← All changes | includes/class-rest-manager.php +87 -9 1.0.2 → 1.3.3 View file →

		@@ -30,16 +30,25 @@
30	30	/**
31	31	* Register every route a module declared, prefixed with its slug.
32	32	*/
33	33	public static function register_module( Module $module ): void {
34		- $routes = $module->rest_routes();
35		- if ( empty( $routes ) ) {
36		- return;
37		- }
38		-
	34	+ // rest_routes() is resolved INSIDE the callback, not here.
	35	+ //
	36	+ // This method runs at plugins_loaded, before `init`. Calling
	37	+ // rest_routes() there makes a module build its settings schema, and
	38	+ // those schemas carry __() labels — so WordPress emitted a
	39	+ // _load_textdomain_just_in_time notice for every module, on every
	40	+ // request including the front end (135 per page load with WP_DEBUG on).
	41	+ // The eager call existed only to skip add_action() for modules with no
	42	+ // routes; deferring costs one no-op hook each and moves all translation
	43	+ // work to where it belongs. (QA, 9 Aug 2026)
39	44	add_action(
40	45	'rest_api_init',
41		- static function () use ( $module, $routes ) {
	46	+ static function () use ( $module ) {
	47	+ $routes = $module->rest_routes();
	48	+ if ( empty( $routes ) ) {
	49	+ return;
	50	+ }
42	51	$slug = $module->slug();
43	52	foreach ( $routes as $route ) {
44	53	$path = '/' . trim( $slug, '/' ) . '/' . ltrim( $route['path'] ?? '', '/' );
45	54	$path = rtrim( $path, '/' );
		@@ -90,23 +99,92 @@
90	99
91	100	if ( ! is_callable( $callback ) ) {
92	101	return new \WP_Error( 'xspeed_no_callback', 'Module REST callback is not callable.', array( 'status' => 500 ) );
93	102	}
94		- return call_user_func( $callback, $request );
	103	+
	104	+ return self::run_isolated( $callback, $request, $module->slug() );
95	105	};
96	106	}
97	107
98	108	/**
	109	+ * Backstop for every module REST callback. Containment, not a substitute
	110	+ * for per-query guards: callbacks should still avoid failing queries.
	111	+ *
	112	+ * Two things leak non-JSON into a REST body and break the client's
	113	+ * JSON.parse ("Unexpected token '<'"):
	114	+ * 1. $wpdb echoes "WordPress database error: …" as an HTML <div> the
	115	+ * instant a query fails, when display-errors is on (common on the
	116	+ * hosts we ship to). That HTML is flushed BEFORE our handler
	117	+ * returns, so a try/catch around the return value can't catch it.
	118	+ * We suppress $wpdb's echo for the duration of the call (errors are
	119	+ * still logged) and capture any other stray output via an output
	120	+ * buffer, discarding it so only our JSON reaches the client.
	121	+ * 2. A thrown Throwable would surface as a fatal/HTML error page. We
	122	+ * convert it to a clean 500 WP_Error.
	123	+ *
	124	+ * $wpdb's prior show-errors state and the buffer are always restored in
	125	+ * finally, so global state is untouched after the call.
	126	+ */
	127	+ private static function run_isolated( callable $callback, \WP_REST_Request $request, string $slug ) {
	128	+ global $wpdb;
	129	+
	130	+ $prev_show_errors = null;
	131	+ if ( $wpdb instanceof \wpdb ) {
	132	+ // hide_errors() returns the previous flag so we can restore it.
	133	+ $prev_show_errors = $wpdb->hide_errors();
	134	+ }
	135	+
	136	+ ob_start();
	137	+ try {
	138	+ $result = call_user_func( $callback, $request );
	139	+ } catch ( \Throwable $e ) {
	140	+ if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
	141	+ error_log( sprintf( '[xspeed] REST callback for "%s" threw: %s', $slug, $e->getMessage() ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Gated behind WP_DEBUG.
	142	+ }
	143	+ $result = new \WP_Error(
	144	+ 'xspeed_rest_exception',
	145	+ __( 'The request could not be completed due to a server error.', 'xspeed' ),
	146	+ array( 'status' => 500 )
	147	+ );
	148	+ } finally {
	149	+ // Discard anything the callback (or $wpdb) echoed — DB-error
	150	+ // HTML, notices, debug output — so the response body is JSON only.
	151	+ $stray = ob_get_clean();
	152	+ if ( '' !== $stray && defined( 'WP_DEBUG' ) && WP_DEBUG ) {
	153	+ error_log( sprintf( '[xspeed] discarded %d bytes of stray REST output from "%s"', strlen( $stray ), $slug ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Gated behind WP_DEBUG.
	154	+ }
	155	+ if ( $wpdb instanceof \wpdb && false !== $prev_show_errors && null !== $prev_show_errors ) {
	156	+ $wpdb->show_errors();
	157	+ }
	158	+ }
	159	+
	160	+ return $result;
	161	+ }
	162	+
	163	+ /**
99	164	* Wrap permission_callback with the always-on cap check. A module may
100	165	* declare its own permission_callback for an extra-strict gate; both
101	166	* must pass.
	167	+ *
	168	+ * A route may opt out of the capability check with
	169	+ * `'allow_unauthenticated' => true`. That is ONLY for endpoints designed to
	170	+ * be called by anonymous frontend visitors — the RUM beacon is the reason
	171	+ * this exists: it collects Core Web Vitals from real visitors, who by
	172	+ * definition are not logged in, so the default `manage_options` gate
	173	+ * rejected every sample with a 401 and the feature could never record
	174	+ * anything. (FBS-84070)
	175	+ *
	176	+ * Opting out drops ONLY the capability check. A route-declared
	177	+ * `permission_callback` still runs and still has to pass, so a module can
	178	+ * keep its own validation (nonce, rate limit, payload shape) on top.
102	179	*/
103	180	private static function wrap_permission( Module $module, array $route ): callable {
104	181	$declared = $route['permission_callback'] ?? null;
105	182	$capability = $route['capability'] ?? 'manage_options';
	183	+ $public = ! empty( $route['allow_unauthenticated'] );
106	184
107		- return static function ( \WP_REST_Request $request ) use ( $declared, $capability ) {
108		- if ( ! current_user_can( $capability ) ) {
	185	+ return static function ( \WP_REST_Request $request ) use ( $declared, $capability, $public ) {
	186	+ if ( ! $public && ! current_user_can( $capability ) ) {
109	187	return false;
110	188	}
111	189	if ( is_callable( $declared ) ) {
112	190	$result = call_user_func( $declared, $request );