…vider system (#1207) * feat: migrate from npm to pnpm - pnpm-workspace.yaml for workspace packages - workspace:* protocol for 45 inter-package deps - All CI workflows updated with pnpm/action-setup - Cold install: 92.6s → 42.1s (2.2x faster) - Warm install: 48.1s → 21.0s (2.3x faster) * fix(ci): use pnpm cache in tests.yml (was double-quoted npm) * fix: link URL field priority in CTA editor Changed priority from 1.2 to 5 so the link picker renders after the Action Type dropdown instead of before it (and before vanity URL). * fix(ci): address CodeRabbit review comments - Replace package-lock.json with pnpm-lock.yaml in change detection - Replace npm ci with pnpm install --frozen-lockfile in all workflows - Rename 'Install npm dependencies' step to 'Install pnpm dependencies' - Update .claude/skills/create-package.md to use pnpm - Add bash language to code fence (MD040) * fix: use pnpm publish in bump-and-publish-packages script npm publish leaves workspace:* specifiers unresolved. pnpm publish rewrites them to actual version ranges before publishing. Added --no-git-checks since publish runs from a script context. * fix(ci): remaining CodeRabbit findings - deploy-to-wordpress.yml: add pnpm setup step, fix cache and build command - build.yml: replace manual cache blocks with setup-node native pnpm cache, remove stale npm-cache-build conditional - ci.yml: guard problem matcher paths with file existence check - tests.yml: remove --quiet flag (pnpm forwards it to Jest, which rejects it) * fix: format bump-and-publish script, add react/react-dom devDeps - Auto-formatted bump-and-publish-packages.js (prettier) - Added react and react-dom as explicit devDeps (needed for Jest tests, were phantom-hoisted by npm) - Note: 5 test suites fail with same error on both npm and pnpm (pre-existing @testing-library/react issue, not pnpm-related) * fix(ci): remove duplicate pnpm setup step in build.yml * feat: admin notifications panel with toolbar markers + extensible provider system Adds a unified slide-in admin notifications panel to surface behaviorally- targeted tips, release announcements, and upsells — replacing the scattered admin-header notices for anything non-blocking. **New React package:** @popup-maker/admin-notifications - NotificationPanel, NotificationItem, NotificationFilters, NotificationPanelHeader - Composable hooks: usePanelOpenState, useNotifications, useMarkerSync - Uses MarkColored from @popup-maker/icons; matches design-handoff aesthetics - Supports 'iframe' action type for in-panel modal content (e.g. changelog viewer) **New PHP services (namespaced under PopupMaker\Services\Notifications):** - Manager — parent orchestrator, exposes popup_maker/notification_providers filter for addons to register their own providers - Provider interface — minimal contract (init()) for child providers - WhatsNew — auto-generated "What's new in X.Y" notification on major.minor release, parses Features/Improvements from readme.txt, overwrites slot on newer release with 'since' floor preserved - FeatureAnnouncements — behaviorally-targeted in-plugin tips/upsells: - CTA system adoption (if no CTAs exist) - Exit-intent upsell (10+ form conversions + no exit-intent triggers) - Ad-blocker bypass tip (conversions + setting off) - Scheduling upsell (3+ popups + stale/disabled signals) **Toolbar integration (ToolbarNotifications controller):** - Green [!] marker flush against the right edge of the PM admin sidebar menu - Matching [!] chip in the frontend admin bar + 'Notifications (N)' sub-node - Clicking either sets a localStorage flag and lets WP 7.0 soft-nav handle the transition — panel consumes flag on arrival, no URL pollution - Deep-linking via ?pum-notifications=open still works for shareable URLs **Legacy cleanup (classes/Utils/Alerts.php, classes/Admin/Notices.php):** - Removed whats_new_1_8_0 alert (2018-era, irrelevant) - Removed integration_alerts (BuddyPress addon unmaintained) - Removed pum_bfcm_2024 notice (expired) - Removed pum_block_editor_migration notice (shipped, no longer relevant) - Inline admin_notices rendering now gated to type=error/warning or global=true alerts only — everything else routes to the panel **REST API:** GET/POST at /wp-json/popup-maker/v2/notifications - Output sanitized server-side via wp_kses with PUM's allowed-tags list - URLs