assets/js/checkout.js (2)

1071-1098: Consider extracting captcha token collection to a reusable helper.

This captcha token collection logic is duplicated from lines 912-932. Extracting it into a helper function would improve maintainability:

♻️ Optional refactor to reduce duplication

Add a helper method to the Vue instance:

getCaptchaTokens() {
    const tokens = {};
    
    const recaptcha = jQuery('input[name="g-recaptcha-response"]').filter(function() {
        return this.value;
    }).first().val();
    
    const hcaptcha = jQuery('input[name="h-captcha-response"]').filter(function() {
        return this.value;
    }).first().val();
    
    const cap = jQuery('input[name="cap-token"]').filter(function() {
        return this.value;
    }).first().val();
    
    if (recaptcha) tokens['g-recaptcha-response'] = recaptcha;
    if (hcaptcha) tokens['h-captcha-response'] = hcaptcha;
    if (cap) tokens['cap-token'] = cap;
    
    return tokens;
},

Then use it in both locations:

const login_data = {
    username_or_email,
    password: this.inline_login_password,
    _wpnonce: jQuery('[name="_wpnonce"]').val(),
    ...this.getCaptchaTokens()
};

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@assets/js/checkout.js` around lines 1071 - 1098, The captcha token collection
is duplicated; extract it into a reusable helper (e.g., getCaptchaTokens) on the
Vue instance and replace the duplicated blocks (including the construction of
inline_login_data and the earlier block at the other occurrence) by spreading
the helper's return into the data object; implement getCaptchaTokens to read the
three inputs ('g-recaptcha-response', 'h-captcha-response', 'cap-token'), return
an object with only the present tokens, and update places that currently build
inline_login_data (and the block around lines 912-932) to include
...this.getCaptchaTokens().

---

905-934: Captcha tokens are collected but the server-side handler doesn't pass them to the pre-auth filter.

The captcha tokens (g-recaptcha-response, h-captcha-response, cap-token) are correctly collected and sent to the server. However, examining inc/checkout/class-checkout.php (lines 1777-1788), the wu_before_inline_login filter only receives $username as context — the captcha tokens from the request are not passed to filter callbacks.

Plugins hooking into wu_before_inline_login will need to retrieve captcha tokens directly via wu_request('g-recaptcha-response') or similar, which works but is less explicit than passing them as filter arguments.

Consider updating the filter signature to include the request data:

-$pre_auth = apply_filters('wu_before_inline_login', null, $username);
+$pre_auth = apply_filters('wu_before_inline_login', null, $username, [
+    'g-recaptcha-response' => sanitize_text_field(wu_request('g-recaptcha-response')),
+    'h-captcha-response'   => sanitize_text_field(wu_request('h-captcha-response')),
+    'cap-token'            => sanitize_text_field(wu_request('cap-token')),
+]);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@assets/js/checkout.js` around lines 905 - 934, The filter call for
wu_before_inline_login only passes $username and should be extended to include
the incoming request data (or at minimum the captcha tokens) so hooked plugins
can access them; update the apply_filters('wu_before_inline_login', $username)
invocation in the checkout handler (inc/checkout/class-checkout.php) to pass a
second argument such as $request_data or an array of tokens (e.g.,
['g-recaptcha-response'=>..., 'h-captcha-response'=>..., 'cap-token'=>...]),
update the filter docblock to document the new parameter, and ensure backward
compatibility by keeping $username as the first arg (so existing callbacks still
receive it) and by noting that add_filter callbacks must accept the extra arg
(or use func_get_args where necessary).

inc/sso/class-wordpress-simple-cache.php (4)

188-201: Same coding standards fixes needed for deleteMultiple().

♻️ Proposed fixes

 public function deleteMultiple($keys) {
-    if (!is_array($keys) && !($keys instanceof \Traversable)) {
+    if ( ! is_array($keys) && ! ($keys instanceof \Traversable)) {
         throw new class('Keys must be an array or Traversable') extends \Exception implements InvalidArgumentException {};
     }

     $success = true;
     foreach ($keys as $key) {
-        if (!$this->delete($key)) {
+        if ( ! $this->delete($key)) {
             $success = false;
         }
     }

     return $success;
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@inc/sso/class-wordpress-simple-cache.php` around lines 188 - 201, The
deleteMultiple method should follow PSR-16 coding standards: change the
signature to accept iterable $keys and return bool, and throw the proper
InvalidArgumentException implementation rather than declaring an anonymous
class. Update deleteMultiple to declare function deleteMultiple(iterable $keys):
bool, validate $keys (throw new \Psr\SimpleCache\InvalidArgumentException with
the message when invalid), iterate over $keys calling $this->delete($key) and
return a boolean success flag; reference the deleteMultiple method and
InvalidArgumentException type in class-wordpress-simple-cache.php when making
these changes.

