* fix: session secret key, cart session persistence, null variation attributes
- Use wp_salt() as fallback secret key instead of hardcoded 24-byte string
to satisfy php-jwt v7's HS256 minimum key length requirement (Closes#1009)
- Call get_cart_from_session() after wc_load_cart() in
initialize_session_and_cart() to prevent cart queries from clearing
persisted session data (Closes#1010)
- Guard against null $attrs in variation_attributes_to_data_array()
to prevent PHP warnings when variations have no attributes (Closes#1011)
- Return empty array instead of null for product attribute options
when no terms exist
* chore: Linter compliances met
* devops: Variable product performance optimization and tests
- Memoize get_variation_prices() in the Product model to avoid
redundant lookups across multiple pricing fields (price, regularPrice,
salePrice, and their RAW variants)
- Remove redundant post__in filter from variations connection resolver;
post_parent already constrains the query, and the post__in triggered
an extra get_children() call per product
- Add createVariableProductCatalog() helper to GraphQLE2E for creating
variable products with many variations in tests
- Add VariableProductPerformanceTest (wpunit) measuring DB query count
and duration for 15 variable products with 18 variations each
- Add VariableProductPerformanceCest (functional) verifying 6 rapid
queries do not return 429 errors
Addresses #897
* fix: Skip timing assertion when xdebug is active and clean up debug code
* fix: Elementor breaks transfer-session endpoint with 500 error
Elementor's LandingPages module creates a WP_Query during `init` which
fires `pre_get_posts` before WooCommerce session is initialized. Our
resolve_request handler ran on this early query and called
WC()->session->get_customer_id() on null, causing a fatal error.
Fix: Guard resolve_request to only run on the main front-end query and
bail if WC session is not yet initialized. Also add Elementor to the
test environment and add functional tests that reproduce the issue.
Closes#945
* chore: Add @param docblock for resolve_request $query parameter
* devops: Remove unused resolvers and add session transaction manager tests
Remove Coupon_Connection_Resolver and Customer_Connection_Resolver
which had 0% coverage and were never instantiated.
Add SessionTransactionManagerTest covering did_transaction_expire
edge cases and next_transaction invalid/expired queue handling.
* devops: WC email template tests, COT cursor HPOS fix, checkout account auth
WC Email Template Tests:
- Add WooCommerceEmailTemplatesTest verifying WC email templates are used
for registerCustomer, checkout with account creation, and password reset
- Use MockPHPMailer to capture emails and verify HTML content type
- Disable deferred transactional emails during tests via GRAPHQL_TESTING flag
COT Cursor HPOS Fix:
- Fix COT_Cursor::compare_with to resolve orderby aliases and legacy meta
keys (_order_total, _date_completed, etc.) to COT column names
- Add resolve_orderby_alias() mapping short aliases and meta keys to columns
- Add DB_Hooks::clean_query_vars to translate post_* and meta_key orderby
to COT-compatible equivalents via woocommerce_order_query_args filter
Checkout Account Authentication:
- Add authenticate field to CreateAccountInput type
- Gate wc_set_customer_auth_cookie() behind authenticate flag in checkout
mutation so account creation doesn't auto-authenticate by default
Closes#882
* devops: codeception.dist.yml updated
* fix: Functional test cleanup and CI coverage condition
Test fixes:
- Enable authorizing URL fields in ProtectedRouterCest and
DownloadableItemAuthCest via setWooGraphQLSetting
- Add stale data cleanup (sessions, users, products, orders) to
GraphQLE2E _setupStore/getCatalog/setupStoreAndUsers
- Fix CartTransactionQueueCest and CartQueriesTest for test isolation
CI:
- Only run coverage job when at least one upstream job succeeds
* chore: Linter compliances met
* fix: HPOS order mutation data loss and CI coverage condition
Refactor order create/update mutations to set all props on a single
WC_Order instance before saving, mirroring the WC REST API pattern.
Previously, separate add_order_meta() and add_items() calls each loaded
their own order instance and saved independently, causing HPOS data loss
for payment method, addresses, and other fields.
