Merge pull request #1959 from Automattic/fix/cloudflare-explicit-publication-changes

Require explicit Cloudflare publication changes

Author: chubes4

packages/runtime-cloudflare/README.md

@@ -10,7 +10,7 @@ On cold start, the entry Worker uses the acquired pointer to rebuild PHP-WASM's
 
 Canonical browser, health, and mutation boots require the separately managed `WORDPRESS_AUTH_SECRET` Worker secret. The entry Worker derives the eight WordPress auth keys and salts from that secret with a versioned, site-scoped (`default`) SHA-256 domain separator before `wp-load.php`. It never logs, persists, or returns the secret or derived values. Configure it independently from the bootstrap password with `wrangler secret put WORDPRESS_AUTH_SECRET --config packages/runtime-cloudflare/wrangler.jsonc`; rotating `WORDPRESS_ADMIN_PASSWORD` does not rotate authentication salts or invalidate sessions.
 
-After each mutating HTTP request, the entry runtime invokes MDI's explicit request-boundary flush, collects canonical files, stores immutable content-addressed R2 objects and a revision manifest, then commits the new pointer through the held lease. GET, HEAD, and asset requests release without promotion. Failed requests abort their leases; stale leases recover by token/version/expiry checks. The entry isolate can cache one runtime only for the exact acquired pointer revision and exits it after promotion or when another isolate advances the pointer. It does not persist SQLite. Existing manifests are reused when canonical file hashes have not changed. Authenticated requests that produce no canonical MDI changes do not rebuild a publication.
+After each mutating HTTP request, the entry runtime invokes MDI's explicit request-boundary flush, collects canonical files, stores immutable content-addressed R2 objects and a revision manifest, then commits the new pointer through the held lease. GET, HEAD, and asset requests release without promotion. Failed requests abort their leases; stale leases recover by token/version/expiry checks. The entry isolate can cache one runtime only for the exact acquired pointer revision and exits it after promotion or when another isolate advances the pointer. It does not persist SQLite. Existing manifests are reused when canonical file hashes have not changed. Canonical mutations such as login session-token writes do not rebuild a publication unless WordPress reports explicit affected routes or a global publication change.
 
 Anonymous HTML responses are stored as create-once, host-independent R2 artifacts under their canonical revision. An authorized `POST ?phase=operator-publish` establishes or replaces a bounded route set. Once that publication exists, WordPress hooks report the public routes affected by post, term, menu, theme, plugin, and relevant option mutations. The Worker renders only those routes in the already-mutated PHP runtime, stages immutable page artifacts and a version 2 publication descriptor, commits canonical state through the coordinator, then conditionally promotes `sites/default/publications/current.json` against its prior R2 ETag. Unchanged route entries retain their older canonical artifacts. A promotion conflict or post-commit R2 failure leaves the prior publication readable and is exposed through `x-wp-codebox-publication`; it never rolls back already-committed WordPress state. Published GET and HEAD requests check a 60-second edge entry and then R2 before coordinator construction, while authenticated, preview, admin, REST, and unpublished routes continue through WordPress. The version 2 reader accepts existing version 1 descriptors during migration. This provides bounded automatic route compilation and local edge invalidation, not a global CDN purge pipeline.
 

packages/runtime-cloudflare/src/worker.ts

@@ -399,9 +399,9 @@ function readPublicationChanges(php: PHP): PublicationChanges {
   return { all: value.all, upsert, remove }
 }
 