---

141-152: Address static analysis warnings for coding standards compliance.

The code quality checks flag spacing issues and missing @throws annotations.

♻️ Proposed fixes for coding standards

 /**
  * Obtains multiple cache items.
  *
  * `@since` 2.0.11
  *
  * `@param` iterable $keys    A list of keys.
  * `@param` mixed    $default Default value for missing keys.
  * `@return` iterable A list of key => value pairs.
- * `@throws` InvalidArgumentException If $keys is not iterable or contains illegal values.
+ * `@throws` InvalidArgumentException|\Exception If $keys is not iterable or contains illegal values.
  */
 public function getMultiple($keys, $default = null) {
-    if (!is_array($keys) && !($keys instanceof \Traversable)) {
+    if ( ! is_array($keys) && ! ($keys instanceof \Traversable)) {
         throw new class('Keys must be an array or Traversable') extends \Exception implements InvalidArgumentException {};
     }

     $result = [];
     foreach ($keys as $key) {
-        $result[$key] = $this->get($key, $default);
+        $result[ $key ] = $this->get($key, $default);
     }

     return $result;
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@inc/sso/class-wordpress-simple-cache.php` around lines 141 - 152, Add a
proper docblock above getMultiple() with `@param` iterable|string[] $keys, `@param`
mixed $default, `@return` array, and `@throws`
\Psr\SimpleCache\InvalidArgumentException; then fix spacing to match coding
standards (e.g. space around boolean operators and after commas) and replace the
anonymous exception declaration with a fully-qualified InvalidArgumentException
implementation (throw new class('Keys must be an array or Traversable') extends
\Exception implements \Psr\SimpleCache\InvalidArgumentException {}) or better
yet throw a named exception that implements
\Psr\SimpleCache\InvalidArgumentException; ensure the function signature and
return type remain unchanged and that the thrown exception type matches the
`@throws` docblock.

---

164-177: Same coding standards fixes needed for setMultiple().

♻️ Proposed fixes

 public function setMultiple($values, $ttl = null) {
-    if (!is_array($values) && !($values instanceof \Traversable)) {
+    if ( ! is_array($values) && ! ($values instanceof \Traversable)) {
         throw new class('Values must be an array or Traversable') extends \Exception implements InvalidArgumentException {};
     }

     $success = true;
     foreach ($values as $key => $value) {
-        if (!$this->set($key, $value, $ttl)) {
+        if ( ! $this->set($key, $value, $ttl)) {
             $success = false;
         }
     }

     return $success;
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@inc/sso/class-wordpress-simple-cache.php` around lines 164 - 177, In
setMultiple, replace the custom throw and array/Traversable check with
PSR-compliant code: change the parameter to accept iterable
(setMultiple(iterable $values, $ttl = null)) or at minimum use
is_iterable($values) for the validation, and when throwing, instantiate an
anonymous exception that extends \InvalidArgumentException and implements
\Psr\SimpleCache\InvalidArgumentException (e.g. throw new class('Values must be
iterable') extends \InvalidArgumentException implements
\Psr\SimpleCache\InvalidArgumentException {}), leaving the rest of the loop
logic intact.

---

115-128: Minor: Consider batching deletes for performance.

The loop deletes transients one at a time. For caches with many entries, this could be slow. Also, if any delete fails, the method continues but returns false at the end—this is correct behavior per PSR-16.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@inc/sso/class-wordpress-simple-cache.php` around lines 115 - 128, The current
loop over $results that calls delete_transient($transient_name) for each row is
slow for many entries; instead, build a batched deletion using the $wpdb API:
extract the transient option names from $results (use the same $transient_name
logic), construct a single DELETE query against $wpdb->options (or two queries
to remove both '_transient_%' and '_transient_timeout_%' rows) using WHERE
option_name IN (...) or WHERE option_name LIKE patterns, execute it and
determine success by comparing affected rows to the expected count, falling back
to calling delete_transient() for any names not removed; preserve the existing
$success boolean behavior (set false if any expected delete did not occur) and
keep the original variable names ($results, $transient_name, $success) to locate
the code.