kristianwindandClaude Opus 5
539abf946c
`if git ls-files -z … | xargs -0 grep -nE …; then` has a false green in it. xargs exits 123 when ANY of its invocations exited 1-125, and grep exits 1 on no-match, so a run where one batch matched and another did not exits 123 — which `if` reads as clean, after grep has already printed the hit. Measured: one batch, a match xargs exit 0 -> caught one batch, no match xargs exit 123 -> clean, correct two batches, one match xargs exit 123 -> CLEAN, and it printed the hit Three checks here used that form: debug leftovers, short open tags, and the git-identity scan added two days ago. All three are one batch at this tree's size, so none of them is wrong today — this is a latent false green that arrives with the file list, not a bug anyone would see. Nothing in the output distinguishes the cases. scan_tracked() replaces it: one grep per file, verdict from the OUTPUT rather than any exit status, and a grep failure (exit > 1) reported instead of swallowed. Batching stops existing. The loop also yields the file count, which is the other thing all three were missing — "none" over zero files and "none" over nineteen were the same green. They now read "none in 19 tracked PHP files" and fail below a floor of one. The identity scan is also widened from ci/*.sh to every tracked file. A workflow step writes an identity into the runner's clone just as permanently, and ci/*.sh was scope chosen from where the first instance happened to live — the same "what are your checks pointed at" question as the contrast check. 13 files to 48. The new selftest row plants a write into a workflow file, which the old scope could not see at all. Reported by the Nolimit Security session, who hit the xargs case after widening their own scan from 13 files to 102. Three of my own probes were wrong before they were right, all the same class: the assertions grep for the check's message text, and widening the scope changed the wording from "A ci/ script sets …" to "A tracked file writes …". Five rows reported NOT FLAGGED while the check was working perfectly. They now match the stable half of the message, with the reason written beside them. And the form check matched the comment in static.sh that quotes the bad form in order to explain it, so it is anchored with ^[^#]* — the paragraph documenting a rule is text the rule applies to. That form check is a drift check on the shape and says so: it asserts the pattern is gone, not that the replacement is correct, because this tree's 48 files are one batch and nothing here can measure the fault. 46 selftest assertions. static=0 selftest=0 site=0; site still 69 assertions on WordPress 7.1.2 with WooCommerce 11.1.2. ci/ ships nothing, so no version bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
=== Nolimit Discounts === Contributors: kristianwind Tags: woocommerce, discount, email, shipping, coupon Requires at least: 5.8 Tested up to: 7.1.2 Requires PHP: 7.4 Stable tag: 1.6.2 WC requires at least: 6.0 WC tested up to: 11.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Apply discounts and show/hide shipping methods based on the customer's email address. == Description == Nolimit Discounts lets you give discounts and filter available shipping methods based on the email address a customer logs in or checks out with. = Discount Groups = * Create discount groups with a name and a discount percent. * Attach any number of WooCommerce product categories to a group (drag & drop ordering). * The group's discount percent applies to all products in the attached categories. = Email Assignments = Assign an email pattern to exactly one of three discount types: * **Group** — the customer inherits a discount group's percent and categories. * **Coupon** — an existing WooCommerce coupon is auto-applied at checkout. * **Custom** — a custom percent applied to the entire cart. Email patterns can be: * A full email address: `john@example.com` * A domain: `@company.com` (matches everyone on that domain) * A partial match: `john` (matches any email containing "john") Matching priority: exact email first, then domain, then partial match. Assignments can be toggled active/inactive and work for both logged-in users and guests (via the checkout billing email field, tracked with AJAX). Every assignment can additionally grant **free shipping** — all shipping methods become free at checkout for matching emails, regardless of the assignment type. Coupon assignments pick from your existing WooCommerce coupons in a dropdown. = Shipping Rules = * Per discount group, choose which shipping methods are shown or hidden. * No rules for a group means all shipping methods behave normally. * If any method is set to "Show", only "Show" methods are offered (whitelist). * Drag & drop reordering controls the order methods appear in at checkout. = How discounts are applied = * Group and custom discounts are applied as negative fees on the cart. * Coupons are applied via the standard WooCommerce coupon system. == Installation == 1. Upload the `woocommerce-email-discount-manager` folder to `/wp-content/plugins/`. 2. Make sure WooCommerce is installed and active. 3. Activate the plugin through the Plugins screen in WordPress. 