README.md (1)

21-21: Badge repo switch looks good; consider aligning other repo links.

Many links still point to superdav42/wp-multisite-waas; update for consistency when convenient.

inc/objects/class-limitations.php (3)

86-90: Lazy-build is fine; add a defensive default.

Guard against missing/invalid entries to avoid edge notices.

Apply this diff:

- $module = self::build($this->raw_module_data[ $name ] ?? [], $name);
+ $data = isset($this->raw_module_data[$name]) ? $this->raw_module_data[$name] : [];
+ $module = self::build($data, $name);

---

181-188: Prevent undefined index notices in has_limitations().

Some modules may omit 'enabled'. Use a safe coalesce.

Apply this diff:

- foreach ($this->raw_module_data as $module) {
-     if ($module['enabled']) {
-         return true;
-     }
- }
- return false;
+ foreach ($this->raw_module_data as $module) {
+     if (is_array($module) && ! empty($module['enabled'])) {
+         return true;
+     }
+ }
+ return false;

---

200-201: is_module_enabled() is fine; optional stricter cast.

Consider (bool) for clarity.

Apply this diff:

- return $this->raw_module_data[ $module_name ]['enabled'] ?? false;
+ return (bool) ($this->raw_module_data[$module_name]['enabled'] ?? false);

tests/WP_Ultimo/Objects/Limitations_Test.php (3)

79-86: Avoid coupling tests to internals: prefer public API over reflection of raw_module_data

Asserting via the protected raw_module_data makes tests brittle. Use the public to_array() instead.

Apply:

-// Use reflection to access protected modules property
-$reflection = new \ReflectionClass($limitations);
-$modules_property = $reflection->getProperty('raw_module_data');
-$modules_property->setAccessible(true);
-$modules = $modules_property->getValue($limitations);
+$modules = $limitations->to_array();

---

200-207: Same here: stop reflecting raw_module_data; assert via to_array()

Keeps tests resilient to future refactors.

Apply:

-// Use reflection to access protected modules property
-$reflection = new \ReflectionClass($limitations);
-$modules_property = $reflection->getProperty('raw_module_data');
-$modules_property->setAccessible(true);
-$modules = $modules_property->getValue($limitations);
+$modules = $limitations->to_array();

---

287-292: Redundant assertion; tighten the check

assertNotFalse + assertTrue is redundant; also assert the type.

Apply:

-    if ($should_exist) {
-      $this->assertNotFalse($result);
-      $this->assertTrue($result);
-    } else {
+    if ($should_exist) {
+      $this->assertIsBool($result);
+      $this->assertTrue($result);
+    } else {
       $this->assertFalse($result);
     }

views/domain/dns-table.php (1)

78-81: Render human-friendly Yes/No and handle undefined state

Booleans render as “true/false”. Show localized Yes/No; optionally guard for undefined.

Apply:

-    <tr>
-      <td colspan="2"><?php esc_html_e('Domain connected to site?', 'multisite-ultimate'); ?></td>
-      <td colspan="2" class="wu-text-left">{{ results.has_correct_dns }}</td>
-    </tr>
+    <tr>
+      <td colspan="2"><?php esc_html_e('Domain connected to site?', 'multisite-ultimate'); ?></td>
+      <td colspan="2" class="wu-text-left">
+        <span v-if="results && results.has_correct_dns === true"><?php esc_html_e('Yes', 'multisite-ultimate'); ?></span>
+        <span v-else-if="results && results.has_correct_dns === false"><?php esc_html_e('No', 'multisite-ultimate'); ?></span>
+        <span v-else>—</span>
+      </td>
+    </tr>

Please confirm that the frontend payload feeding this template includes results.has_correct_dns. If not, we should add it where the DNS data is assembled.

inc/models/class-domain.php (1)

400-410: Early short-circuit via secret verification looks good

Nicely preserves the DNS path while enabling Cloudflare-friendly verification behind a filter.

Minor: drop the unused local variable.