-function publicationPlan(current: PublishedRevision, changes: PublicationChanges, fallbackAll = true): { upsert: string[]; remove: string[] } {
+function publicationPlan(current: PublishedRevision, changes: PublicationChanges): { upsert: string[]; remove: string[] } {
   const existing = current.routes.map(({ route }) => route)
-  const upsert = changes.all || (fallbackAll && changes.upsert.length === 0 && changes.remove.length === 0) ? existing : changes.upsert
+  const upsert = changes.all ? existing : changes.upsert
   const remove = changes.remove.filter((route) => !upsert.includes(route))
   if (new Set([...existing, ...upsert]).size > MAX_PUBLISHED_ROUTES) throw new Error("Incremental publication exceeds its route budget.")
   return { upsert, remove }
@@ -536,8 +536,7 @@ async function runCoordinatedWordPressRequest(request: Request, env: RuntimeEnv,
     }
     if (mutatesCanonicalState) {
       if (!canonicalChanges || !publicationChanges) throw new Error("Canonical mutation completed without its persistence evidence.")
-      const hasCanonicalChanges = canonicalChanges.created.length + canonicalChanges.changed.length + canonicalChanges.deleted.length > 0
-      const plan = currentPublication ? publicationPlan(currentPublication.publication, publicationChanges, hasCanonicalChanges) : null
+      const plan = currentPublication ? publicationPlan(currentPublication.publication, publicationChanges) : null
       const compiled = plan ? await compilePublicationRoutes(runtime, plan.upsert, new URL(request.url).origin) : []
       const next = await persistRuntime(env.WORDPRESS_STATE_BUCKET, runtime, canonicalChanges)
       const stagedPublication = currentPublication && plan && (plan.upsert.length || plan.remove.length)
@@ -831,7 +830,7 @@ async function runScheduledWordPressCron(env: RuntimeEnv, coordinator: RevisionC
         await discardRuntime(runtime)
         break
       }
-      const plan = currentPublication ? publicationPlan(currentPublication.publication, event.publicationChanges, false) : null
+      const plan = currentPublication ? publicationPlan(currentPublication.publication, event.publicationChanges) : null
       const origin = plan && plan.upsert.length ? await runtimeSiteOrigin(runtime) : SITE_URL
       const compiled = plan ? await compilePublicationRoutes(runtime, plan.upsert, origin) : []
       const next = await persistRuntime(env.WORDPRESS_STATE_BUCKET, runtime, event.canonicalChanges)

scripts/cloudflare-local-gate.mjs

@@ -134,6 +134,7 @@ async function login() {
   const form = new URLSearchParams({ log: "admin", pwd: password, redirect_to: `${origin}/wp-admin/`, testcookie: "1", "wp-submit": "Log In" })
   const response = await request(`${origin}/wp-login.php`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form, redirect: "manual" })
   if (![301, 302].includes(response.status)) throw new Error(`Expected login redirect, received ${response.status}: ${await response.text()}`)
+  if (response.headers.has("x-wp-codebox-publication") || response.headers.has("x-wp-codebox-publication-revision")) throw new Error("Login must not trigger publication work.")
   const location = response.headers.get("location")
   if (!location?.includes("/wp-admin/")) throw new Error(`Login did not redirect to wp-admin: ${location}`)
   const admin = await assertAuthenticatedDashboard(new URL(location, origin))

tests/cloudflare-runtime.test.ts

@@ -376,7 +376,8 @@ test("Cloudflare runtime injects composable coordinators without moving PHP out
   assert.match(worker, /Incremental publication promotion failed after canonical commit/)
   assert.ok(coordinatedRequest.indexOf("stageIncrementalPublication") < coordinatedRequest.indexOf("commitLease"))
   assert.ok(coordinatedRequest.indexOf("commitLease") < coordinatedRequest.indexOf("safelyPromoteIncrementalPublication"))
-  assert.match(coordinatedRequest, /hasCanonicalChanges = canonicalChanges\.created\.length \+ canonicalChanges\.changed\.length \+ canonicalChanges\.deleted\.length > 0/)
+  assert.match(worker, /const upsert = changes\.all \? existing : changes\.upsert/)
+  assert.doesNotMatch(worker, /fallbackAll|hasCanonicalChanges/)
   assert.ok(scheduledCron.indexOf("stageIncrementalPublication") < scheduledCron.indexOf("commitLease"))
   assert.ok(scheduledCron.indexOf("commitLease") < scheduledCron.indexOf("safelyPromoteIncrementalPublication"))
   assert.match(worker, /https:\/\/wp-codebox-publication\.invalid/)