| @@ -30,16 +30,25 @@ | ||
| 30 | 30 | /** |
| 31 | 31 | * Register every route a module declared, prefixed with its slug. |
| 32 | 32 | */ |
| 33 | 33 | public static function register_module( Module $module ): void { |
| 34 | - $routes = $module->rest_routes(); | |
| 35 | - if ( empty( $routes ) ) { | |
| 36 | - return; | |
| 37 | - } | |
| 38 | - | |
| 34 | + // rest_routes() is resolved INSIDE the callback, not here. | |
| 35 | + // | |
| 36 | + // This method runs at plugins_loaded, before `init`. Calling | |
| 37 | + // rest_routes() there makes a module build its settings schema, and | |
| 38 | + // those schemas carry __() labels — so WordPress emitted a | |
| 39 | + // _load_textdomain_just_in_time notice for every module, on every | |
| 40 | + // request including the front end (135 per page load with WP_DEBUG on). | |
| 41 | + // The eager call existed only to skip add_action() for modules with no | |
| 42 | + // routes; deferring costs one no-op hook each and moves all translation | |
| 43 | + // work to where it belongs. (QA, 9 Aug 2026) | |
| 39 | 44 | add_action( |
| 40 | 45 | 'rest_api_init', |
| 41 | - static function () use ( $module, $routes ) { | |
| 46 | + static function () use ( $module ) { | |
| 47 | + $routes = $module->rest_routes(); | |
| 48 | + if ( empty( $routes ) ) { | |
| 49 | + return; | |
| 50 | + } | |
| 42 | 51 | $slug = $module->slug(); |
| 43 | 52 | foreach ( $routes as $route ) { |
| 44 | 53 | $path = '/' . trim( $slug, '/' ) . '/' . ltrim( $route['path'] ?? '', '/' ); |
| 45 | 54 | $path = rtrim( $path, '/' ); |
| @@ -154,15 +163,28 @@ | ||
| 154 | 163 | /** |
| 155 | 164 | * Wrap permission_callback with the always-on cap check. A module may |
| 156 | 165 | * declare its own permission_callback for an extra-strict gate; both |
| 157 | 166 | * must pass. |
| 167 | + * | |
| 168 | + * A route may opt out of the capability check with | |
| 169 | + * `'allow_unauthenticated' => true`. That is ONLY for endpoints designed to | |
| 170 | + * be called by anonymous frontend visitors — the RUM beacon is the reason | |
| 171 | + * this exists: it collects Core Web Vitals from real visitors, who by | |
| 172 | + * definition are not logged in, so the default `manage_options` gate | |
| 173 | + * rejected every sample with a 401 and the feature could never record | |
| 174 | + * anything. (FBS-84070) | |
| 175 | + * | |
| 176 | + * Opting out drops ONLY the capability check. A route-declared | |
| 177 | + * `permission_callback` still runs and still has to pass, so a module can | |
| 178 | + * keep its own validation (nonce, rate limit, payload shape) on top. | |
| 158 | 179 | */ |
| 159 | 180 | private static function wrap_permission( Module $module, array $route ): callable { |
| 160 | 181 | $declared = $route['permission_callback'] ?? null; |
| 161 | 182 | $capability = $route['capability'] ?? 'manage_options'; |
| 183 | + $public = ! empty( $route['allow_unauthenticated'] ); | |
| 162 | 184 | |
| 163 | - return static function ( \WP_REST_Request $request ) use ( $declared, $capability ) { | |
| 164 | - if ( ! current_user_can( $capability ) ) { | |
| 185 | + return static function ( \WP_REST_Request $request ) use ( $declared, $capability, $public ) { | |
| 186 | + if ( ! $public && ! current_user_can( $capability ) ) { | |
| 165 | 187 | return false; |
| 166 | 188 | } |
| 167 | 189 | if ( is_callable( $declared ) ) { |
| 168 | 190 | $result = call_user_func( $declared, $request ); |
