Merge branch 'main' into fix/route-post-redirect

Author: nicolas-jaussaud

.github/workflows/deploy-docs.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24.15.0
+          node-version: 24.16.0
           cache: npm
           cache-dependency-path: website/package-lock.json
 

src/DataView/Request.php

@@ -0,0 +1,73 @@
+<?php declare( strict_types=1 );
+
+namespace Tangible\DataView;
+
+use WP_REST_Request;
+
+/**
+ * Wraps a WP_REST_Request instance, gives access to parameters
+ * according to method and defines default values
+ */
+class Request {
+
+    /**
+     * @see https://developer.wordpress.org/reference/classes/wp_rest_request/
+     */
+    protected WP_REST_Request $rest_request;
+
+    protected array $default_params = [
+        'id'        => null,
+        'action'    => 'list',
+        '_wpnonce'  => '',
+    ];
+
+    public function __construct() {
+        /**
+         * Simple implementation based on how WP_REST_Server::serve_request()
+         * instantiates WP_REST_Request
+         *
+         * @see https://developer.wordpress.org/reference/classes/wp_rest_server/serve_request/
+         */
+        $this->rest_request = new WP_REST_Request(
+            $_SERVER['REQUEST_METHOD'],
+            $_SERVER['PATH_INFO'] ?? '/'
+        );
+
+        $this->rest_request->set_default_params( $this->default_params );
+        $this->rest_request->set_query_params( wp_unslash( $_GET ) );
+        $this->rest_request->set_body_params( wp_unslash( $_POST ) );
+    }
+
+    /**
+     * Get the current action from the request.
+     *
+     * @return string Current action (defaults to 'list').
+     */
+    public function get_current_action(): string {
+        return sanitize_key( (string) $this->rest_request->get_param( 'action' ) );
+    }
+
+    /**
+     * Get the entity ID from the current request.
+     *
+     * @return int|null Entity ID or null if not present.
+     */
+    public function get_current_id(): ?int {
+        $id = $this->rest_request->get_param( 'id' );
+        return $id !== null ? (int) $id : null;
+    }
+
+    /**
+     * Get the WordPress nonce from the current request.
+     */
+    public function get_nonce(): string {
+        return (string) $this->rest_request->get_param( '_wpnonce' );
+    }
+
+    /**
+     * Whether the current request is a POST request.
+     */
+    public function is_post(): bool {
+        return $this->rest_request->is_method( 'POST' );
+    }
+}

src/DataView/RequestRouter.php

@@ -24,6 +24,7 @@ class RequestRouter {
     protected UrlBuilder $url_builder;
     protected Renderer $renderer;
     protected LabelGenerator $label_generator;
+    protected Request $request;
 
     /** @var callable|null */
     protected $layout_callback = null;
@@ -38,7 +39,8 @@ public function __construct(
         FieldTypeRegistry $registry,
         UrlBuilder $url_builder,
         ?Renderer $renderer = null,
-        ?LabelGenerator $label_generator = null
+        ?LabelGenerator $label_generator = null,
+        ?Request $request = null
     ) {
         $this->config          = $config;
         $this->dataset         = $dataset;
@@ -47,6 +49,7 @@ public function __construct(
         $this->url_builder     = $url_builder;
         $this->renderer        = $renderer ?? new HtmlRenderer();
         $this->label_generator = $label_generator ?? new LabelGenerator();
+        $this->request         = $request ?? new Request();
 
         $this->resolve_labels();
     }
@@ -120,8 +123,8 @@ protected function check_capability() {
     public function route(): void {
         $this->check_capability();
 
-        $action = $this->url_builder->get_current_action();
-        $id     = $this->url_builder->get_current_id();
+        $action = $this->request->get_current_action();
+        $id     = $this->request->get_current_id();
 
         // Handle singular mode differently.
         if ( $this->config->is_singular() ) {
@@ -526,15 +529,6 @@ protected function render_list_table( array $entities ): string {
         return $html;
     }
 
-    /**
-     * Check if this is a POST request.
-     *
-     * @return bool True if POST request.
-     */
-    protected function is_post_request(): bool {
-        return isset( $_SERVER['REQUEST_METHOD'] ) && $_SERVER['REQUEST_METHOD'] === 'POST';
-    }
-
     /**
      * Verify nonce for an action.
      *
@@ -544,8 +538,7 @@ protected function is_post_request(): bool {
      */
     protected function verify_nonce( string $action, ?int $id = null ): bool {
         $nonce_action = $this->url_builder->get_nonce_action( $action, $id );
-        // phpcs:ignore WordPress.Security.NonceVerification.Missing
-        $nonce = $_POST['_wpnonce'] ?? $_GET['_wpnonce'] ?? '';
+        $nonce = $this->request->get_nonce();
         return wp_verify_nonce( $nonce, $nonce_action ) !== false;
     }
 

src/DataView/UrlBuilder.php

@@ -50,30 +50,6 @@ public function url_with_nonce( string $action, ?int $id, string $nonce_action )
         return wp_nonce_url( $url, $nonce_action );
     }
 
-    /**
-     * Get the current action from the request.
-     *
-     * @return string Current action (defaults to 'list').
-     */
-    public function get_current_action(): string {
-        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-        return isset( $_GET['action'] ) ? sanitize_key( $_GET['action'] ) : 'list';
-    }
-
-    /**
-     * Get the entity ID from the current request.
-     *
-     * @return int|null Entity ID or null if not present.
-     */
-    public function get_current_id(): ?int {
-        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-        if ( ! isset( $_GET['id'] ) ) {
-            return null;
-        }
-        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-        return (int) $_GET['id'];
-    }
-
     /**
      * Get the menu page slug.
      *