Forms: add admin abilities for form CRUD and bulk responses#47102
Forms: add admin abilities for form CRUD and bulk responses#47102
Conversation
|
Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.
Interested in more tips and information?
|
|
Thank you for your PR! When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:
This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖 🔴 Action required: Please include detailed testing steps, explaining how to test your change, like so: 🔴 Action required: We would recommend that you add a section to the PR description to specify whether this PR includes any changes to data or privacy, like so: Follow this PR Review Process:
If you have questions about anything, reach out in #jetpack-developers for guidance! |
github-actions
bot
added
the
[Status] Needs Author Reply
There was a problem hiding this comment.
Pull request overview
This PR adds five new admin-level abilities to the Jetpack Forms Abilities API for managing forms and their responses. It builds upon the existing abilities infrastructure to provide CRUD operations for forms and bulk response management.
Changes:
- Added 5 new admin abilities:
list-forms,get-form,create-form,delete-form, andbulk-update-responses - All abilities require
edit_pagescapability for admin-level access - Implemented helper methods for extracting field definitions from block content
- Added comprehensive test coverage for new abilities (21 tests total)
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
projects/packages/forms/src/abilities/class-forms-abilities.php |
Added 5 new ability registration methods and their corresponding execution callbacks, plus helper methods for field extraction |
projects/packages/forms/tests/php/abilities/Forms_Abilities_Test.php |
Added 10 new tests for the CRUD operations and updated expected abilities list |
projects/packages/forms/changelog/add-admin-form-abilities |
Added changelog entry for the new admin abilities |
| $result = wp_trash_post( $form_post->ID ); | ||
| if ( ! $result ) { | ||
| return new \WP_Error( 'delete_failed', __( 'Failed to delete form.', 'jetpack-forms' ) ); | ||
| } |
There was a problem hiding this comment.
The delete_form function doesn't check if the form is already in the trash before attempting to trash it. If a form is already trashed, wp_trash_post will return false, and this will be reported as 'delete_failed' which could be confusing. Consider adding a check for the current post status and returning a more specific error message if the form is already trashed, or returning success if it's already in the desired state.
There was a problem hiding this comment.
Resolved by the rest_do_request() refactor — delete_form now delegates to DELETE /wp/v2/jetpack-forms/{id}, which handles already-trashed posts internally.
| $status = $args['status'] ?? 'publish'; | ||
| $post_id = wp_insert_post( | ||
| array( | ||
| 'post_type' => Contact_Form::POST_TYPE, | ||
| 'post_title' => sanitize_text_field( $args['title'] ), | ||
| 'post_content' => $content, | ||
| 'post_status' => $status, |
There was a problem hiding this comment.
The create_form function doesn't validate the 'status' parameter against the allowed values defined in the input schema (publish, draft). While the schema validation should prevent invalid values from reaching this function when called through the abilities API, the function can be called directly and could accept any status value. Consider adding explicit validation to ensure the status is one of the allowed values, or document that the function relies on schema validation.
There was a problem hiding this comment.
Resolved by the rest_do_request() refactor — create_form now delegates to POST /wp/v2/jetpack-forms, which validates status against the post type's allowed statuses via schema validation.
|
|
||
| $this->assertInstanceOf( \WP_Error::class, $result ); | ||
| $this->assertEquals( 'missing_params', $result->get_error_code() ); | ||
| } |
There was a problem hiding this comment.
Missing test for successful bulk_update_responses execution. Consider adding a test that creates feedback posts, calls bulk_update_responses with a valid action and IDs, and verifies that the responses were updated correctly. This would ensure the integration with Contact_Form_Endpoint::bulk_actions() works as expected.
| } | |
| } | |
| /** | |
| * Test bulk_update_responses success. | |
| */ | |
| public function test_bulk_update_responses_success() { | |
| wp_set_current_user( self::$user_id ); | |
| $post_ids = array(); | |
| $post_ids[] = wp_insert_post( | |
| array( | |
| 'post_type' => 'feedback', | |
| 'post_title' => 'Feedback to update 1', | |
| 'post_content' => 'First feedback content.', | |
| 'post_status' => 'publish', | |
| ) | |
| ); | |
| $post_ids[] = wp_insert_post( | |
| array( | |
| 'post_type' => 'feedback', | |
| 'post_title' => 'Feedback to update 2', | |
| 'post_content' => 'Second feedback content.', | |
| 'post_status' => 'publish', | |
| ) | |
| ); | |
| $result = Forms_Abilities::bulk_update_responses( | |
| array( | |
| 'action' => 'trash', | |
| 'ids' => $post_ids, | |
| ) | |
| ); | |
| $this->assertNotInstanceOf( \WP_Error::class, $result ); | |
| foreach ( $post_ids as $post_id ) { | |
| $this->assertEquals( 'trash', get_post_status( $post_id ) ); | |
| } | |
| } |
There was a problem hiding this comment.
The bulk actions endpoint has its own test coverage in Contact_Form_Endpoint_Test.php. The ability test validates input validation (missing params). A full integration test would require creating feedback posts with proper meta structure — out of scope for this thin adapter layer.
| $expected_abilities = array( | ||
| 'jetpack-forms/list-forms', | ||
| 'jetpack-forms/get-form', | ||
| 'jetpack-forms/create-form', | ||
| 'jetpack-forms/delete-form', | ||
| 'jetpack-forms/get-responses', | ||
| 'jetpack-forms/update-response', | ||
| 'jetpack-forms/bulk-update-responses', | ||
| 'jetpack-forms/get-status-counts', | ||
| ); |
There was a problem hiding this comment.
