an isExporting state to track export progress and prevent UI flickering. The export button is now disabled and shows a busy indicator while exporting, improving user feedback during CSV downloads. props @simison

edanzer · 2025-09-26T17:25:08Z

projects/packages/forms/src/dashboard/hooks/use-export-responses.ts

+			} );
+			setIsExporting( false );
+		}
+	}, [ currentQuery, selected, closeModal, createErrorNotice ] );


We've updated the onExport method returned from this hook. It doesn’t accept args and returns an object from the endpoint rather than fetch Response.

This onExport method is passed to both the CSV and Google export components, and the CSV file has been updated to use the new onExport as expected.

But the Google Drive card is still using this same onExport function the old way here.

onExport( 'grunion_export_to_gdrive', 'feedback_export_nonce_gdrive' ) .then( ( response: Response ) => response.json() ) .then( ( { data } ) => { window.open( data.sheet_link, '_blank' ); } ) .finally( () => { setIsExporting( false ); } ); }, [ tracks, onExport, isExporting ] );

I'd think we either need to update Google drive to use the new onExport method correctly, or else if there's a reason we don't want to tackle that here, maybe have the useExportResponses() hook still return the old method (for Google) along with the new one (for CSV), and then handle updating Google in a follow up.

To confirm if you try to Export to Google with this PR, you do get an error:

Uncaught (in promise) TypeError: response.json is not a function at eval (google-drive.tsx:76:100)

Good catch. @edanzer. It used to work but I think I broke it :(

Will create a fix for google drive.

github-actions bot added [Block] Contact Form Form block (also see Contact Form label) [Feature] Contact Form [Package] Forms [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ labels Sep 23, 2025

github-actions bot added the [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. label Sep 23, 2025

lezama force-pushed the forms/add-rest-export-endpoint branch from 49302ee to 0ff05d9 Compare September 23, 2025 01:09

lezama requested a review from a team September 23, 2025 01:10

enejb reviewed Sep 23, 2025

View reviewed changes

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php Outdated Show resolved Hide resolved

lezama changed the title ~~Forms: Add REST API endpoint for exporting responses~~ WIP: Forms: Add REST API endpoint for exporting responses Sep 23, 2025

enejb previously requested changes Sep 23, 2025

View reviewed changes

projects/packages/forms/src/contact-form/class-contact-form-plugin.php Show resolved Hide resolved

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php Outdated Show resolved Hide resolved

Use rest endpoint instead of ajax

06c5d76

lezama force-pushed the forms/add-rest-export-endpoint branch from 233fb69 to 06c5d76 Compare September 23, 2025 18:36

lezama changed the title ~~WIP: Forms: Add REST API endpoint for exporting responses~~ Forms: Add REST API endpoint for exporting responses Sep 23, 2025

not deprecating

f28cd8a

manzoorwanijk reviewed Sep 24, 2025

View reviewed changes

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php Show resolved Hide resolved

lezama added 3 commits September 24, 2025 09:40

Refactor CSV export to use admin-post

258fed2

simpler

8a3ac4c

add sanitize_calllbacks

b9d4bf1

lezama requested review from enejb and a team September 24, 2025 13:01

fix types

9299540

lezama and others added 3 commits September 24, 2025 10:10

simpler

2d8dae5

simpler

1149953

Merge branch 'trunk' into forms/add-rest-export-endpoint

e610b0c

manzoorwanijk reviewed Sep 24, 2025

View reviewed changes

projects/packages/forms/src/contact-form/class-contact-form-endpoint.php Show resolved Hide resolved

remove unused params

ff69dc1

manzoorwanijk reviewed Sep 25, 2025

View reviewed changes

simison mentioned this pull request Sep 25, 2025

Forms: add "is exporting" state to the export endpoint handler #45302

Closed

3 tasks

enejb and others added 4 commits September 25, 2025 15:06

Update projects/packages/forms/src/contact-form/class-contact-form-pl…

4a97cab

…ugin.php Co-authored-by: Manzoor Wani <[email protected]>

Use feedback ids instead

f3e2b8a

Show error notice when there are no responses.

d2eb4c2

Add tests

123c3e9

github-actions bot added the [Tests] Includes Tests label Sep 26, 2025

enejb added 3 commits September 25, 2025 23:52

Fix linter errors

2a66931

More tests

2c414d6

Pass the $post_id

8c58151

manzoorwanijk previously approved these changes Sep 26, 2025

View reviewed changes

Keep the previous method as it was

d4ab5b9

enejb dismissed manzoorwanijk’s stale review via d4ab5b9 September 26, 2025 15:29

Add export progress indicator to CSV export

1604597

Introduces an isExporting state to track export progress and prevent UI flickering. The export button is now disabled and shows a busy indicator while exporting, improving user feedback during CSV downloads. props @simison

edanzer reviewed Sep 26, 2025

View reviewed changes

Forms: Add REST API endpoint for exporting responses #45275

Are you sure you want to change the base?

Forms: Add REST API endpoint for exporting responses #45275

Conversation

lezama commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Changes:

Other information

Testing instructions

Product impact

Does this pull request change what data or activity we track or use?

Checklist

Uh oh!

github-actions bot commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jp-launch-control bot commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

Uh oh!

manzoorwanijk commented Sep 23, 2025

Uh oh!

manzoorwanijk commented Sep 23, 2025

Uh oh!

lezama commented Sep 23, 2025

Uh oh!

Uh oh!

Uh oh!

enejb commented Sep 23, 2025

Uh oh!

manzoorwanijk commented Sep 24, 2025

Uh oh!

Uh oh!

lezama commented Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

enejb commented Sep 24, 2025

Uh oh!

manzoorwanijk left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

simison commented Sep 25, 2025

Uh oh!

manzoorwanijk left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lezama commented Sep 23, 2025 •

edited

Loading

github-actions bot commented Sep 23, 2025 •

edited

Loading

github-actions bot commented Sep 23, 2025 •

edited

Loading

jp-launch-control bot commented Sep 23, 2025 •

edited

Loading

lezama commented Sep 24, 2025 •

edited

Loading