address code review feedback (WP-1007)

- route all TaxonomyLinksController responses through wordpressProxy
- remove unused testConnectionNonce from wp_localize_script
- replace $GLOBALS capture in ContentRelationsHandlerTest with anonymous class instance properties
- rename nonce action smartling_instant_translation → smartling_translation across all check_ajax_referer/wp_create_nonce call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: vsolovei-smartling

inc/Smartling/Services/ContentRelationsHandler.php

@@ -81,7 +81,7 @@ public function register(): void
      */
     public function createSubmissionsHandler(array $data = null): void
     {
-        $this->wpProxy->check_ajax_referer('smartling_instant_translation', '_wpnonce');
+        $this->wpProxy->check_ajax_referer('smartling_translation', '_wpnonce');
         if (!$this->wpProxy->current_user_can(SmartlingUserCapabilities::SMARTLING_CAPABILITY_WIDGET_CAP)) {
             $this->returnError('permission.denied', 'Insufficient permissions', 403);
             return;
@@ -104,7 +104,7 @@ public function createSubmissionsHandler(array $data = null): void
 
     public function actionHandler(): void
     {
-        $this->wpProxy->check_ajax_referer('smartling_instant_translation', '_wpnonce');
+        $this->wpProxy->check_ajax_referer('smartling_translation', '_wpnonce');
         if (!$this->wpProxy->current_user_can(SmartlingUserCapabilities::SMARTLING_CAPABILITY_WIDGET_CAP)) {
             $this->returnError('permission.denied', 'Insufficient permissions', 403);
             return;

inc/Smartling/WP/Controller/ConfigurationProfileFormController.php

@@ -32,7 +32,6 @@ public function wp_enqueue(): void
             wp_enqueue_script($jFile, $jFile, ['jquery'], $ver, false);
         }
         wp_localize_script($jsPath . 'configuration-profile-form.js', 'smartlingProfileForm', [
-            'testConnectionNonce' => wp_create_nonce('smartling_test_connection'),
             'expertSettingsNonce' => wp_create_nonce('smartling_expert_global_settings'),
         ]);
     }

inc/Smartling/WP/Controller/ContentEditJobController.php

@@ -87,7 +87,7 @@ public function setServedContentType($servedContentType)
     public function initJobApiProxy(): void
     {
         add_action('wp_ajax_' . self::SMARTLING_JOB_API_PROXY, function () {
-            $this->wpProxy->check_ajax_referer('smartling_instant_translation', '_wpnonce');
+            $this->wpProxy->check_ajax_referer('smartling_translation', '_wpnonce');
             if (!$this->wpProxy->current_user_can(SmartlingUserCapabilities::SMARTLING_CAPABILITY_WIDGET_CAP)) {
                 $this->wpProxy->wp_send_json(['status' => 403, 'message' => 'Insufficient permissions'], 403);
                 return;

inc/Smartling/WP/Controller/InstantTranslationController.php

@@ -37,7 +37,7 @@ public function register(): void
 
     public function handleRequestTranslation(): void
     {
-        $this->wpProxy->check_ajax_referer('smartling_instant_translation', '_wpnonce');
+        $this->wpProxy->check_ajax_referer('smartling_translation', '_wpnonce');
 
         if (!$this->wpProxy->current_user_can(SmartlingUserCapabilities::SMARTLING_CAPABILITY_WIDGET_CAP)) {
             $this->wpProxy->wp_send_json_error(['message' => 'Insufficient permissions'], 403);
@@ -139,7 +139,7 @@ public function handleRequestTranslation(): void
 
     public function handlePollStatus(): void
     {
-        $this->wpProxy->check_ajax_referer('smartling_instant_translation', '_wpnonce');
+        $this->wpProxy->check_ajax_referer('smartling_translation', '_wpnonce');
 
         if (!$this->wpProxy->current_user_can(SmartlingUserCapabilities::SMARTLING_CAPABILITY_WIDGET_CAP)) {
             $this->wpProxy->wp_send_json_error(['message' => 'Insufficient permissions'], 403);