escaped with esc_url_raw - Capabilities via central $container->get_permission('edit_popups') mapping - Dismissal forwards expires param so 'Not now' actions can snooze (30-day TTL on upsells vs permanent dismiss via the corner X) **Performance:** FeatureAnnouncements caches the computed alert array in a 12h transient (flushed on save_post_popup). Cold compute is ~10ms; warm render is 0ms. WhatsNew caches parsed readme highlights similarly. * fix(notifications): accessibility — inert, focus rings, modifier clicks, live aria - NotificationPanel: apply `inert` when closed so keyboard users can't tab into the hidden close/filter/dismiss controls; `aria-modal` now reflects actual open state instead of being hardcoded - useMarkerSync: update data-count + pluralized aria-label on every change so screen readers announce the current count instead of the stale initial - usePanelOpenState: skip click interception on modifier/middle clicks so Cmd/Ctrl/Shift/middle-click still opens the target in a new tab; removed the asymmetric stopPropagation that leaked between the two branches - styles.scss: explicit :focus-visible rings on chips, dismiss buttons, and CTA variants that strip default button chrome Addresses CodeRabbit #13, #14, #15, #17. * fix(notifications): harden REST dismiss against unknown codes/actions - Validate the requested code against the current alert list before acting - Reject actions that aren't declared on the matched alert so callers can't fire arbitrary `pum_alert_dismissed` events - Derive `expires` from the declared action instead of trusting the request body — drops the unused `expires` request param entirely - Sanitize every scalar passed through prepare_alert_for_response (`code`/`type`/`category`/per-action fields) - Fix inline comment ending so PHPCS stays clean Addresses CodeRabbit #3, #4. * fix(notifications): locale-scope announcement cache + expand invalidation - Suffix the cache key with the current locale so two admins in different languages don't see each other's translated strings and locale-formatted numbers bleed through the shared transient - Track written cache keys in an option so flush clears every locale variant in one pass - Invalidate on CTA lifecycle events in addition to popup saves (save_post_pum_cta, deleted_post, trashed_post, untrashed_post) so `has_no_ctas()` doesn't keep promoting the CTA tip for up to 12 hours after a user creates their first CTA - Drop `-- ... --` dashed separator comments that tripped Squiz InvalidEndChar Addresses CodeRabbit #5, #6, #7. * fix(notifications): gate changelog iframe on install_plugins; fix section regex - Users with a custom `edit_popups` grant but without `install_plugins` (typical editor-style roles) would get a 403 in the iframe because plugin-install.php enforces that cap. The "View changelog" action now picks between the in-admin iframe viewer (when the cap is present) and a public wppopupmaker.com changelog link otherwise - Multi-word bold section headings like `**Bug Fixes**` or `**Breaking Changes**` previously failed the single-word terminator lookahead, so the Features/Improvements blocks kept consuming content past their real boundary. Terminator pattern now accepts multi-word + punctuation Addresses CodeRabbit #8, #9. * fix(notifications): defer provider boot past addon load window - Core plugin loads on plugins_loaded@11, but Pro/Pro+ addons hook in at @12-13. Running `Manager::init()` synchronously during Core construct applied the `popup_maker/notification_providers` filter before any addon had registered — those providers would never boot - Move the Manager boot to `init` (priority 5) so every addon that wants to register a provider has already done so - Make `Manager::init()` idempotent with a `booted` flag so repeated calls (e.g. from test fixtures or duplicate init fires) don't double up the provider hook registrations Addresses CodeRabbit #2. * fix(notifications): harden update-plugins badge strip regex The previous two-regex pass assumed one specific nesting of the legacy alerts-count bubble — any translation, attribute-order tweak, or added whitespace silently no-op'd the strip and left both the old red bubble and the new green chip rendered side-by-side. Replace with a single tolerant regex extracted into `strip_update_plugins_badge()` that: - matches