4. Go to Nolimit → Discounts to configure groups, assignments and shipping rules. = REST API = The plugin exposes a `wc-edm/v1` namespace for remote management (groups, email assignments, shipping rules, audit log). Every route requires an authenticated user with the `manage_woocommerce` capability — use a WordPress Application Password over HTTPS. Requests are rate limited per user (or per IP when unauthenticated) and all changes are written to the audit log. Both are adjustable with filters: * `wc_edm_rate_limit_enabled` (bool) * `wc_edm_rate_limit_max_requests` (int, $method) * `wc_edm_rate_limit_window` (int seconds, $method) * `wc_edm_audit_log_enabled` (bool) * `wc_edm_audit_log_retention_days` (int) * `wc_edm_client_ip` (string) — override IP resolution behind a proxy/CDN == Frequently Asked Questions == = Does it work for guests? = Yes. When a guest types their email in the checkout billing email field, the plugin stores it in the WooCommerce session via AJAX and recalculates the cart, so discounts and shipping rules apply immediately. = What happens if several patterns match one email? = The most specific match wins: exact email, then domain, then partial match. == Changelog == = 1.6.2 = * Declares compatibility with WordPress 7.1.2 and WooCommerce 11.1.2, both tested. No functional change. = 1.6.1 = * The status label on the Nolimit dashboard card is now readable. It was white text on a light overlay, which on this plugin's green gave 3.5:1 where 4.5:1 is the accessibility minimum. = 1.6.0 = * A shipping method a group is shown is now reserved for that group: customers who match no group no longer see it. Previously a method set up for approved addresses stayed on the checkout for everyone, so free delivery meant for one company could be chosen by anybody. Customers are never left with no shipping method at all. = 1.4.6 = * Housekeeping: the plugin's source moved to a shorter address. Updates continue to arrive as before, and nothing needs doing. = 1.4.5 = * Fixed: the plugin could offer its own release as an update to a different plugin. Plugins that update from the same place share one check inside WordPress, and this one answered for all of them instead of only for itself. If another such plugin is installed, update it as well. * "Vis detaljer" next to the update notice now opens the plugin's own details, with the release notes as the changelog. It previously showed "Plugin not found", because WordPress was asking wordpress.org about a plugin that is not published there. = 1.4.4 = * A new version now shows up within about fifteen minutes instead of being hidden behind a six-hour cache. The plugin was holding on to its own answer for longer than WordPress waits before asking again, so a release could be published and the shop shown nothing. = 1.4.3 = * The plugin is now credited to Kristian Wind, with a link to where its source lives. It previously carried a placeholder name. = 1.4.2 = * The plugin now has an icon, so it no longer shows up as a generic grey plug under Dashboard → Updates. * "Check again" on the updates screen really does check again. It previously reused a cached answer for up to six hours, which made a brand new version look like it had not been published. = 1.4.1 = * The update check now builds the download address itself instead of using the one the repository reports. The repository was reporting a plain-HTTP address on a raw IP, which would have meant downloading plugin code over an unencrypted connection to an address that is free to change. Anyone on 1.4.0 gets this automatically with the next update. = 1.4.0 = * The plugin now updates itself. WordPress checks the plugin's own release feed and offers new versions in Plugins and Dashboard → Updates, so an update no longer means uploading a zip by hand. The per-plugin "Enable auto-updates" link works too. * Tested against WordPress 7.1 and WooCommerce 11.1, and against the next release of each, so an update to either is checked before it reaches a shop rather than after. * Nothing about the site is sent when it checks for updates. The request is an unauthenticated read of a public file, and the user agent is overridden because WordPress's default one carries the site's own address. = 1.3.1 = * Hardened loading: a class file that cannot be read is now recorded and reported in an admin notice instead of causing a fatal error. During a plugin upgrade WordPress replaces files one at a time, so a request landing mid-copy could previously take down wp-admin. * Admin tabs are only shown when their controller loaded, so an incomplete install costs a tab rather than the whole screen. = 1.3.0 = * Added an audit log: every change made through the REST API is recorded with user, IP, endpoint and time, along with rejected and rate limited requests. Viewable under WooCommerce → Email Discounts → Audit Log, and via GET /wp-json/wc-edm/v1/audit-log. * Added rate limiting on the REST API (default 60 reads and 20 writes per minute per user or IP), returning HTTP 429. Limits are filterable. * Entries are pruned automatically after 30 days (filterable). = 1.2.0 = * Added a free shipping toggle on email assignments — matching customers get all shipping methods at zero cost, works with every assignment type. * Coupon assignments now pick from the shop's existing WooCommerce coupons in a dropdown instead of a free-text field. * Database schema upgrades automatically after plugin updates (no re-activation needed). = 1.1.0 = * Added REST API (namespace wc-edm/v1) for remote management of groups, email assignments and shipping rules. All routes require an authenticated user with the manage_woocommerce capability (use an Application Password over HTTPS). = 1.0.0 = * Initial release: discount groups, email assignments (group/coupon/custom), shipping rules, dashboard.