← All changes | google-index/class-google-index-admin.php +367 -152 2.6.13 → 2.7.2 View file →

		@@ -13,16 +13,24 @@
13	13	if (!defined('ABSPATH')) {
14	14	exit;
15	15	}
16	16
17		-class Google_Index_Admin
	17	+class Google_Index_Admin
18	18	{
19	19	/**
20	20	* Section ID for Google Index settings
21	21	*/
22	22	private const SECTION_GOOGLE_INDEX = 'google_index_direct_settings';
23		-
	23	+
24	24	/**
	25	+ * Placeholder the redacted display JSON uses in place of the private key.
	26	+ *
	27	+ * Its presence means the textarea still holds what the server rendered, so
	28	+ * the submission carries no new credential and must leave storage alone.
	29	+ */
	30	+ private const REDACTED_MARKER = '-----REDACTED-----';
	31	+
	32	+ /**
25	33	* Initialize admin functionality
26	34	*/
27	35	public function __construct()
28	36	{
		@@ -28,16 +36,16 @@
28	36	{
29	37	// Hook into MetaSync admin initialization
30	38	add_action('admin_init', array($this, 'add_settings_to_metasync'), 20);
31	39	add_action('admin_enqueue_scripts', array($this, 'enqueue_admin_scripts'));
32		-
	40	+
33	41	// Hook into MetaSync's AJAX settings processing
34	42	add_action('wp_ajax_meta_sync_save_settings', array($this, 'process_google_index_settings'), 5);
35	43	add_action('wp_ajax_meta_sync_save_seo_controls', array($this, 'process_google_index_settings'), 5);
36		-
	44	+
37	45	// Display admin notices after redirect
38	46	add_action('admin_notices', array($this, 'display_admin_notices'));
39		-
	47	+
40	48	// AJAX handlers
41	49	add_action('wp_ajax_metasync_google_index_direct_test', array($this, 'ajax_test_connection'));
42	50	}
43	51
		@@ -96,9 +104,9 @@
96	104	if (!function_exists('google_index_direct')) {
97	105	if (file_exists(plugin_dir_path(__FILE__) . 'google-index-init.php')) {
98	106	require_once plugin_dir_path(__FILE__) . 'google-index-init.php';
99	107	} else {
100		- error_log('MetaSync Google Index: google-index-init.php not found at ' . plugin_dir_path(__FILE__) . 'google-index-init.php');
	108	+ error_log('MetaSync Google Index: google-index-init.php not found at ' . plugin_dir_path(__FILE__) . 'google-index-init.php'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
101	109	return;
102	110	}
103	111	}
104	112
		@@ -103,8 +111,12 @@
103	111	}
104	112
105	113	// Get current service account info (safe - doesn't expose private key)
106	114	$google_index = google_index_direct();
	115	+ if (!$google_index) {
	116	+ // Nothing to render against, and calling through would be fatal.
	117	+ return;
	118	+ }
107	119	$service_info = $google_index->get_service_account_info();
108	120	$is_configured = !isset($service_info['error']);
109	121
110	122	$saved_json_display = $is_configured ? $google_index->get_redacted_config_json() : '';
		@@ -119,112 +131,212 @@
119	131	*/
120	132	public function process_google_index_settings()
121	133	{
122	134	// Only process if our fields are present in the request
123		- if (!isset($_POST['google_index_service_account_json']) &&
124		- !isset($_POST['google_index_clear_config']) &&
125		- !isset($_FILES['google_index_service_account_file'])) {
	135	+ if (!isset($_POST['google_index_service_account_json']) && // phpcs:ignore WordPress.Security.NonceVerification.Missing -- early-return checks, a nonce is verified before any write
	136	+ !isset($_POST['google_index_clear_config']) && // phpcs:ignore WordPress.Security.NonceVerification.Missing -- early-return checks, a nonce is verified before any write
	137	+ !isset($_FILES['google_index_service_account_file'])) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- early-return checks, a nonce is verified before any write
126	138	return; // No Google Index data to process
127	139	}
128		-
	140	+
	141	+ if (!$this->authorize_settings_request()) {
	142	+ return;
	143	+ }
	144	+
	145	+ // Clearing does not need to load or inspect credential contents.
