Rock gated content by truongwp · Pull Request #3088 · Strategy11/formidable-forms

truongwp · 2026-04-27T13:33:13Z

Related PR: https://github.com/Strategy11/formidable-pro/pull/6451

Summary by CodeRabbit

New Features
- Gated Content action: configure gated items, generate timed access tokens, unlock private/passworded posts, and shortcode to render gated links or raw tokens
- Admin UX: dynamic item rows, autocomplete for many items, copy-shortcode support, and helper shortcode references in the form editor
Tests
- PHPUnit coverage for token generation, validation, resolution, and controller behavior
Chores
- Database schema updated to track gated tokens

Resolve conflicts in: - FrmAppHelper.php: keep db_version = 106 (required for gated tokens table) - formidable_admin.js: keep HEAD (includes gated content JS changes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coderabbitai · 2026-04-27T13:33:24Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a gated-content form action with token generation/storage/validation, DB table and migrations, admin UI/JS and styles, shortcode rendering, query hooks to unlock private/passworded posts, hook wiring, and unit/integration tests.

Changes

Gated Content Form Action Feature

Layer / File(s)	Summary
Core Data Models and Action `classes/models/FrmGatedItem.php`, `classes/models/FrmGatedToken.php`, `classes/models/FrmGatedContentAction.php`	Value objects for gated items and tokens, plus `FrmGatedContentAction` implementing the `gated_content` form action, post selectors, shortcodes, and settings sanitization.
Token Generation & Validation System `classes/helpers/FrmGatedTokenHelper.php`	Generates 32-character raw tokens, hashes and persists rows, manages per-request/transient caches, validates tokens via URL→cookie→user→filter chain, handles cookies and membership caching, and provides cleanup.
Database Schema & Versioning `classes/models/FrmMigrate.php`, `classes/helpers/FrmAppHelper.php`	Adds `frm_gated_tokens` table and bumps plugin DB version to 106; uninstall drops the table.
Post Access Control & Query Filtering `classes/controllers/FrmGatedContentController.php`	Includes private posts in main singular queries when a token validates, unlocks password-protected posts for a validated token (bypasses password check only for that post), strips `access_code` via redirect, and forces 404 for unauthorized private posts; clears caches on action updates/deletes.
Shortcode Handler & Display `classes/controllers/FrmGatedContentShortcodeController.php`	Implements `[frm_gated_content]` shortcode with modes `access_token`, `url`, and `link`, supporting single or list outputs and safe escaping.
Admin Settings UI & Templates `classes/views/frm-form-actions/_gated_content_settings.php`, `classes/views/frm-form-actions/_gated_content_item_row.php`, `classes/views/frm-form-actions/_gated_content_shortcodes.php`, `resources/scss/admin/components/form/_form-actions.scss`	Admin UI for configuring gated items, item row template, shortcode reference, autocomplete for large post lists, and styles for layout and copy controls.
Client-side Admin Logic `js/src/admin/admin.js`	Manages dynamic gated-content item rows: type activation, reindexing, deterministic per-row IDs, file-field filtering, and shortcode copy UX with fallback.
Hook Registration & Controller Wiring `classes/controllers/FrmFormActionsController.php`, `classes/controllers/FrmHooksController.php`, `classes/controllers/FrmFormsController.php`	Registers the `gated_content` action and wires daily token cleanup, action triggers, query/post hooks, save/delete handlers, shortcode callback, and passes form_id into helper shortcode generation.
Token Helper Unit Tests `tests/phpunit/helpers/test_FrmGatedTokenHelper.php`	Covers generation format/persistence/caching, validate_access_code behavior, expiry handling, and multi-source token resolution including filter fallback.
Controller Integration Tests `tests/phpunit/misc/test_FrmGatedContentController.php`	Tests that action triggers generate tokens and respect configured events (e.g., `payment-success`).

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested labels

run tests

Suggested reviewers

garretlaxton
Crabcyborg

Poem

🐰 I hopped through tokens, keys in paw,
I tucked a shortcode by the door,
Private posts now find a way,
Links and tokens lead the day,
A rabbit cheers the code once more.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'Rock gated content' is vague and generic, using unclear phrasing that does not convey specific information about the changeset despite implementing substantial gated content functionality.	Consider revising the title to be more descriptive, such as 'Add gated content feature with token validation' or 'Implement gated content access control system' to better communicate the main changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	Docstring coverage is 95.51% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch rock-gated-content

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-04-27T13:36:35Z

DeepSource Code Review

We reviewed changes in 4d7b13f...cdd8856 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Jul 1, 2026 8:41a.m.	Review ↗
JavaScript		Jul 1, 2026 8:41a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-04-27T13:37:50Z

+		const copyBtn = event.target.closest( '.frm_gc_copy_shortcode' );
+		if ( copyBtn ) {
+			const text = copyBtn.dataset.frmCopy;
+			if ( navigator.clipboard && navigator.clipboard.writeText ) {


