Ship 1.6.0: Abilities permission fix, private data storage, HTML API content filters

.distignore

@@ -1,12 +1,15 @@
-# Development
-.git
-.github
-.gitignore
-.distignore
-node_modules
-vendor
-tests
-coverage
+# Development. Leading slashes anchor these to the plugin root so a bundled
+# path such as assets/vendor/ is not swept up with Composer's vendor/.
+/.git
+/.github
+/.gitignore
+/.distignore
+/node_modules
+/vendor
+/tests
+/coverage
+/src
+/docs
 
 # Config
 .editorconfig
@@ -17,11 +20,12 @@ phpcs.xml*
 phpstan.neon
 
 # Build tools
-build.sh
-package.json
-package-lock.json
-composer.json
-composer.lock
+/build.sh
+/bin
+/package.json
+/package-lock.json
+/composer.json
+/composer.lock
 
 # IDE
 .idea/
@@ -45,7 +49,7 @@ CLAUDE.md
 *~
 
 # Misc
-build-release/
-.wordpress-org/
-landing-page.html
-LICENSE
+/build-release/
+/.wordpress-org/
+/landing-page.html
+/LICENSE

.github/workflows/quality.yml

@@ -43,12 +43,25 @@ jobs:
       - run: git diff --exit-code -- assets/js/wp7-admin.js assets/js/wp7-admin.asset.php assets/js/wp7-admin.css assets/js/wp7-admin-rtl.css assets/js/wp7-dataviews.css assets/js/wp7-dataviews-rtl.css
       - run: composer install --no-interaction --prefer-dist
       - run: composer phpcs
+
+      # The content filters run on WordPress's HTML API. Fetch just that part of
+      # core so those tests execute instead of skipping.
+      - name: Fetch the WordPress HTML API
+        run: |
+          git clone --depth=1 --filter=blob:none --sparse https://github.com/WordPress/wordpress-develop.git /tmp/wordpress
+          git -C /tmp/wordpress sparse-checkout set src/wp-includes
       - run: composer test
+        env:
+          FUNCTIONALITIES_WP_DIR: /tmp/wordpress/src
+
+      - name: Translation template is current
+        run: ./bin/make-pot.sh --check
       - run: |
           for file in $(find assets -name '*.js' -type f); do
             node --check "$file"
           done
       - run: bash -n build.sh
+      - run: bash -n bin/make-pot.sh
 
   package:
     name: Distribution package
@@ -72,6 +85,10 @@ jobs:
             functionalities/includes/core/class-module-registry.php \
             functionalities/includes/core/class-wordpress-7-integration.php \
             functionalities/includes/storage/class-atomic-json-store.php \
+            functionalities/includes/storage/class-data-directory.php \
+            functionalities/assets/vendor/prism/prism.min.js \
+            functionalities/assets/vendor/prism/prism.min.css \
+            functionalities/languages/functionalities.pot \
             functionalities/assets/js/admin-redirects.js \
             functionalities/assets/js/admin-tools.js \
             functionalities/assets/js/wp7-admin.js \
@@ -82,7 +99,7 @@ jobs:
             functionalities/assets/blocks/svg-icon/block.json; do
             unzip -Z1 "$zip" | grep -qx "$required"
           done
-          if unzip -Z1 "$zip" | grep -Eq '(^|/)(tests|vendor|node_modules|\.git|\.github)/|composer\.(json|lock)$|\.md$'; then
+          if unzip -Z1 "$zip" | grep -Eq '(^|/)(tests|node_modules|src|docs|\.git|\.github)/|/vendor/(composer|bin)/|composer\.(json|lock)$|package\.json$|\.md$'; then
             echo 'Development files leaked into the distribution.' >&2
             exit 1
           fi

.github/workflows/release.yml

@@ -107,6 +107,9 @@ jobs:
             "includes/admin/class-admin.php" \
             "includes/admin/class-admin-ui.php" \
             "includes/core/class-wordpress-7-integration.php" \
+            "includes/storage/class-data-directory.php" \
+            "assets/vendor/prism/prism.min.js" \
+            "languages/functionalities.pot" \
             "assets/js/wp7-admin.js" \
             "assets/js/wp7-admin.asset.php" \
             "assets/js/wp7-admin.css" \

.gitignore

@@ -12,9 +12,10 @@ Thumbs.db
 *.swo
 *~
 
-# Dependencies
-node_modules/
-vendor/
+# Dependencies. Both are anchored to the repo root: an unanchored
+# `vendor/` also matches assets/vendor/, which is shipped source.
+/node_modules/
+/vendor/
 
 # Log files
 *.log

README.md

@@ -2,7 +2,9 @@
 
 All-in-one WordPress optimization toolkit with 16 modules for performance, security, SEO, and content management. Built with modern WordPress coding standards and a clean module-based dashboard. Optimized for performance with modular initialization, static property caching, and intelligent transients.
 
