feat(content-gate): grouped access rules evaluation and normalization (#4435)

Author: miguelpeixe

includes/content-gate/class-access-rules.php

@@ -168,6 +168,87 @@ public static function evaluate_rule( $rule_slug, $args = null, $user_id = null
 		return call_user_func( $rule['callback'], $user_id, $args );
 	}
 
+	/**
+	 * Evaluate access rules with OR logic between groups and AND logic within groups.
+	 *
+	 * Rules structure: [ [ rule1, rule2 ], [ rule3, rule4 ] ]
+	 * - Groups use OR logic: reader must pass at least one group
+	 * - Rules within a group use AND logic: reader must pass all rules in the group
+	 *
+	 * @param array $access_rules The access rules (array of groups, each group is an array of rules).
+	 *
+	 * @return bool True if access is granted, false if restricted.
+	 */
+	public static function evaluate_rules( $access_rules ) {
+		if ( empty( $access_rules ) ) {
+			return true;
+		}
+
+		// Normalize legacy flat rules structure to grouped format.
+		$access_rules = self::normalize_rules( $access_rules );
+
+		// Evaluate each group with OR logic - if any group passes, grant access.
+		foreach ( $access_rules as $group ) {
+			if ( self::evaluate_rules_group( $group ) ) {
+				return true;
+			}
+		}
+
+		// No group passed - restrict access.
+		return false;
+	}
+
+	/**
+	 * Evaluate a single group of access rules with AND logic.
+	 *
+	 * @param array $group Array of rules in the group.
+	 *
+	 * @return bool True if all rules in the group pass, false otherwise.
+	 */
+	private static function evaluate_rules_group( $group ) {
+		if ( empty( $group ) || ! is_array( $group ) ) {
+			return true;
+		}
+
+		foreach ( $group as $rule ) {
+			if ( ! isset( $rule['slug'] ) ) {
+				continue;
+			}
+			if ( ! self::evaluate_rule( $rule['slug'], $rule['value'] ?? null ) ) {
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	/**
+	 * Normalize access rules to grouped format.
+	 *
+	 * Converts legacy flat rules [ rule1, rule2 ] to grouped format [ [ rule1, rule2 ] ].
+	 *
+	 * @param array $access_rules The access rules.
+	 *
+	 * @return array Normalized access rules in grouped format.
+	 */
+	public static function normalize_rules( $access_rules ) {
+		if ( empty( $access_rules ) ) {
+			return [];
+		}
+
+		// Check if already in grouped format (array of arrays with rules).
+		// A grouped format has arrays as first-level elements.
+		// A flat format has rule objects (with 'slug' key) as first-level elements.
+		$first_element = reset( $access_rules );
+		if ( is_array( $first_element ) && ! isset( $first_element['slug'] ) ) {
+			// Already in grouped format.
+			return $access_rules;
+		}
+
+		// Convert flat format to single group.
+		return [ $access_rules ];
+	}
+
 	/**
 	 * Get subscriptions eligible for access rules.
 	 *

includes/content-gate/class-content-gate.php

@@ -767,6 +767,11 @@ public static function get_custom_access_settings( $gate_id ) {
 			$custom_access = [];
 		}
 
+		$access_rules = isset( $custom_access['access_rules'] ) ? $custom_access['access_rules'] : [];
+
+		// Normalize legacy flat rules to grouped format.
+		$access_rules = Access_Rules::normalize_rules( $access_rules );
+
 		$default_metering = [
 			'enabled' => false,
 			'count'   => 0,
@@ -776,7 +781,7 @@ public static function get_custom_access_settings( $gate_id ) {
 		return [
 			'active'         => isset( $custom_access['active'] ) ? (bool) $custom_access['active'] : false,
 			'metering'       => isset( $custom_access['metering'] ) ? $custom_access['metering'] : $default_metering,
-			'access_rules'   => isset( $custom_access['access_rules'] ) ? $custom_access['access_rules'] : [],
+			'access_rules'   => $access_rules,
 			'gate_layout_id' => isset( $custom_access['gate_layout_id'] ) ? (int) $custom_access['gate_layout_id'] : 0,
 		];
 	}

includes/content-gate/class-content-restriction-control.php

@@ -7,8 +7,6 @@
 
 namespace Newspack;
 
-use Newspack\Access_Rules;
-
 /**
  * Main class.
  */
@@ -211,14 +209,9 @@ public static function is_post_restricted( $is_post_restricted, $post_id = null
 			// If custom_access mode is active.
 			if ( ! $is_restricted && ! empty( $gate['custom_access']['active'] ) ) {
 				$access_rules = $gate['custom_access']['access_rules'] ?? [];
-				if ( ! empty( $access_rules ) ) {
-					foreach ( $access_rules as $rule ) {
-						if ( ! Access_Rules::evaluate_rule( $rule['slug'], $rule['value'] ?? null ) ) {
-							$is_restricted  = true;
-							$gate_layout_id = $gate['custom_access']['gate_layout_id'] ?? $gate['id'];
-							break;
-						}
-					}
+				if ( ! empty( $access_rules ) && ! Access_Rules::evaluate_rules( $access_rules ) ) {
+					$is_restricted  = true;
+					$gate_layout_id = $gate['custom_access']['gate_layout_id'] ?? $gate['id'];
 				}
 			}
 

