| @@ -18,8 +18,9 @@ | ||
| 18 | 18 | | `/intros` | DELETE | `includes/seen-intros.php` | logged-in + OpenStation enabled | |
| 19 | 19 | | `/os-settings` | GET / POST | `includes/os-settings.php` | logged-in + OpenStation enabled | |
| 20 | 20 | | `/extended-options` | GET / POST | `includes/extended-options.php` | `manage_options` | |
| 21 | 21 | | `/pwa-state` | GET / POST | `includes/pwa.php` | logged-in + OpenStation enabled | |
| 22 | +| `/feedback/deactivation` | POST | `includes/feedback/rest.php` | `activate_plugins` + `openstation_deactivation_feedback_enabled()`; deliberately not `openstation_rest_require_enabled()` (the person deactivating usually has OpenStation off). No object-level checks: the route stores nothing on the site, it forwards an anonymous payload to the intake on openstation.blog and answers `{ sent }` | | |
| 22 | 23 | | `/debug` | GET | `includes/devtools.php` | `manage_options` (filterable via `openstation_debug_rest_permission`) | |
| 23 | 24 | | `/presence` | GET / POST | `includes/presence.php` | logged-in + OpenStation enabled | |
| 24 | 25 | | `/oauth/start` | POST | `includes/oauth-relay.php` | logged-in | |
| 25 | 26 | | `/oauth/callback` | GET | `includes/oauth-relay.php` | public (validated by the state nonce) | |
| @@ -37,9 +38,8 @@ | ||
| 37 | 38 | | `/comments/bulk` | POST | `apps/comments/parts/rest.php` | `moderate_comments` | |
| 38 | 39 | | `/comments/reply` | POST | `apps/comments/parts/rest.php` | `edit_posts` | |
| 39 | 40 | | `/comments/insights/{email}` | GET | `apps/comments/parts/rest.php` | `moderate_comments` | |
| 40 | 41 | | `/comments/counts` | GET | `apps/comments/parts/rest.php` | `edit_posts` | |
| 41 | -| `/comments/ai-settings` | GET / POST | `apps/comments/parts/ai-moderation.php` | `manage_options` | | |
| 42 | 42 | | `/content-graph/post-types` | GET | `includes/content-graph/rest.php` | `edit_posts` (filterable via `openstation_content_graph_user_can_use`) | |
| 43 | 43 | | `/content-graph/nodes` | GET | `includes/content-graph/rest.php` | `edit_posts` (filterable via `openstation_content_graph_user_can_use`) | |
| 44 | 44 | | `/content-graph/post/{id}` | GET | `includes/content-graph/rest.php` | `edit_posts` (filterable via `openstation_content_graph_user_can_use`) | |
| 45 | 45 | | `/apps/(?P<app>[a-z0-9][a-z0-9_-]*)/dispatch` | POST | `includes/framework/wordpress.php` | Logged in + the app exists + `App::allows()` (its `capabilities()` and `can()` gate). Every `.os.php` window — Code Blue included, behind Developer mode + `manage_options` (`manage_network_options` on multisite), filterable via `openstation_code_blue_user_can_use` — is served by this one route; there are no per-app routes. | |