-**Version:** 1.5.0
+**Version:** 1.6.0
+**Requires WordPress:** 6.3 or later (tested up to 7.1)
+**Requires PHP:** 7.4 or later
 **License:** GPL-2.0-or-later
 **Text Domain:** `functionalities`
 **Pricing:** Free
@@ -18,7 +20,21 @@ All-in-one WordPress optimization toolkit with 16 modules for performance, secur
 
 All modules are accessed through a unified dashboard at `wp-admin/admin.php?page=functionalities`. Click any module card to configure its settings.
 
-Learn more on [Functionalities Site](https://functionalities.dev)
+## Documentation
+
+Full documentation is at **[functionalities.dev](https://functionalities.dev/)**:
+
+| | |
+|---|---|
+| [Getting started](https://functionalities.dev/docs/getting-started) | Install, enable a module, verify it works |
+| [Module reference](https://functionalities.dev/modules) | What each of the 16 modules does |
+| [Dashboard](https://functionalities.dev/docs/dashboard) | Working with the module dashboard |
+| [Hooks](https://functionalities.dev/docs/hooks) | Every action and filter the plugin fires |
+| [API reference](https://functionalities.dev/docs/api-reference) | Extending the plugin in code |
+| [FAQ](https://functionalities.dev/faq) | Common questions |
+| [Downloads](https://functionalities.dev/download) | Current and previous releases |
+
+Per-module guides: [Link Management](https://functionalities.dev/docs/link-management) · [Redirect Manager](https://functionalities.dev/docs/redirect-manager) · [Login Security](https://functionalities.dev/docs/login-security) · [Performance & Cleanup](https://functionalities.dev/docs/performance) · [Schema](https://functionalities.dev/docs/schema) · [Snippets](https://functionalities.dev/docs/snippets) · [SVG Icons](https://functionalities.dev/docs/svg-icons) · [Block Cleanup](https://functionalities.dev/docs/block-cleanup) · [Content Integrity](https://functionalities.dev/docs/content-regression) · [Assumption Detection](https://functionalities.dev/docs/assumption-detection) · [Task Manager](https://functionalities.dev/docs/task-manager)
 
 See the [public roadmap](ROADMAP.md) for planned fixes and features.
 
@@ -31,8 +47,8 @@ This plugin is built with a "Performance First" philosophy. Unlike many all-in-o
 - **Modular Initialization:** Each module checks its enabled state before registering its feature hooks. Disabled modules add no frontend assets or feature behavior.
 - **Minimized Database Load:** All module settings are cached in static properties. This ensures that `get_option()` is called at most once per module per request, regardless of how many times a feature is accessed.
 - **Zero Frontend Bloat:** Most modules are "Zero Footprint" on the frontend, meaning they load no CSS or JS unless explicitly required (like the Components or Fonts modules).
-- **Intelligent Filtering:** Content filters (`the_content`, etc.) use `strpos()` fast-exit checks. If the specific markers or tags for a feature aren't present in your content, the plugin exits immediately without running expensive regular expressions or DOM parsing.
-- **Efficient HTML Processing:** We use targeted regex for lightweight tasks (like Schema injection) and only resort to `DOMDocument` when structural manipulation is strictly necessary, ensuring maximum speed.
+- **Intelligent Filtering:** Content filters (`the_content`, etc.) use `strpos()` fast-exit checks. If the specific markers or tags for a feature aren't present in your content, the plugin exits immediately without running expensive parsing.
+- **Efficient HTML Processing:** Since 1.6.0, Link Management, Block Cleanup, and Schema use the WordPress HTML API (`WP_HTML_Tag_Processor`) to edit attributes in place. Nothing is reserialized, so Vue, Alpine, and mustache templates survive untouched and no framework skip guard is needed.
 - **Aggressive Caching:** Heavy operations—such as reading JSON exception lists, calculating file hashes, or managing redirects—are cached using WordPress Transients or versioned options to minimize Disk I/O.
 
 ---
@@ -278,6 +294,9 @@ Enhanced login protection and security measures for your WordPress site.
 