any attribute order - accepts an extra class besides `update-plugins` - walks a single level of nested spans (the inner counter span WP injects) without being tripped by them - falls back to the original string when preg_replace returns null Addresses CodeRabbit #1. * fix(notifications): make external-link flag explicit instead of always _blank NotificationItem previously forced target="_blank" on every `type:'link'` action, including internal admin destinations (CTA admin page, Settings tab). That's inconsistent UX inside wp-admin. - NotificationAction type now carries optional `external?: boolean` and `target?: '_blank' | '_self'` - Component renders `target="_blank" rel="noopener noreferrer"` only when the action opts in (defaults to same-tab) - Store dismiss() no longer accepts an `expires` arg — the REST endpoint now derives it server-side from the declared action, so there's nothing to forward from the client Addresses CodeRabbit #12 and the related client-side trim for #3. * chore: align package.json — React 18 root + private admin-notifications - Root: downgrade `react` / `react-dom` to ^18.3.1 to match the peer ranges declared by workspace packages (block-library, components, cta-editor, icons). React 19 on root was triggering peer-dependency warnings (and potential runtime weirdness) under pnpm strict mode - admin-notifications package.json: add `"private": true` so it can't be accidentally published to npm; drop README.md + LICENSE from the `files` allowlist since those aren't present in the package Addresses CodeRabbit #10, #11. * fix(ci): use pnpm run build:production after pnpm install The "Install production dependencies" step installs via pnpm, but the following "Build production assets" step still called `npm run build:production`. Under pnpm's node_modules layout that would resolve through npm's hoisting expectations and fail (or worse, succeed inconsistently). Align the runner with the install. Addresses CodeRabbit #18. * fix(notifications): REST — panel-eligible gate, narrow kses allowlist, close vs dismiss - `find_alert_by_code()` now rejects non-panel-eligible alerts (`type: error|warning` or `global: true`) so POST /dismiss can't act on inline-rendered blockers the user never saw through this endpoint. Extracted `is_panel_eligible()` so `get_items()` uses the same gate. - `prepare_alert_for_response()` no longer borrows the broad legacy `PUM_Utils_Alerts::allowed_tags()` allowlist (which permitted script, form, input, button, select, option). New `panel_allowed_tags()` returns a minimal formatting set and fires `popup_maker/notifications/allowed_tags` for Pro/Pro+ to extend. - `resolve_action_expires()` now cleanly separates two intents: - action '' (corner X close) → always permanent, never inherits a declared "Not now" TTL, only allowed when `dismissible: true` - action 'dismiss' or other → must match a declared action on the alert, inherits that action's `expires` REST `action` arg default flipped to '' to match. - Reflowed the wrapped inline comments in dismiss_item and resolve_action_expires into `/* */` blocks. Addresses CodeRabbit round 2: A2, A3, A4, B1. * fix(notifications): WhatsNew — version-scoped alert code + locale cache key - `ALERT_CODE` was stable across every release, so dismissing v1.22's announcement wrote `pm_whats_new_release => true` into `_pum_dismissed_alerts` — which then suppressed v1.23's (and every future) announcement via `PUM_Utils_Alerts::has_dismissed_alert()`. The provider's own `on_dismiss()` cleanup handler does clear the slot, but that only runs when the alert gets to render, which never happened because the stable-code dismissal filtered it out first. Replaced with `ALERT_CODE_PREFIX + major.minor` so each release gets its own dismissal entry. - `parse_highlights()` cache key now includes the current locale, so rendered HTML (which contains translated "…and N more changes" footer text and locale-formatted numbers from _n()) doesn't leak across admins using different languages. - Reflowed wrapped `//` comments in the version-bump handler, parse helpers, and section regex into `/* */` blocks. Addresses CodeRabbit round 2: A6, A7, A8. * style(notifications): reflow wrapped // comments into /* */ blocks PHPCS's Squiz.Commenting.InlineComment sniff flags any `//` comment whose content wraps