fix(content-gate): prevent metering from bypassing account verification requirement (#4459)

Author: miguelpeixe

includes/content-gate/class-content-gate.php

@@ -822,6 +822,21 @@ public static function get_registration_settings( $gate_id ) {
 		];
 	}
 
+	/**
+	 * Whether the gate requires account verification.
+	 *
+	 * @param int $gate_id Optional gate ID. Default is the current gate.
+	 *
+	 * @return bool Whether the gate requires account verification.
+	 */
+	public static function requires_account_verification( $gate_id = null ) {
+		if ( ! $gate_id ) {
+			$gate_id = self::get_gate_post_id();
+		}
+		$registration = self::get_registration_settings( $gate_id );
+		return $registration['require_verification'];
+	}
+
 	/**
 	 * Update registration settings for a gate.
 	 *

includes/content-gate/class-metering.php

@@ -361,14 +361,20 @@ public static function is_logged_in_metering_allowed( $post_id = null ) {
 			return false;
 		}
 
+		// Bail if the gate requires account verification and the reader is not verified.
+		// Non-reader users (admins, editors) are exempt - they have full access through other means.
+		$user = \wp_get_current_user();
+		if ( Content_Gate::requires_account_verification() && Reader_Activation::is_user_reader( $user ) && ! Reader_Activation::is_reader_verified( $user ) ) {
+			return false;
+		}
+
 		// Not in checkout modals.
 		if ( method_exists( 'Newspack_Blocks\Modal_Checkout', 'is_modal_checkout' ) && \Newspack_Blocks\Modal_Checkout::is_modal_checkout() ) {
 			return false;
 		}
 
 		$gate_post_id = Content_Gate::get_gate_post_id();
 		$settings     = self::get_registered_settings( $gate_post_id );
-		$priority     = \get_post_meta( $gate_post_id, 'gate_priority', true );
 
 		// Bail if metering is not enabled.
 		if ( ! $settings['enabled'] || $settings['count'] <= 0 ) {
@@ -380,7 +386,6 @@ public static function is_logged_in_metering_allowed( $post_id = null ) {
 			return self::$logged_in_metering_cache[ $post_id ];
 		}
 
-		// Aggregate metering by gate priority, if available.
 		$user_meta_key = self::METERING_META_KEY . '_' . $gate_post_id;
 
 		$updated_user_data  = false;