Prefer using an optional chain expression instead, as it's more concise and easier to read

The optional chaining operator can be used to perform null checks before accessing a property, or calling a function.

deepsource-io · 2026-04-27T13:38:46Z

+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$raw_token = FrmGatedTokenHelper::get_raw_token_for_action( $action_id );
+		$this->assertNotNull(


Call to an undefined method test_FrmGatedContentController::assertNotNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T13:38:46Z

+	 * @covers FrmGatedContentController::trigger
+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T13:38:46Z

+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();
+		$entry_id = $this->factory->entry->create( array( 'form_id' => $form_id ) );


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T13:38:46Z

+
+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$this->assertNull(


Call to an undefined method test_FrmGatedContentController::assertNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T15:30:03Z

+	 * @param array $atts Shortcode attributes.
+	 * @return string Shortcode output, or empty string when no token is available.
+	 */
+	public static function shortcode( $atts ) {


`shortcode` has a cyclomatic complexity of 19 with "High" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-04-27T15:30:04Z

+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$raw_token = FrmGatedTokenHelper::get_raw_token_for_action( $action_id );
+		$this->assertNotNull(


Call to an undefined method test_FrmGatedContentController::assertNotNull()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-04-27T15:30:04Z

+	 * @covers FrmGatedContentController::trigger
+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T15:30:04Z

+	 */
+	public function test_payment_success_event_skips_non_matching_action() {
+		$form_id  = $this->factory->form->create();
+		$entry_id = $this->factory->entry->create( array( 'form_id' => $form_id ) );


Access to an undefined property test_FrmGatedContentController::$factory

The property you are trying to access is not defined and will cause unexpected behavior when used.

deepsource-io · 2026-04-27T15:30:04Z

+
+		FrmFormActionsController::trigger_actions( 'payment-success', $form_id, $entry_id );
+
+		$this->assertNull(


Call to an undefined method test_FrmGatedContentController::assertNull()

The method you are trying to call is not defined, which can result in a fatal error.

Crabcyborg · 2026-06-30T12:41:34Z

+	 */
+	private static function get_token_transient_key( $action_id ) {
+		$user_id = get_current_user_id();
+		$scope   = $user_id ? (string) $user_id : hash( 'sha256', FrmAppHelper::get_ip_address() );


@truongwp People on the same internet network could use the same IP address.

Is there more we can add here to help ensure uniqueness? Like user agent?

If we add the user agent check, the same user using different browsers won't work.

# Conflicts: # css/frm_admin.css # js/formidable_admin.js

deepsource-io · 2026-06-30T20:45:13Z

+		);
+
+		$this->assertNotNull( $row, 'Token row not found in DB.' );
+		$this->assertSame( $this->action_id, (int) $row->action_id );


Call to an undefined method test_FrmGatedTokenHelper::assertSame()

The method you are trying to call is not defined, which can result in a fatal error.

truongwp and others added 18 commits April 16, 2026 21:33

Add Gated content form action

30b8547

Create gated_tokens db table

56ccb14

Add gated token helper

347fa2d

Add code to trigger the gated content action

b84c0b4

Add code to obtain gated content token

709c312

Add gated content shortcode

60852cd

Handle password protected posts

e0e06c1

Fix open access for password protected pages not working

b0a3830

Add show=url to shortcode

69ebb2f

Support private pages

f12e90c

Use frm_clone_icon

3d338a6

Necessary code to add more gated content type

9b550ac

Add unit tests

32eeae2

Add support for running gated content in payment success

5b5b5b8

Update unit tests

334d5f9

Merge master into branch, keeping db_version 106 and built JS

6f0f023

Resolve conflicts in: - FrmAppHelper.php: keep db_version = 106 (required for gated tokens table) - formidable_admin.js: keep HEAD (includes gated content JS changes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix JS error when sorting fields and PHP error when duplicating form

20314c4

Use transient to temporarily store the gated content token

b95e703

deepsource-io Bot reviewed Apr 27, 2026

View reviewed changes

truongwp added 7 commits April 27, 2026 21:11

Fix PHPStan

27dab71

Fix PHPStan

e7b8988

Remove md5()

2c012f7

Fix deepsource error

d4c35aa

Fix Psalm

ccc67e3

Fix PHPStan

2a8d369

Revert deepsource config file

877e9e6

deepsource-io Bot reviewed Apr 27, 2026

View reviewed changes

Crabcyborg reviewed Jun 29, 2026

View reviewed changes

Comment thread classes/views/frm-form-actions/_gated_content_item_row.php Outdated

Crabcyborg reviewed Jun 29, 2026

View reviewed changes

Comment thread classes/helpers/FrmGatedTokenHelper.php Outdated

Crabcyborg reviewed Jun 29, 2026

View reviewed changes

Comment thread classes/helpers/FrmGatedTokenHelper.php Outdated

Crabcyborg reviewed Jun 29, 2026

View reviewed changes

Comment thread classes/helpers/FrmGatedTokenHelper.php Outdated