	146	+ if (isset($_POST['google_index_clear_config'])) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- authorize_settings_request() verified nonce and capability
	147	+ $this->clear_stored_service_account();
	148	+ $this->add_settings_notice('Service account configuration cleared successfully!', 'success');
	149	+ return;
	150	+ }
	151	+
	152	+ $result = $this->persist_submitted_service_account();
	153	+
	154	+ if ($result['status'] === 'error') {
	155	+ // The parent save is still mid-flight; aborting here with an error
	156	+ // keeps a bad credential from being reported as a successful save.
	157	+ wp_send_json_error([
	158	+ 'errors' => ['Google Index: ' . $result['message']],
	159	+ 'message' => 'Google Index: ' . $result['message'],
	160	+ ]);
	161	+ }
	162	+
	163	+ if ($result['status'] === 'unavailable') {
	164	+ // The sub-module is missing. Let the rest of the settings save
	165	+ // finish and surface this as a notice instead of failing the page.
	166	+ $this->add_settings_notice($result['message'], 'warning');
	167	+ return;
	168	+ }
	169	+
	170	+ if ($result['status'] === 'saved') {
	171	+ $this->add_settings_notice('Google Index service account configured successfully!', 'success');
	172	+ }
	173	+ }
	174	+
	175	+ /**
	176	+ * Read the submitted service account from $_POST/$_FILES, validate it, and
	177	+ * persist it when it is a genuinely new credential.
	178	+ *
	179	+ * Returns a status rather than emitting a response because the caller runs
	180	+ * inside another form's save: it must abort the parent save on a bad
	181	+ * credential, not answer for the whole request.
	182	+ *
	183	+ * @return array{status:string, message:string} status is one of:
	184	+ * 'saved' - a new credential was written
	185	+ * 'unchanged' - nothing to write (empty, or the redacted display text)
	186	+ * 'error' - validation or persistence failed; message explains why
	187	+ */
	188	+ private function persist_submitted_service_account()
	189	+ {
129	190	// Load Google Index functionality
130		- if (!function_exists('google_index_save_service_account')) {
	191	+ if (!$this->module_function_available('google_index_save_service_account')) {
131	192	if (file_exists(plugin_dir_path(__FILE__) . 'google-index-init.php')) {
132	193	require_once plugin_dir_path(__FILE__) . 'google-index-init.php';
133		- } else {
134		- error_log('MetaSync Google Index: google-index-init.php not found at ' . plugin_dir_path(__FILE__) . 'google-index-init.php');
135		- return;
136	194	}
	195	+
	196	+ // A partial deploy can leave the file present but the function
	197	+ // undefined, so re-check rather than assuming the require worked.
	198	+ if (!$this->module_function_available('google_index_save_service_account')) {
	199	+ error_log('MetaSync Google Index: google_index_save_service_account() unavailable; expected google-index-init.php at ' . plugin_dir_path(__FILE__) . 'google-index-init.php'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
	200	+
	201	+ // Deliberately NOT 'error'. This optional sub-module failing to
	202	+ // load must not abort the parent settings save — the embedded
	203	+ // caller would turn that into a wp_send_json_error() and take
	204	+ // the whole General Settings / Indexation Control page down.