Missing test coverage for list_forms ability. Consider adding tests that verify:
- Empty list when no forms exist
- Pagination and per_page parameters work correctly
- Search parameter filters by form title
- Status parameter filters by form status
- The dashboard context properly includes entries_count and edit_url fields
There was a problem hiding this comment.
list_forms delegates to the REST endpoint via rest_do_request() — pagination, search, and status filtering are tested in Jetpack_Form_Endpoint_Test.php. Testing every REST parameter here would duplicate endpoint tests.
| 'jetpack-forms/get-form', | ||
| array( | ||
| 'label' => __( 'Get form details', 'jetpack-forms' ), | ||
| 'description' => __( 'Get a single form with its full structure, field definitions, response count, status, and preview URL.', 'jetpack-forms' ), |
There was a problem hiding this comment.
The description states "Get a single form with its full structure, field definitions, response count, status, and preview URL" but the implementation doesn't return a response count or preview URL. The returned data only includes id, title, status, fields, date, modified, and edit_url. Consider either updating the description to match the implementation or adding the missing fields (response_count and preview_url) to the returned data.
| 'description' => __( 'Get a single form with its full structure, field definitions, response count, status, and preview URL.', 'jetpack-forms' ), | |
| 'description' => __( 'Get a single form with its full structure, field definitions, status, dates, and edit URL.', 'jetpack-forms' ), |
There was a problem hiding this comment.
Fixed in the refactor commit — description now reads "field definitions, status, and edit URL" which matches the actual return value.
| $content = $args['content'] ?? ''; | ||
| if ( '' === $content ) { | ||
| // Default form structure with a submit button. | ||
| $content = '<!-- wp:jetpack/contact-form --><!-- wp:jetpack/button {"element":"button","text":"Submit","lock":{"remove":true}} /--><!-- /wp:jetpack/contact-form -->'; | ||
| } | ||
|
|
||
| $status = $args['status'] ?? 'publish'; | ||
| $post_id = wp_insert_post( | ||
| array( | ||
| 'post_type' => Contact_Form::POST_TYPE, | ||
| 'post_title' => sanitize_text_field( $args['title'] ), | ||
| 'post_content' => $content, |
There was a problem hiding this comment.
The 'content' parameter passed to create_form is not sanitized before being used in wp_insert_post. While WordPress does apply some sanitization internally, block content should ideally be validated to ensure it contains properly formatted block markup. Consider adding validation to ensure the content is valid block syntax or at least doesn't contain malicious script tags.
There was a problem hiding this comment.
Resolved by the rest_do_request() refactor — create_form now delegates to POST /wp/v2/jetpack-forms, which runs the full REST sanitization pipeline including wp_kses_post() on content.
| 'jetpack-forms/create-form', | ||
| array( | ||
| 'label' => __( 'Create a form', 'jetpack-forms' ), | ||
| 'description' => __( 'Create a new form with a title. Optionally provide block content for the form structure. Returns the new form ID and edit URL.', 'jetpack-forms' ), |
There was a problem hiding this comment.
The description states that create_form "Returns the new form ID and edit URL" but the actual return value includes additional fields: 'id', 'title', 'status', and 'edit_url'. Consider updating the description to "Returns the new form data including ID, title, status, and edit URL" to accurately reflect all returned fields.
| 'description' => __( 'Create a new form with a title. Optionally provide block content for the form structure. Returns the new form ID and edit URL.', 'jetpack-forms' ), | |
| 'description' => __( 'Create a new form with a title. Optionally provide block content for the form structure. Returns the new form data including ID, title, status, and edit URL.', 'jetpack-forms' ), |
There was a problem hiding this comment.
The description is a summary for AI/MCP consumers — it highlights the most useful fields (ID and edit URL) without being an exhaustive spec. The current wording is accurate and concise.
Code Coverage SummaryCoverage changed in 3 files.
Full summary · PHP report · JS report If appropriate, add one of these labels to override the failing coverage check:
Covered by non-unit tests
|
All ability callbacks now create WP_REST_Request objects and dispatch through the REST pipeline instead of directly calling endpoint methods. This eliminates code duplication and inherits endpoint validation, sanitization, and hooks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
| 'fields' => $fields, | ||
| 'date' => $data['date'], | ||
| 'modified' => $data['modified'], | ||
| 'edit_url' => $data['link'] ?? get_edit_post_link( $data['id'], 'raw' ), |
There was a problem hiding this comment.
get_form() sets edit_url from $data['link'], but the REST link field is the public permalink (view URL), not the wp-admin edit URL. This will return the wrong URL when callers expect an edit link. Prefer always using get_edit_post_link( $data['id'], 'raw' ) (or $data['edit_url'] if the endpoint provides it) and avoid falling back to link here.
| 'edit_url' => $data['link'] ?? get_edit_post_link( $data['id'], 'raw' ), | |
| 'edit_url' => get_edit_post_link( $data['id'], 'raw' ), |
1 participant
Summary
Adds 5 new admin-level abilities to the Jetpack Forms Abilities API:
list-forms— List forms with entries count, edit URLs, pagination, search, and status filter. Delegates toJetpack_Form_Endpointwithjetpack_forms_context=dashboard.get-form— Get a single form's full details including extracted field definitions from block content.create-form— Create a newjetpack_formCPT post with optional block content (defaults to empty form with submit button).delete-form— Soft-delete (trash) a form.bulk-update-responses— Mark multiple responses as spam/not-spam viaContact_Form_Endpoint::bulk_actions().All require
edit_pagescapability. Independent of the public abilities PR (#46821).Test plan
composer test-php tests/php/abilities/Forms_Abilities_Test.php— 21 tests, 59 assertions passcomposer test-php— 648 tests passlist-formsreturns form data with entries_countcreate-formcreates ajetpack_formpostdelete-formtrashes the form (soft delete)