across multiple lines because each line is treated as a standalone inline comment that must end in terminal punctuation. Rewrap the multi-line explanatory comments into proper block comments (`/* … */`) so each comment has a single clear terminator. Addresses CodeRabbit round 2: A1, A5. * fix(notifications): a11y round 2 — focus trap, modal contentLabel, close vs dismiss - NotificationPanel: new `useFocusTrap` hook records the previously focused element on open, moves focus to the first focusable child inside the panel, wraps Tab/Shift+Tab inside it while open, and restores focus to the caller on close. Pairs with the existing `inert` attribute to give the role="dialog" proper modal behavior. - NotificationItem: Modal for the iframe viewer now sets `contentLabel` (to the action text or a localized "Details" fallback) so screen readers have an accessible name announce. The Modal's header is still hidden because the iframe carries its own chrome. - NotificationItem + store: corner X now dispatches `action: ''` instead of `action: 'dismiss'`, matching the new server-side semantics (close = always permanent, never inherits a declared "Not now" snooze). "Not now" buttons continue to send `action: 'dismiss'` and get the declared expires TTL. Addresses CodeRabbit round 2: A4 (client side), A9, B2. * chore(notifications): drop unused ToolbarNotifications::panel_url() * fix(notifications): a11y round 3 — aria-pressed, count label, popstate sync, typed selectors * chore(ci): finish npm → pnpm migration across workflows and publish script * fix(notifications): point CTA 'Learn more' at live tutorial slug The previous /docs/call-to-actions/ target returned 404. Swap to the canonical tutorial page until a proper CTA overview hub exists. * fix(notifications): route upsell CTAs to feature pages, not pricing Button copy reads 'See how X works' — informational, not transactional. Landing on the pricing grid was a trust-eroding mismatch. Route to dedicated feature landing pages (/features/exit-intent/ and /features/popup-scheduling/) which carry their own on-page upgrade CTA. * fix(notifications): fire pum_alert_dismissed on close/dismiss paths Core's PUM_Utils_Alerts::action_handler() only dispatches the pum_alert_dismissed hook for custom actions — empty and 'dismiss' short-circuit after writing user-meta. Providers registering an on-dismiss handler (e.g. WhatsNew clearing its release slot and writing last-seen) never got notified for the two most common paths. The resulting bug: WhatsNew's slot option was never cleared on dismissal, so while the alert was correctly suppressed per-user via user-meta, the global slot stayed populated and carried stale 'since' floors into future major.minor bumps. Fire the hook from the REST endpoint after a successful dismissal so providers see every close/dismiss consistently. Fix belongs in core action_handler long-term; this is the scoped fix for this plugin. * fix(notifications): align feature URLs with nested category structure Live site uses /features/<category>/<slug>/ (e.g. /features/popup-triggers/exit-intent-triggers/). Match the precedent: - exit-intent → popup-triggers/exit-intent-triggers (page exists) - scheduling → popup-automation/popup-scheduling (new category hub; stronger differentiated cluster than piling onto targeting) * fix(notifications): move scheduling under popup-targeting category Overruling my automation-category suggestion — targeting is the stronger cluster. Scheduling is the 'when' dimension of targeting, which sits alongside 'who' (conditions, device, geo) naturally. * docs(notifications): add central registry of all pum_alert_list notices Documents every notice registered across core + this plugin + Pro: delivery surfaces, dismissal model, per-notice conditions and destinations, and the process for adding a new one. Central reference so adding a notice doesn't require grep-walking six plugins. * docs(notifications): correct registry to reflect branch state Prior version described the legacy pre-cleanup alert set (whats_new_1_8_0, integration_alerts, etc.) based on grepping the wrong working directory (develop, not this branch). Updated to the actual current registry: adds pum_notice_<id> remote feed, php/wp min-req nags, and notes the legacy entries removed on this branch. * docs(notifications): document