	205	+ return ['status' => 'unavailable', 'message' => 'The Google Index module could not be loaded, so the service account was not saved.'];
	206	+ }
137	207	}
138		-
	208	+
139	209	$service_account_json = '';
140		-
	210	+
141	211	// Get JSON from textarea
142		- if (isset($_POST['google_index_service_account_json'])) {
143		- $service_account_json = sanitize_textarea_field(wp_unslash($_POST['google_index_service_account_json']));
	212	+ if (isset($_POST['google_index_service_account_json'])) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- private, callers verify a nonce and capability first
	213	+ $service_account_json = sanitize_textarea_field(wp_unslash($_POST['google_index_service_account_json'])); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- private, callers verify a nonce and capability first
144	214	}
145		-
	215	+
146	216	// Override with file upload if provided
147		- if (isset($_FILES['google_index_service_account_file']) &&
148		- !empty($_FILES['google_index_service_account_file']['tmp_name']) &&
149		- file_exists($_FILES['google_index_service_account_file']['tmp_name'])) {
150		-
151		- $uploaded_json = file_get_contents($_FILES['google_index_service_account_file']['tmp_name']);
	217	+ if (isset($_FILES['google_index_service_account_file']) && // phpcs:ignore WordPress.Security.NonceVerification.Missing -- private, callers verify a nonce and capability first
	218	+ !empty($_FILES['google_index_service_account_file']['tmp_name']) && // phpcs:ignore WordPress.Security.NonceVerification.Missing -- private, callers verify a nonce and capability first
	219	+ file_exists($_FILES['google_index_service_account_file']['tmp_name'])) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- private, callers verify a nonce and capability first
	220	+
	221	+ $uploaded_json = file_get_contents($_FILES['google_index_service_account_file']['tmp_name']); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- private, callers verify a nonce and capability first
152	222	if ($uploaded_json !== false) {
153	223	$service_account_json = $uploaded_json; // Removed unnecessary wp_unslash
154	224	}
155	225	}
156		-
157		- // Handle clear configuration
158		- if (isset($_POST['google_index_clear_config'])) {
159		- delete_option('google_index_service_account');
160		- // Success messages shown after redirect (to prevent interfering with MetaSync flow)
161		- $this->add_settings_notice('Service account configuration cleared successfully!', 'success');
	226	+
	227	+ if (empty($service_account_json) || trim($service_account_json) === '') {
	228	+ return ['status' => 'unchanged', 'message' => ''];
162	229	}
163		- // Process service account JSON if provided
164		- elseif (!empty($service_account_json) && trim($service_account_json) !== '') {
165		-
166		- // Skip if it contains redacted private key (user didn't paste new JSON)
167		- if (strpos($service_account_json, '-----REDACTED-----') !== false) {
168		- return; // Don't process redacted display text
	230	+
	231	+ // Skip if it contains redacted private key (user didn't paste new JSON)
	232	+ if (strpos($service_account_json, self::REDACTED_MARKER) !== false) {
	233	+ return ['status' => 'unchanged', 'message' => ''];
	234	+ }
	235	+
	236	+ $validation = $this->validate_service_account_json($service_account_json);
	237	+ if (!empty($validation['error'])) {
	238	+ return ['status' => 'error', 'message' => $validation['error']];
	239	+ }
	240	+
	241	+ if (!google_index_save_service_account($validation['data'])) {
	242	+ return [
	243	+ 'status' => 'error',
	244	+ 'message' => 'Failed to save service account configuration. Please try again or check your JSON format.',
	245	+ ];
	246	+ }
	247	+
	248	+ return ['status' => 'saved', 'message' => 'Google Index service account configured successfully!'];
	249	+ }
	250	+
	251	+ /**
	252	+ * Whether a function the optional Google Index sub-module provides exists.
	253	+ *
	254	+ * Taking the name as a parameter keeps the check opaque to static analysis,
	255	+ * which otherwise treats the second call in a load-then-verify pair as dead
	256	+ * because it cannot see that the intervening require_once may define it.
	257	+ *
	258	+ * Genuinely impure: the same argument yields a different answer once the
	259	+ * sub-module has been required, which is precisely why it is called twice.
	260	+ *
	261	+ * @phpstan-impure
	262	+ *
	263	+ * @param string $name Function name to look for.
	264	+ * @return bool
	265	+ */
	266	+ private function module_function_available($name)
	267	+ {
	268	+ return function_exists($name);
	269	+ }
	270	+
	271	+ /**
	272	+ * Decode and structurally validate a service account JSON string.
	273	+ *
	274	+ * @param string $json Raw JSON text.
	275	+ * @return array{data:array|null, error:string} error is '' when valid.
	276	+ */
	277	+ private function validate_service_account_json($json)
	278	+ {
	279	+ $data = json_decode($json, true);
	280	+
	281	+ if (json_last_error() !== JSON_ERROR_NONE) {
	282	+ $message = 'Invalid JSON format';
	283	+ switch (json_last_error()) {
	284	+ case JSON_ERROR_SYNTAX:
	285	+ $message .= ' - Syntax error in JSON';
	286	+ break;
	287	+ case JSON_ERROR_UTF8:
	288	+ $message .= ' - Invalid UTF-8 encoding';
	289	+ break;
	290	+ default:
	291	+ $message .= ' - ' . json_last_error_msg();
	292	+ break;
169	293	}
170		-
171		- // Decode and validate JSON
172		- $service_account_data = json_decode($service_account_json, true);
173		-
174		- if (json_last_error() !== JSON_ERROR_NONE) {
175		- // JSON parsing error - send immediate error response
176		- $json_error_message = 'Invalid JSON format';
177		- switch (json_last_error()) {
178		- case JSON_ERROR_SYNTAX:
179		- $json_error_message .= ' - Syntax error in JSON';
180		- break;
181		- case JSON_ERROR_UTF8:
182		- $json_error_message .= ' - Invalid UTF-8 encoding';
183		- break;
184		- default:
185		- $json_error_message .= ' - ' . json_last_error_msg();
186		- break;
187		- }
188		-
189		- wp_send_json_error([
190		- 'errors' => ['Google Index: ' . $json_error_message . '. Please check your service account JSON.']
191		- ]);
	294	+
	295	+ return ['data' => null, 'error' => $message . '. Please check your service account JSON.'];
	296	+ }
	297	+
	298	+ if (!is_array($data)) {
	299	+ return [
	300	+ 'data' => null,
	301	+ 'error' => 'JSON must be an object/array. Please check your service account JSON format.',
	302	+ ];
	303	+ }
	304	+
	305	+ $required_fields = ['type', 'project_id', 'private_key_id', 'private_key', 'client_email', 'client_id', 'auth_uri', 'token_uri'];
	306	+ $missing_fields = [];
	307	+
	308	+ foreach ($required_fields as $field) {
	309	+ if (!isset($data[$field]) || empty($data[$field])) {
	310	+ $missing_fields[] = $field;
192	311	}
193		-
194		- if (!is_array($service_account_data)) {
195		- wp_send_json_error([
196		- 'errors' => ['Google Index: JSON must be an object/array. Please check your service account JSON format.']
197		- ]);
	312	+ }
	313	+
	314	+ if (!empty($missing_fields)) {
	315	+ return [
	316	+ 'data' => null,
	317	+ 'error' => 'Missing required fields - ' . implode(', ', $missing_fields) . '. Please ensure you have a complete service account JSON.',
	318	+ ];
	319	+ }
	320	+
	321	+ return ['data' => $data, 'error' => ''];
	322	+ }
	323	+
	324	+ /**
	325	+ * Remove the stored service account and any token minted from it.
	326	+ *
	327	+ * A cached access token that outlives the credential it was issued for
	328	+ * would keep working until it expired.
	329	+ */
	330	+ private function clear_stored_service_account()
	331	+ {
	332	+ delete_option('google_index_service_account');
	333	+
	334	+ if (function_exists('google_index_direct')) {
	335	+ $instance = google_index_direct();
	336	+ if ($instance) {
	337	+ $instance->clear_token_cache();
198	338	}
199		-
200		- // Validate required fields
201		- $required_fields = ['type', 'project_id', 'private_key_id', 'private_key', 'client_email', 'client_id', 'auth_uri', 'token_uri'];
202		- $missing_fields = [];
203		-
204		- foreach ($required_fields as $field) {
205		- if (!isset($service_account_data[$field]) || empty($service_account_data[$field])) {
206		- $missing_fields[] = $field;
207		- }
208		- }
209		-
210		- if (!empty($missing_fields)) {
211		- wp_send_json_error([
212		- 'errors' => ['Google Index: Missing required fields - ' . implode(', ', $missing_fields) . '. Please ensure you have a complete service account JSON.']
213		- ]);
214		- }
215		-
216		- // Save using Google Index function
217		- $result = google_index_save_service_account($service_account_data);
218		-
219		- if ($result) {
220		- $this->add_settings_notice('Google Index service account configured successfully!', 'success');
221		- } else {
222		- // Send immediate error response using MetaSync's expected format
223		- wp_send_json_error([
224		- 'errors' => ['Google Index: Failed to save service account configuration. Please try again or check your JSON format.']