 **Features:**
 - Limit login attempts to prevent brute force attacks
+- Per-username throttling, so a distributed attempt against one account is caught
+- IP allowlist, so a shared address behind a CDN cannot lock you out of your own site
+- Unlock any address or username directly from the lockout log
 - Configurable lockout durations
 - Disable XML-RPC authentication and application passwords
 - Hide detailed login errors to prevent user enumeration
@@ -394,52 +413,38 @@ add_filter( 'functionalities_svg_icons_sanitize', function( $svg, $slug ) {
 ```
 functionalities/
 ├── assets/
-│   ├── css/
-│   │   ├── admin.css
-│   │   ├── admin-ui.css
-│   │   ├── content-regression.css
-│   │   └── svg-icons-editor.css
-│   └── js/
-│       ├── admin.js
-│       ├── admin-redirects.js
-│       ├── admin-tools.js
-│       ├── admin-ui.js
-│       ├── content-regression.js
-│       └── svg-icons-editor.js
+│   ├── blocks/svg-icon/        Block metadata for the SVG Icon block
+│   ├── css/                    admin, admin-ui, content-regression, svg-icons-editor
+│   ├── js/                     admin*, content-regression, svg-icons-editor, wp7-*
+│   └── vendor/prism/           Bundled Prism.js (MIT), admin syntax highlighting
 ├── includes/
 │   ├── admin/
-│   │   ├── class-admin.php
-│   │   ├── class-admin-ui.php
-│   │   ├── class-module-controller.php
-│   │   ├── class-module-docs.php
+│   │   ├── class-admin.php                             Thin entry point
+│   │   ├── class-admin-ui.php                          Shared UI helpers
+│   │   ├── class-module-controller.php                 Settings + custom pages
+│   │   ├── class-module-docs.php                       Per-module docs text
+│   │   ├── class-settings-portability-controller.php   Export / import / diagnostics
+│   │   ├── class-site-health-controller.php            Scans, schedules, exposure probe
 │   │   ├── class-redirect-manager-controller.php
-│   │   ├── class-settings-portability-controller.php
-│   │   ├── class-site-health-controller.php
 │   │   ├── class-svg-icons-controller.php
-│   │   └── class-task-manager-controller.php
+│   │   ├── class-task-manager-controller.php
+│   │   ├── trait-admin-ajax.php
+│   │   ├── trait-admin-options.php
+│   │   └── trait-admin-sanitizers.php
 │   ├── core/
-│   │   └── class-module-registry.php
-│   ├── features/
-│   │   ├── class-assumption-detection.php
-│   │   ├── class-block-cleanup.php
-│   │   ├── class-components.php
-│   │   ├── class-content-regression.php
-│   │   ├── class-editor-links.php
-│   │   ├── class-fonts.php
-│   │   ├── class-link-management.php
-│   │   ├── class-login-security.php
-│   │   ├── class-meta.php
-│   │   ├── class-misc.php
-│   │   ├── class-pwa.php
-│   │   ├── class-redirect-manager.php
-│   │   ├── class-schema.php
-│   │   ├── class-snippets.php
-│   │   ├── class-svg-icons.php
-│   │   └── class-task-manager.php
-│   └── storage/
-│       └── class-atomic-json-store.php
+│   │   ├── class-module-registry.php                   Module list + lazy loader
+│   │   └── class-wordpress-7-integration.php           Abilities, DataViews, AI
+│   ├── features/                                       One class per module (16)
+│   ├── storage/
+│   │   ├── class-atomic-json-store.php                 Locked, atomic JSON writes
+│   │   └── class-data-directory.php                    Private data path + hardening
+│   └── traits/
+│       └── trait-css-sanitizer.php
 ├── languages/
-├── exception-urls.json.sample
+├── src/                        Source for the WordPress 7 admin bundle (not shipped)
+├── tests/                      PHPUnit suite
+├── docs/                       Performance baseline notes (not shipped)
+├── exception-urls-sample.json
 ├── functionalities.php
 ├── index.php
 └── uninstall.php

ROADMAP.md

@@ -1,10 +1,36 @@
 # Dynamic Functionalities Roadmap
 
-Version **1.5.0** builds on the completed v1.4.8 reliability work with
-progressive WordPress 7 platform integrations. The release is tagged only after
-automated checks and the real-WordPress smoke gate pass.
+Version **1.6.0** is a security and correctness release built on the v1.5.0 WordPress 7 work. The