FeatureAnnouncements transient flush The 12h locale-scoped transient isn't cleared by 'wp cache flush' (it lives in the options table, not object cache). Add the one-liner that actually works — saved future-me an hour of head-scratching when URLs looked stale after a code change. * fix: address remaining CodeRabbit CR issues from rounds 1-4 - Skip malformed alert entries in get_items before calling prepare_alert_for_response. - Clean up synthetic tabindex attribute on focus trap unmount. - Include workspace package.json files in dependency change detection gate. - Remove continue-on-error mask on pnpm audit to surface failures properly. - Hook announcement cache flush to option updates for conditions like conversion counts and bypass settings. * fix(notifications): clear pending dismiss timeout on unmount Prevents React warnings about setting state on unmounted components when a notification item is removed before the 260ms dismiss animation completes. * fix(notifications): consult LAST_SEEN_OPTION when computing since floor on_dismiss() has been writing the dismissed major.minor to pum_whats_new_last_seen since round 1, but on_version_update() never read it back — so after a deactivate/reactivate cycle (where the update hook fires with an empty $old_version) the since floor would collapse to null and the next What's New card would lose its 'since vX.Y' continuity. * perf(notifications): memoize scheduling_stats per request needs_popup_scheduling() and scheduling_message() both walked every popup on every panel load. Cache the result in a class property so the scan runs once per request. needs_popup_scheduling() now consumes the same stats array as the message builder. * fix(a11y): focus trap only removes the synthetic tabindex it added Previously the cleanup unconditionally stripped tabindex off the container, which would clobber a caller-provided tabindex. Track whether we added it ourselves and only remove in that case. * chore(ci): include pnpm-workspace.yaml in dependency-change gate Workspace manifest changes can gate installs/audits the same as package.json and the lockfile. Add it so the detection job catches root-workspace edits too. * fix(notifications): don't slam panel closed on mount after localStorage open usePanelOpenState ran syncFromUrl() once on mount to 'reconcile with soft-nav URL changes' — but that clobbers the localStorage-flag open path used when the marker is clicked from non-PM admin pages. The URL on arrival has no ?pum-notifications=open (we used localStorage, not the URL), so the mount sync would force isOpen=false and flash the panel closed immediately after opening. The initial state is already authoritative (initiallyOpen reads both query param and localStorage flag via shouldOpenOnMount). popstate handler alone is enough for back/forward navigation. * fix(notifications): append tab slug as URL hash so settings page activates it The settings page's client-side tab switcher reads window.location.hash (assets/js/src/admin/settings-page/index.js:17), not the ?tab= query param. Emit both so the URL is semantically correct AND the right tab actually activates in the DOM. Affects the 'Enable bypass' action on pm_tip_adblock_bypass. * fix(notifications): stop panel from reopening after same-tab navigation Two bugs combined to make the panel 'stick' after clicking a link inside it: 1. Marker bootstrap set the localStorage open-flag even when the React panel was already on the current page. Intended for the non-PM-page → soft-nav case; fired everywhere instead. Clicking any same-tab link after that flag was set would auto-open the panel on arrival. 2. Link actions navigated while the URL still carried ?pum-notifications=open from the pushState on open. Strip the query param in the onClick handler for same-tab links so the destination page doesn't inherit 'open' state. * chore(deps): normalize pnpm-lock after merge Post-merge pnpm install switched a few internal workspace refs from file: to link: protocol. No version changes, just cleaner resolution. * style(phpcs): fix indentation in Assets.php after merge Merge conflict resolution left a block over-indented by one tab. PHPCBF autofix restores correct indentation.

Admin Menu Position Collission with Yumpu #9

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions