fix(cloud): connected is not covered (#994) - #87
Open
cport1 wants to merge 1 commit into
Open
Conversation
On a successful exchange the plugin said "Cloud features are now active." What had happened was that credentials were stored. Whether this site is covered is a different fact and, at that moment, an unknown one: nothing from the site has been received. It is the same mistake as treating an OAuth redirect as proof of an install, which is what WebDecoy/app#994 exists to stop. The notice now says what happened and what has not happened yet, and carries a link to the screen in the app that watches for the first report. The journey used to end here, in wp-admin, with a claim nobody had checked; it now ends where the claim can be confirmed. Notices gained an optional link. The message is still escaped as text and the link is built from esc_url + esc_html rather than carried as markup, because a notice that accepted HTML would be a place for some to arrive. connected_notice_message is public and static so the claim can be asserted on without a WordPress runtime, which is the whole point: the regression to guard is the wording, not the plumbing. tests/bootstrap.php gains a guarded pass-through for __() so the WordPress-free suite can read the English source strings; it is inert inside WordPress, where the real function is defined and is the one used. The disconnect notice already got this right -- "Disconnected from WebDecoy Cloud. Local protection remains active." -- and is unchanged. Tests: the notice says a report is still to come and claims neither "now active" nor "protected", with and without an organization name. Verified by putting the old wording back and watching it fail. Claude-Session: https://claude.ai/code/session_017jwQyaJfkKsp2CgLbi9g7x
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to WebDecoy/app#994, whose requirement this closes on the plugin side:
What it said
On a successful exchange:
What had happened is that credentials were stored. Whether the site is covered is a different fact, and at that moment an unknown one — nothing from the site has been received yet. The journey then ended there, in wp-admin, with a claim nobody had checked.
What it says now
The link goes to
/onboarding/setup, where the app already polls install state and distinguishes waiting, reporting and silent. So the journey now ends where the claim can actually be confirmed.The disconnect notice already got this right — "Disconnected from WebDecoy Cloud. Local protection remains active." — and is unchanged. It is the model for the tone.
Implementation notes
esc_url+esc_htmlrather than carried as markup, because a notice that accepted HTML would be a place for some to arrive.connected_notice_message()is public and static so the claim can be asserted without a WordPress runtime. The regression worth guarding is the wording, not the plumbing.tests/bootstrap.phpgains a guarded pass-through for__(), so the WordPress-free suite can read the English source strings. It is inert inside WordPress, where the real function is defined and is the one used.Tests
The notice says a report is still to come, and claims neither "now active" nor "protected", with and without an organization name. Verified by putting the old wording back and watching it fail.
php tests/run.php— 96 passed, 0 failed.phpcsclean.phpstanclean (needs-d memory_limit=1Glocally; the default limit dies parsing an unrelated generated file).Release
Not released. This changes user-visible copy, so it wants a version bump and the usual
bin/release-all.shrun — your call on when.