+release is tagged only after automated checks and the real-WordPress smoke gate pass.
 
-## v1.5.0: WordPress 7 platform integration
+## v1.6.0: security, storage, and the HTML API
+
+- Give every Abilities API operation its own permission callback and a strict input schema.
+- Move redirect, 404, and task data into a private directory, migrate existing files, and add a Site
+  Health probe that confirms over HTTP that it is unreachable.
+- Filter header and footer snippets at save time only, so logged-out visitors receive them intact.
+- Cache a remote JSON exception preset and invalidate it when a post or page is edited.
+- Replace DOMDocument with the WordPress HTML API in Link Management, Block Cleanup, and Schema, and
+  delete the JS-framework skip guard it required.
+- Buffer redirect hits and 404 aggregates instead of rewriting JSON per request; run redirects at
+  `parse_request`.
+- Cache the Content Integrity list column, and keep the SVG icon library out of the autoload set.
+- Harden the service worker: no admin, login, REST, cross-origin, or private responses; capped runtime
+  cache; per-URL precache.
+- Add username throttling, an IP allowlist, and an unlock action to Login Security.
+- Bundle Prism.js instead of loading it from a CDN.
+- Generate a real translation template and stop shipping build sources in the zip.
+
+## v1.6.0 release gate
+
+- No ability can be reached without the capability its operation implies.
+- Plugin data files return a non-200 to an anonymous request on Apache, nginx, and IIS.
+- A snippet containing `&&` renders byte-identical for an anonymous visitor and an administrator.
+- A page using Vue or Alpine passes through all three content filters unchanged.
+- Existing option names, hooks, admin URLs, shortcodes, and stored JSON remain compatible, and data
+  written by earlier versions is migrated on first load.
+
+## v1.5.0: WordPress 7 platform integration (completed)
 
 - Upgrade the SVG Icon block to Block API v3.
 - Add a WordPress Core Icon source without giving up the existing custom icon

assets/blocks/svg-icon/block.json

@@ -2,7 +2,7 @@
 	"$schema": "https://schemas.wp.org/trunk/block.json",
 	"apiVersion": 3,
 	"name": "functionalities/svg-icon-block",
-	"version": "1.5.0",
+	"version": "1.6.0",
 	"title": "SVG Icon",
 	"category": "design",
 	"icon": "flag",

assets/vendor/index.php

@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.

assets/vendor/prism/LICENSE

@@ -0,0 +1,21 @@
+MIT LICENSE
+
+Copyright (c) 2012 Lea Verou
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

assets/vendor/prism/index.php

@@ -0,0 +1,2 @@
+<?php
+// Silence is golden.

bin/make-pot.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+#
+# Single source of truth for regenerating languages/functionalities.pot.
+#
+#   bin/make-pot.sh           rewrite the committed template
+#   bin/make-pot.sh --check   regenerate to a temp file and diff (used by CI)
+#
+# CI runs the exact same command a developer does, so the freshness check can
+# never fail on a flag or header that only one side passes.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+TARGET="languages/functionalities.pot"
+HEADERS='{"Report-Msgid-Bugs-To":"https://github.com/wpgaurav/functionalities/issues"}'
+EXCLUDE="tests,src,node_modules,vendor,build,assets/vendor,bin"
+
+if [ -n "${WP_CLI:-}" ]; then
+	WP="$WP_CLI"
+elif command -v wp >/dev/null 2>&1; then
+	WP="wp"
+else
+	PHAR="${TMPDIR:-/tmp}/wp-cli.phar"
+	[ -f "$PHAR" ] || curl -sSL -o "$PHAR" \
+		https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
+	WP="php $PHAR"
+fi
+
+generate() {
+	# shellcheck disable=SC2086
+	$WP i18n make-pot . "$1" \
+		--slug=functionalities \
+		--domain=functionalities \
+		--headers="$HEADERS" \
+		--exclude="$EXCLUDE" >/dev/null
+}
+
+if [ "${1:-}" = "--check" ]; then
+	EXPECTED="$(mktemp)"
+	trap 'rm -f "$EXPECTED"' EXIT
+	generate "$EXPECTED"
+	if diff <(grep -v 'POT-Creation-Date' "$TARGET") \
+	        <(grep -v 'POT-Creation-Date' "$EXPECTED"); then
+		echo "$TARGET is current."
+	else
+		echo "::error::$TARGET is stale. Run bin/make-pot.sh and commit the result."
+		exit 1
+	fi
+else
+	generate "$TARGET"
+	echo "Wrote $TARGET"
+fi