includes/wizards/audience/class-audience-content-gates.php

@@ -369,10 +369,13 @@ public function register_api_endpoints() {
 									'access_rules'   => [
 										'type'  => 'array',
 										'items' => [
-											'type'       => 'object',
-											'properties' => [
-												'slug'  => [ 'type' => 'string' ],
-												'value' => [ 'type' => 'mixed' ],
+											'type'  => 'array',
+											'items' => [
+												'type' => 'object',
+												'properties' => [
+													'slug' => [ 'type' => 'string' ],
+													'value' => [ 'type' => 'mixed' ],
+												],
 											],
 										],
 									],
@@ -472,22 +475,81 @@ public function sanitize_metering( $metering ) {
 	 * @param array  $rules The rules.
 	 * @param string $type The type of rules to sanitize.
 	 *
-	 * @return array The sanitized access rules.
+	 * @return array The sanitized rules.
 	 */
 	public function sanitize_rules( $rules, $type = 'access' ) {
-		$sanitized_rules = [];
 		if ( ! is_array( $rules ) ) {
-			return $sanitized_rules;
+			return [];
+		}
+
+		// For access rules, handle grouped format.
+		if ( 'access' === $type ) {
+			return $this->sanitize_access_rules_grouped( $rules );
 		}
+
+		// For content rules, use flat format.
+		$sanitized_rules = [];
 		foreach ( $rules as $rule ) {
-			$sanitized = $type === 'access' ? $this->sanitize_access_rule( $rule ) : $this->sanitize_content_rule( $rule );
+			$sanitized = $this->sanitize_content_rule( $rule );
 			if ( ! is_wp_error( $sanitized ) ) {
 				$sanitized_rules[] = $sanitized;
 			}
 		}
 		return $sanitized_rules;
 	}
 
+	/**
+	 * Sanitize access rules in grouped format.
+	 *
+	 * Accepts both flat format [ rule1, rule2 ] and grouped format [ [ rule1, rule2 ], [ rule3 ] ].
+	 * Always returns grouped format [ [ rule1, rule2 ], [ rule3 ] ].
+	 *
+	 * @param array $rules The access rules.
+	 *
+	 * @return array The sanitized access rules in grouped format.
+	 */
+	public function sanitize_access_rules_grouped( $rules ) {
+		if ( empty( $rules ) ) {
+			return [];
+		}
+
+		// Normalize rules (flat or grouped) to a consistent grouped format.
+		$rules = Access_Rules::normalize_rules( $rules );
+
+		// Sanitize each group.
+		$sanitized_groups = [];
+		foreach ( $rules as $group ) {
+			$sanitized_group = $this->sanitize_access_rules_group( $group );
+			if ( ! empty( $sanitized_group ) ) {
+				$sanitized_groups[] = $sanitized_group;
+			}
+		}
+
+		return $sanitized_groups;
+	}
+
+	/**
+	 * Sanitize a single group of access rules.
+	 *
+	 * @param array $group The group of access rules.
+	 *
+	 * @return array The sanitized group.
+	 */
+	public function sanitize_access_rules_group( $group ) {
+		if ( ! is_array( $group ) ) {
+			return [];
+		}
+
+		$sanitized_group = [];
+		foreach ( $group as $rule ) {
+			$sanitized = $this->sanitize_access_rule( $rule );
+			if ( ! is_wp_error( $sanitized ) ) {
+				$sanitized_group[] = $sanitized;
+			}
+		}
+		return $sanitized_group;
+	}
+
 	/**
 	 * Sanitize access rule.
 	 *

src/wizards/audience/views/content-gates/custom-access.tsx

@@ -20,6 +20,9 @@ interface CustomAccessProps {
 }
 
 export default function CustomAccess( { gateId, customAccess, onChange, cardProps = {} }: CustomAccessProps ) {
+	// Get the first group of rules (UI currently only supports a single group).
+	const currentRules = customAccess.access_rules[ 0 ] || [];
+
 	const handleChange = useCallback(
 		( value: Partial< CustomAccess > ) => {
 			onChange( {
@@ -31,6 +34,16 @@ export default function CustomAccess( { gateId, customAccess, onChange, cardProp
 		},
 		[ customAccess, onChange ]
 	);
+
+	const handleRulesChange = useCallback(
+		( rules: GateAccessRule[] ) => {
+			// Wrap rules in a single group to maintain grouped format.
+			// If no rules, set empty array to avoid [ [] ] which would pass readiness checks.
+			handleChange( { access_rules: rules.length ? [ rules ] : [] } );
+		},
+		[ handleChange ]
+	);
+
 	return (
 		<ActionCard
 			title={ __( 'Paid Access', 'newspack-plugin' ) }
@@ -43,10 +56,7 @@ export default function CustomAccess( { gateId, customAccess, onChange, cardProp
 		>
 			{ customAccess.active && (
 				<Card noBorder>
-					<AccessRules
-						rules={ customAccess.access_rules }
-						onChange={ ( rules: GateAccessRule[] ) => handleChange( { access_rules: rules } ) }
-					/>
+					<AccessRules rules={ currentRules } onChange={ handleRulesChange } />
 					<hr />
 					<Metering metering={ customAccess.metering } onChange={ ( metering: Metering ) => handleChange( { metering } ) } />
 				</Card>

src/wizards/audience/views/content-gates/types/index.d.ts

@@ -80,11 +80,13 @@ type Registration = {
 	gate_layout_id: number;
 };
 
+type GateAccessRuleGroup = GateAccessRule[];
+
 type CustomAccess = {
 	active: boolean;
 	metering: Metering;
 	gate_layout_id: number;
-	access_rules: GateAccessRule[];
+	access_rules: GateAccessRuleGroup[];
 };
 
 type ContentGiftingConfig = {