-    $domain_manager = \WP_Ultimo\Managers\Domain_Manager::get_instance();
-    $secret_verification_enabled = apply_filters('wu_enable_secret_domain_verification', true, $this);
+    $secret_verification_enabled = apply_filters('wu_enable_secret_domain_verification', true, $this);
     if ( $secret_verification_enabled ) {
-      $secret_result = $domain_manager->verify_domain_with_secret($domain_url);
+      $secret_result = \WP_Ultimo\Managers\Domain_Manager::get_instance()->verify_domain_with_secret($domain_url);
       if ( $secret_result ) {
         return true;
       }
     }

inc/managers/class-domain-manager.php (3)

1027-1037: Harden JSON parsing and shape checks

Guard against invalid/HTML responses from proxies or WAFs.

Apply:

-    $body = wp_remote_retrieve_body($response);
-    $data = json_decode($body, true);
+    $body = wp_remote_retrieve_body($response);
+    $data = json_decode($body, true);
+    if (!is_array($data)) {
+      wu_log_add(
+        "domain-verification-{$domain}",
+        __('Verification endpoint returned invalid JSON.', 'multisite-ultimate'),
+        LogLevel::WARNING
+      );
+      return false;
+    }

---

914-931: Tighten REST arg validation for domain parameter

Add validate_callback; also consider making TTL filterable.

Apply:

-        'args'                => array(
-          'domain' => array(
-            'required'          => true,
-            'sanitize_callback' => 'sanitize_text_field',
-          ),
-        ),
+        'args'                => array(
+          'domain' => array(
+            'required'          => true,
+            'sanitize_callback' => 'sanitize_text_field',
+            'validate_callback' => function ($param) {
+              return (bool) filter_var($param, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
+            },
+          ),
+        ),

And in generate_domain_verification_secret, make TTL filterable:

-    set_site_transient("wu_domain_verification_{$domain}", $secret, 5 * MINUTE_IN_SECONDS);
+    set_site_transient(
+      "wu_domain_verification_{$domain}",
+      $secret,
+      (int) apply_filters('wu_domain_verification_ttl', 5 * MINUTE_IN_SECONDS, $domain)
+    );

---

967-974: Optional: use cryptographically strong generator

wp_generate_password is fine here, but random_bytes(16) + bin2hex() is stronger.

Apply:

-    $secret = wp_generate_password(32, false);
+    $secret = bin2hex(random_bytes(16));

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

assets/js/domain-logs.js (1)

15-15: Safer log rendering via text(); preserve formatting and add null-safety

Good XSS hardening. To avoid collapsing newlines and to guard missing data:

Apply:

-$('#content').text(response.data.contents);
+$('#content').text((response && response.data && typeof response.data.contents === 'string') ? response.data.contents : '');

Optionally ensure CSS preserves line breaks:

#content { white-space: pre-wrap; font-family: monospace; }

inc/models/class-domain.php (1)

609-609: Docblock return type should include null

Method returns an instance or null; reflect that to aid static analysis.

- * @return static
+ * @return static|null

inc/class-domain-mapping.php (1)

245-262: Harden async verification response (no-cache, consistent shape, unused params)

• Prevent proxies from caching the JSON.
• Use wp_send_json_success for a consistent payload.
• Mark unused parameters to satisfy static analyzers.

-public function verify_dns_mapping($current_site, $domain, $path) {
+public function verify_dns_mapping($_current_site, $domain, $_path) {
   // Nonce functions are unavailable and the wp_hash is basically the same.
   if (isset($_REQUEST['async_check_dns_nonce'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
     // This is very early in the request we need these to use wp_hash.
     require_once ABSPATH . WPINC . '/l10n.php';
     require_once ABSPATH . WPINC . '/pluggable.php';
-    if (hash_equals(wp_hash($domain), $_REQUEST['async_check_dns_nonce'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
+    $nonce = (string) $_REQUEST['async_check_dns_nonce']; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
+    if (hash_equals(wp_hash($domain), $nonce)) {
       $domains = $this->get_www_and_nowww_versions($domain);
 
       $mapping = Domain::get_by_domain($domains);
       if ($mapping) {
-        wp_send_json($mapping->to_array());
+        nocache_headers();
+        wp_send_json_success($mapping->to_array());
       }
     }
   }
 }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.