225		- ]);
226		- }
227	339	}
228	340	}
229	341
230	342	/**
		@@ -265,10 +377,10 @@
265	377	// Get and display notices
266	378	$notices = get_transient('google_index_admin_notices');
267	379	if (!empty($notices)) {
268	380	foreach ($notices as $notice) {
269		- $class = 'notice notice-' . esc_attr($notice['type']) . ' is-dismissible';
270		- echo '<div class="' . $class . '">';
	381	+ $class = 'notice notice-' . $notice['type'] . ' is-dismissible';
	382	+ echo '<div class="' . esc_attr($class) . '">';
271	383	echo '<p><strong>Google Index:</strong> ' . esc_html($notice['message']) . '</p>';
272	384	echo '</div>';
273	385	}
274	386
		@@ -282,10 +394,10 @@
282	394	*/
283	395	public function ajax_test_connection()
284	396	{
285	397	// Check nonce and permissions
286		- if (!wp_verify_nonce($_POST['nonce'] ?? '', 'metasync_google_index_direct_test') ||
287		- !Metasync::current_user_has_plugin_access()) {
	398	+ if (!current_user_can('manage_options') ||
	399	+ !wp_verify_nonce(wp_unslash($_POST['nonce'] ?? ''), 'metasync_google_index_direct_test')) {
288	400	wp_die('Security check failed');
289	401	}
290	402
291	403	// Load Google Index functionality
		@@ -292,9 +404,9 @@
292	404	if (!function_exists('google_index_direct')) {
293	405	if (file_exists(plugin_dir_path(__FILE__) . 'google-index-init.php')) {
294	406	require_once plugin_dir_path(__FILE__) . 'google-index-init.php';
295	407	} else {
296		- error_log('MetaSync Google Index: google-index-init.php not found at ' . plugin_dir_path(__FILE__) . 'google-index-init.php');
	408	+ error_log('MetaSync Google Index: google-index-init.php not found at ' . plugin_dir_path(__FILE__) . 'google-index-init.php'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
297	409	return;
298	410	}
299	411	}
300	412
		@@ -313,8 +425,40 @@
313	425	'message' => 'Test failed: ' . $e->getMessage()
314	426	]);
315	427	}
316	428	}
	429	+
	430	+ /**
	431	+ * Authorize the shared MetaSync settings AJAX action before secret handling.
	432	+ */
	433	+ private function authorize_settings_request()
	434	+ {
	435	+ if (!current_user_can('manage_options')) {
	436	+ wp_send_json_error(array('message' => 'Insufficient permissions.'), 403);
	437	+ }
	438	+
	439	+ $action = isset($_POST['action']) ? sanitize_key(wp_unslash($_POST['action'])) : '';
	440	+ $nonce_field = '';
	441	+ $nonce_action = '';
	442	+
	443	+ if ($action === 'meta_sync_save_settings') {
	444	+ $nonce_field = 'meta_sync_nonce';
	445	+ $nonce_action = 'meta_sync_general_setting_nonce';
	446	+ } elseif ($action === 'meta_sync_save_seo_controls') {
	447	+ $nonce_field = 'meta_sync_seo_controls_nonce';
	448	+ $nonce_action = 'meta_sync_seo_controls_nonce';
	449	+ }
	450	+
	451	+ if (
	452	+ $nonce_field === ''
	453	+ || !isset($_POST[$nonce_field])
	454	+ || !wp_verify_nonce(wp_unslash($_POST[$nonce_field]), $nonce_action)
	455	+ ) {
	456	+ wp_send_json_error(array('message' => 'Invalid nonce'), 403);
	457	+ }
	458	+
	459	+ return true;
	460	+ }
317	461
318	462	/**
319	463	* Enqueue admin scripts and styles
320	464	*/
		@@ -324,15 +468,14 @@
324	468	$page_slug = $this->get_metasync_page_slug();
325	469	if (strpos($hook, $page_slug) === false) {
326	470	return;
327	471	}
328		-
329		- // Only load on general tab (default tab when none specified)
330		- $current_tab = isset($_GET['tab']) ? $_GET['tab'] : 'general';
331		- if ($current_tab !== 'general') {
	472	+
	473	+ $current_tab = isset($_GET['tab']) ? sanitize_key(wp_unslash($_GET['tab'])) : 'general'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only page and tab check to enqueue scripts
	474	+ if ($current_tab !== 'general' && strpos($hook, 'seo-controls') === false) {
332	475	return;
333	476	}
334		-
	477	+
335	478	// Add inline JavaScript for functionality
336	479	wp_add_inline_script('jquery', $this->get_admin_javascript());
337	480	}
338	481
		@@ -346,61 +489,130 @@
346	489	$nonce = wp_create_nonce('metasync_google_index_direct_test');
347	490
348	491	return "
349	492	jQuery(document).ready(function($) {
	493	+ // What the textarea held immediately before a file overwrote it.
	494	+ // Seeded from the server-rendered value and re-snapshotted on each
	495	+ // file pick, so 'Remove' undoes exactly the file selection — it
	496	+ // does not also discard a credential the user typed by hand before
	497	+ // mis-clicking Choose File.
	498	+ var originalJsonValue = $('#google_index_service_account_json').val();
	499	+
	500	+ // Test Connection builds its results list as an HTML string. The
	501	+ // values come from the API/server rather than the page, so escape
	502	+ // them before they reach that sink.
	503	+ function escHtml(value) {
	504	+ return $('<div>').text(value === undefined || value === null ? '' : value).html();
	505	+ }
	506	+
	507	+ function showFileMessage(text, type) {
	508	+ var box = $('#google-index-file-messages');
	509	+ if (!box.length) { return; }
	510	+ box.empty();
	511	+ if (!text) { return; }
	512	+ var notice = $('<div>').addClass('notice notice-' + type + ' inline');
	513	+ notice.append($('<p>').text(text));
	514	+ box.append(notice);
	515	+ }
	516	+
	517	+ function clearSelectedFile(restoreTextarea) {
	518	+ var input = $('#google_index_service_account_file');
	519	+ if (input.length) {
	520	+ input.val('');
	521	+ }
	522	+ $('#google-index-selected-file').hide();
	523	+ $('#google-index-selected-file-name').text('');
	524	+ showFileMessage('', 'info');
	525	+
	526	+ if (restoreTextarea) {
	527	+ var textarea = $('#google_index_service_account_json');
	528	+ textarea.val(originalJsonValue);
	529	+ textarea.trigger('input').trigger('change');
	530	+ $('#metaSyncGeneralSetting, #metaSyncSeoControlsForm').trigger('change');
	531	+ }
	532	+ }
	533	+
350	534	// Integration with MetaSync's unsaved changes detection
351	535	function integrateWithUnsavedChangesDetection() {
352	536	// Monitor textarea for changes (avoid recursion)
353	537	$('#google_index_service_account_json').on('input change paste keyup', function(e) {
354		- console.log('Google Index: Textarea changed via', e.type);
355	538	// Trigger MetaSync's change detection (works on both Settings and Indexation Control pages)
356	539	$('#metaSyncGeneralSetting, #metaSyncSeoControlsForm').trigger('change');
357	540	});
358		-
	541	+
359	542	// Handle file upload with auto-populate and change detection
360	543	$('#google_index_service_account_file').on('change', function(e) {
361	544	var file = e.target.files[0];
362	545	var textarea = $('#google_index_service_account_json');
363		-
364		- if (file && file.type === 'application/json') {
365		- var reader = new FileReader();
366		- reader.onload = function(e) {
367		- try {
368		- var json = JSON.parse(e.target.result);
369		- // Update textarea value
370		- var jsonString = JSON.stringify(json, null, 2);
371		- textarea.val(jsonString);
372		-
373		- // Create and dispatch native events to ensure proper detection
374		- setTimeout(function() {
375		- // Create native events
376		- var inputEvent = new Event('input', { bubbles: true, cancelable: true });
377		- var changeEvent = new Event('change', { bubbles: true, cancelable: true });
378		-
379		- // Dispatch events on the actual DOM element (not jQuery)
380		- textarea[0].dispatchEvent(inputEvent);
381		- textarea[0].dispatchEvent(changeEvent);
382		-
383		- // Also trigger jQuery events as backup
384		- textarea.trigger('input').trigger('change');
385		-
386		- console.log('Google Index: File upload triggered change detection');
387		- }, 100);
388		- } catch (err) {
389		- alert('Invalid JSON file selected.');
390		- }
391		- };
392		- reader.readAsText(file);
393		- } else {
394		- // File upload indicates change even if not JSON (works on both Settings and Indexation Control pages)
395		- $('#metaSyncGeneralSetting, #metaSyncSeoControlsForm').trigger('change');
	546	+
	547	+ if (!file) {
	548	+ clearSelectedFile(true);
	549	+ return;
396	550	}
	551	+
	552	+ if (!file.name.toLowerCase().endsWith('.json')) {
	553	+ // Inline feedback instead of the old blocking alert().
	554	+ showFileMessage('\"' + file.name + '\" is not a .json file. Choose the service account key file you downloaded from Google Cloud.', 'error');
	555	+ $('#google-index-selected-file').hide();
	556	+ $('#google_index_service_account_file').val('');
	557	+ return;
	558	+ }
	559	+
	560	+ // Snapshot only when no file is currently selected, i.e. at
	561	+ // the START of a pick sequence. Re-snapshotting on every
	562	+ // pick would make Remove restore file A's contents after
	563	+ // the user picked A then B then removed — leaving a
	564	+ // credential in the box while the UI says no file is
	565	+ // selected.
	566	+ if (!$('#google-index-selected-file').is(':visible')) {
	567	+ originalJsonValue = textarea.val();
	568	+ }
	569	+
	570	+ var reader = new FileReader();
	571	+ reader.onload = function(ev) {
	572	+ try {
	573	+ var json = JSON.parse(ev.target.result);
	574	+ var jsonString = JSON.stringify(json, null, 2);
	575	+ textarea.val(jsonString);
	576	+
	577	+ $('#google-index-selected-file-name').text(file.name);
	578	+ $('#google-index-selected-file').show();
	579	+ showFileMessage('\"' + file.name + '\" loaded. Save the page to store it.', 'info');
	580	+
	581	+ // Create and dispatch native events to ensure proper detection
	582	+ setTimeout(function() {
	583	+ var inputEvent = new Event('input', { bubbles: true, cancelable: true });
	584	+ var changeEvent = new Event('change', { bubbles: true, cancelable: true });
	585	+
	586	+ textarea[0].dispatchEvent(inputEvent);
	587	+ textarea[0].dispatchEvent(changeEvent);
	588	+
	589	+ textarea.trigger('input').trigger('change');
	590	+ }, 100);
	591	+ } catch (err) {
	592	+ showFileMessage('\"' + file.name + '\" is not valid JSON. Re-download the key file from Google Cloud and try again.', 'error');
	593	+ $('#google-index-selected-file').hide();
	594	+ $('#google_index_service_account_file').val('');
	595	+ }
	596	+ };
	597	+ reader.onerror = function() {
	598	+ showFileMessage('\"' + file.name + '\" could not be read. Try choosing it again.', 'error');
	599	+ $('#google-index-selected-file').hide();
	600	+ $('#google_index_service_account_file').val('');
	601	+ };
	602	+ reader.readAsText(file);
397	603	});
	604	+
	605	+ // Remove/reselect
	606	+ $('#google-index-remove-file').on('click', function(e) {
	607	+ e.preventDefault();
	608	+ clearSelectedFile(true);
	609	+ });
398	610	}
399		-
	611	+
400	612	// Initialize integration after a small delay to ensure MetaSync is ready
401	613	setTimeout(integrateWithUnsavedChangesDetection, 100);
402		-
	614	+
403	615	// Handle test connection button
404	616	$('#google-index-test-connection').on('click', function(e) {
405	617	e.preventDefault();
406	618
		@@ -429,10 +641,10 @@
429	641	html += '<li><strong>Token Cached:</strong> ' + (results.token_test.cached ? '✅ Yes' : '⚪ No') + '</li>';
430	642	}
431	643
432	644	if (results.credentials_test) {
433		- html += '<li><strong>Service Account:</strong> ' + results.credentials_test.client_email + '</li>';
434		- html += '<li><strong>Project ID:</strong> ' + results.credentials_test.project_id + '</li>';
