Repository navigation
WP.org review: four-letter prefix, enqueued styles, readme, public-route hardening - #43
Merged
Merged
Conversation
WordPress.org's plugin review asked for five things, and this is all of them. The prefix. `atf_` was three letters and the directory requires four, so every collision surface now wears `alltfo_` — the reviewer's own suggestion. Functions, constants, hooks, post types, statuses, capabilities, meta keys, transients, nonce actions, the `wp/v2` rest bases and the shell's entity kind all moved; CSS classes, custom properties and `data-atf-*` attributes stay, because a class name collides with nothing and the stylesheets are the contract the themes were tested against. The style tags. The preview page's document CSS becomes a real enqueued stylesheet (`assets/css/preview.css`), and the front-end renderer stops printing a `<style>` block entirely: theme tokens now ride the form wrapper's own `style` attribute, which scopes for free and hands the builder's canvas the same declarations off the attribute instead of out of a parsed tag. The readme. The display name is "AllTerrain Forms", full stop — the keyword list is gone, and so is the one sentence that called anything "the best". The public routes. `/track` now declares its args, refuses ids that are not forms, and explains in place why `__return_true` is the correct permission for an anonymous counter bump — the same reasoning `/submit` and `/resume` already carried. And the flake found while proving it: the unguessable-filename test asserted a random 24-character token never contains "v2", which is true about one run in 170. The structural regex was always the real statement; now it stands alone. 725 PHPUnit tests, 372 vitest tests, PHPCS and Plugin Check all green. The QA site's data was migrated in place (post types, statuses, meta keys, capabilities) and a no-JS submission stores an entry end to end. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0119U4sRRWGcTQdwYreTwpAp
The double-check against the review found three things the first pass had walked past. The readme claimed nothing is ever sent to any third party, four lines after describing the Akismet integration. Both were almost true; now one section — External services — is exactly true: Akismet (opt-in, per form, with its terms and privacy policy linked, as Guideline 6 asks) and webhooks (entries go only where the site owner points them), and every absolute claim now says "no service of ours" instead of "no service at all". And the last two document-level events the rename had missed — `atf-submitted`, the documented public event, and `atf-refresh` — now wear the four-letter prefix like everything else. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0119U4sRRWGcTQdwYreTwpAp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses every item in the WordPress.org plugin review:
atf_(3 chars) →alltfo_(the reviewer's own suggested prefix) across all collision surfaces: functions, constants, hooks/filters, post types (alltfo_form/alltfo_entry/alltfo_theme), post statuses (alltfo-unread…), capabilities, meta keys (_alltfo_*), transients, nonce actions,wp/v2rest bases, the shell entity kind and DOM events. CSS classes (atf-*), custom properties (--atf-*) anddata-atf-*attributes deliberately stay — they collide with nothing and are the tested theme contract.wp_enqueuecompliance — the preview page's inline<style>is nowassets/css/preview.css, registered and enqueued; the front-end renderer emits theme tokens on the form wrapper'sstyleattribute instead of printing a<style>block. The builder canvas lifts the declarations off the attribute.AllTerrain Forms(matches the plugin header); the "best contact form plugin" claim is gone./track— args schema (form_idabsint,eventenum), a form-existence/type check in the handler, and an in-place justification for the intentionally publicpermission_callback, matching/submitand/resume.v2(~1 in 170 runs).Verification: 725 PHPUnit + 372 vitest tests green, PHPCS 0 errors, Plugin Check clean (only pre-existing
meta_queryperf warnings). Deployed to the 8889 QA site with an in-place data migration (post types, statuses, meta keys, caps); a no-JS submission stores an entry end to end and the OpenStation shell loads all windows without errors.🤖 Generated with Claude Code
https://claude.ai/code/session_0119U4sRRWGcTQdwYreTwpAp