inc/Smartling/WP/Controller/TaxonomyLinksController.php

@@ -162,7 +162,7 @@ public function linkTaxonomies($data)
             $data = $_POST;
         }
         if (!isset($data['sourceBlogId'], $data['sourceId'], $data['taxonomy'])) {
-            wp_send_json_error('Required parameter missing');
+            $this->wordpressProxy->wp_send_json_error('Required parameter missing');
         }
         $sourceBlogId = (int)$data['sourceBlogId'];
         $sourceId = (int)$data['sourceId'];
@@ -210,13 +210,13 @@ public function linkTaxonomies($data)
         }
         $submissions = array_merge($submissionsToAdd, $submissionsToUpdate);
         if (count(array_merge($submissions, $submissionsToDelete)) === 0) {
-            wp_send_json_error('No changes');
+            $this->wordpressProxy->wp_send_json_error('No changes');
         }
         $this->submissionManager->storeSubmissions($submissions);
         foreach ($submissionsToDelete as $submission) {
             $this->submissionManager->delete($submission);
         }
-        wp_send_json(['success' => true, 'submissions' => $this->getSubmissions()]);
+        $this->wordpressProxy->wp_send_json(['success' => true, 'submissions' => $this->getSubmissions()]);
     }
 
     /**

inc/Smartling/WP/View/BulkSubmit.php

@@ -70,7 +70,7 @@
              data-locales='<?= htmlspecialchars(json_encode(array_values($localesData), JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP | JSON_HEX_TAG), ENT_QUOTES, 'UTF-8') ?>'
              data-ajax-url="<?= admin_url('admin-ajax.php') ?>"
              data-admin-url="<?= admin_url('admin-ajax.php') ?>"
-             data-nonce="<?= wp_create_nonce('smartling_instant_translation') ?>"></div>
+             data-nonce="<?= wp_create_nonce('smartling_translation') ?>"></div>
         <div class="postbox-container" style="display:none;">
             <div id="panel-box" class="postbox hndle">
                 <div class="inside">

inc/Smartling/WP/View/ContentEditJob.php

@@ -59,7 +59,7 @@
                  data-locales='<?= htmlspecialchars(json_encode(array_values($localesData), JSON_THROW_ON_ERROR | JSON_HEX_APOS | JSON_HEX_QUOT), ENT_QUOTES, 'UTF-8') ?>'
                  data-ajax-url="<?= admin_url('admin-ajax.php') ?>"
                  data-admin-url="<?= admin_url('admin-ajax.php') ?>"
-                 data-nonce="<?= wp_create_nonce('smartling_instant_translation') ?>"></div>
+                 data-nonce="<?= wp_create_nonce('smartling_translation') ?>"></div>
 <?php if ($needWrapper) : ?>
         </div>
     </div>

tests/Services/ContentRelationsHandlerTest.php

@@ -84,24 +84,22 @@ public function testCreateSubmissionsHandlerReturns403WhenCapabilityMissing(): v
 
         $proxy = $this->makeWpProxy(false);
 
-        $errorKey = null;
-        $errorCode = null;
         $x = new class($service, $proxy) extends ContentRelationsHandler {
+            public ?string $capturedErrorKey = null;
+            public ?int $capturedErrorCode = null;
+
             public function returnResponse(array $data, $responseCode = 200): void {}
 
             public function returnError($key, $message, $responseCode = 400): void
             {
-                // Capture for assertions
-                $GLOBALS['_test_error_key'] = $key;
-                $GLOBALS['_test_error_code'] = $responseCode;
+                $this->capturedErrorKey = $key;
+                $this->capturedErrorCode = $responseCode;
             }
         };
 
         $x->createSubmissionsHandler(['formAction' => ContentRelationsHandler::FORM_ACTION_CLONE, 'source' => ['id' => [1], 'contentType' => 'post'], 'targetBlogIds' => '2']);
 
-        $this->assertSame('permission.denied', $GLOBALS['_test_error_key'] ?? null);
-        $this->assertSame(403, $GLOBALS['_test_error_code'] ?? null);
-
-        unset($GLOBALS['_test_error_key'], $GLOBALS['_test_error_code']);
+        $this->assertSame('permission.denied', $x->capturedErrorKey);
+        $this->assertSame(403, $x->capturedErrorCode);
     }
 }