	645	+ html += '<li><strong>Service Account:</strong> ' + escHtml(results.credentials_test.client_email) + '</li>';
	646	+ html += '<li><strong>Project ID:</strong> ' + escHtml(results.credentials_test.project_id) + '</li>';
435	647	html += '<li><strong>Private Key:</strong> ' + (results.credentials_test.has_private_key ? '✅ Present' : '❌ Missing') + '</li>';
436	648	}
437	649
438	650	if (results.homepage_test) {
		@@ -438,11 +650,11 @@
438	650	if (results.homepage_test) {
439	651	if (results.homepage_test.success) {
440	652	html += '<li><strong>Homepage Status:</strong> ✅ Success</li>';
441	653	} else {
442		- html += '<li><strong>Homepage Status:</strong> ⚠️ ' + results.homepage_test.error.message + '</li>';
	654	+ html += '<li><strong>Homepage Status:</strong> ⚠️ ' + escHtml(results.homepage_test.error.message) + '</li>';
443	655	if (results.homepage_test.note) {
444		- html += '<li><strong>Note:</strong> ' + results.homepage_test.note + '</li>';
	656	+ html += '<li><strong>Note:</strong> ' + escHtml(results.homepage_test.note) + '</li>';
445	657	}
446	658	}
447	659	}
448	660
		@@ -448,9 +660,9 @@
448	660
449	661	html += '</ul></div>';
450	662	resultDiv.html(html);
451	663	} else {
452		- resultDiv.html('<div class=\"notice notice-error inline\"><p><strong>❌ Test Failed:</strong> ' + response.data.message + '</p></div>');
	664	+ resultDiv.html('<div class=\"notice notice-error inline\"><p><strong>❌ Test Failed:</strong> ' + escHtml(response.data.message) + '</p></div>');
453	665	}
454	666	},
455	667	error: function() {
456	668	resultDiv.html('<div class=\"notice notice-error inline\"><p><strong>❌ Connection Error:</strong> Unable to perform test.</p></div>');
		@@ -463,24 +675,27 @@
463	675
464	676	// Handle clear configuration button
465	677	$('#google-index-clear-config').on('click', function(e) {
466	678	e.preventDefault();
467		-
	679	+
468	680	if (!confirm('Are you sure you want to clear the service account configuration?')) {
469	681	return;
470	682	}
471		-
472		- // Create hidden input to indicate clear configuration request
	683	+
	684	+ // Embedded contexts: piggyback on the page's settings form.
473	685	var input = $('<input>')
474	686	.attr('type', 'hidden')
475	687	.attr('name', 'google_index_clear_config')
476	688	.attr('value', '1');
477		-
478		- // Append to form
479		- $('#metaSyncGeneralSetting').append(input);
480		-
481		- // Trigger the form's existing AJAX submission handler
482		- $('#metaSyncGeneralSetting').trigger('submit');
	689	+
	690	+ // Append to the correct form (Indexation Control vs General Settings) and submit via AJAX
	691	+ var clrForm = $('#metaSyncSeoControlsForm').length ? $('#metaSyncSeoControlsForm') : $('#metaSyncGeneralSetting');
	692	+ var clrAction = $('#metaSyncSeoControlsForm').length ? 'meta_sync_save_seo_controls' : 'meta_sync_save_settings';
	693	+ clrForm.append(input);
	694	+ var clrData = clrForm.serialize() + '&action=' + clrAction;
	695	+
	696	+ // Submit the clear request directly via AJAX, then reload
	697	+ $.ajax({ url: ajaxurl || metaSync.ajax_url, type: 'POST', data: clrData, complete: function() { window.location.reload(); } });
483	698	});
484	699
485	700	});
486	701	";