Also fix CI coverage job to only run when all upstream jobs succeed,
and correct test assertions for RAW format line item totals.
Closes#591
* chore: Linter compliances met
* chore: Remove dead code from Order_Mutation after prepare_order refactor
Removes add_items() and update_address() which are no longer called
after the prepare_order() consolidation.
* chore: Remove dead code add_order_meta and update_item_meta_data
* Adds support for tax_lines
* devops: cleanup cart tax lines code style and add unit tests
* feat: add tax-aware cost, subtotal, and taxTotal fields to ShippingRate (#802)
* feat: add format arg to ShippingRate cost/subtotal/taxTotal fields, update test for RAW format
* devops: CartQueriesTest updated
---------
Co-authored-by: Geoff Taylor <geoff@axistaylor.com>
* feat: add authenticated download URLs for headless frontends
- Add downloadNonce and downloadUrl fields to DownloadableItem type
using the existing Protected Router session transfer pattern
- Add preAuthDownloadUrl field (toggleable via settings) that generates
tokenized download URLs for direct file access without cookie auth
- Add download_url nonce handling to Protected_Router
- Add enable_pre_auth_download_urls and download_url_nonce_param settings
- Add GraphQLE2E helpers for checkout and account shortcode pages
- Rewrite ProtectedRouterCest to test redirect flow without JS-dependent
page content assertions, add account and payment method URL tests
- Add DownloadableItemAuthCest with 5 e2e tests covering both options
* fix: test suite stability and code coverage collection
- Add WC_Unit_Tests_Bootstrap stub to wpunit bootstrap to bypass
wc_get_product_visibility_term_ids static cache between suites
- Add setWooGraphQLSetting helper to GraphQLE2E for safe individual
field updates to woographql_settings option with proper defaults
- Update all functional tests to use setWooGraphQLSetting instead of
replacing the entire woographql_settings option
- Fix createRelated factory to use explicit shared category instead
of relying on default Uncategorized category
- Add download_url to ProtectedRouterTest nonce names assertion
- Remove debug logs from ProductQueriesTest and ProductsQueriesTest
- Fix CI workflow to run suites separately and aggregate coverage
via phpcov merge
- Wire c3.php into WordPress index.php for remote coverage collection
- Update .coveralls.yml service_name to github-actions
- Clean up Xdebug 2 settings in Dockerfile
* chore: Linter compliances met
* fix: ensure tests/_output is writable for c3.php coverage collection
* devops: .env.docker removed from setup
* devops: split CI into separate jobs per suite with retry and coverage aggregation
* devops: add +Coverage indicator to CI job names
* devops: add --fail-fast to first run, fix retry to mark job as passing on retry success
Adds a new "Session Transfer Behavior" setting to the WooGraphQL
settings page that controls how cart/session data is handled when
a user logs in with an existing session from another device:
- keep_new_fallback_old (default): keeps current guest session data,
falls back to previously saved user session if guest data is empty
- keep_new: always keeps the current guest session data
- keep_old: restores the previously saved user session data
Move session initialization from graphql_process_http_request hook to
init_graphql_request hook with an is_graphql_http_request() guard.
graphql_process_http_request fires before WPGraphQL's OPTIONS check in
Router::process_http_request(), causing wc_load_cart() to create a new
session for every preflight request. init_graphql_request fires inside
Request constructor which is only instantiated after the OPTIONS exit.
The is_graphql_http_request() guard ensures initialize_session_and_cart()
only runs for actual HTTP requests, not programmatic graphql() calls in
tests or internal usage.
* test: add hCaptcha session token regression test
Adds functional test verifying the session token is correctly linked
to the authenticated user after login when hCaptcha for WP is active.
Resolves#941Resolves#942
* devops: login test added
* fix: add authenticate flag to registerCustomer mutation
Adds an optional `authenticate` boolean input to the registerCustomer
mutation. When true, the mutation sets the current user and reinitializes
the session token for the newly registered customer. Defaults to false
to prevent nonce verification failures in contexts like GraphiQL that
send a nonce with the request.
Resolves#464
* test: add authenticate flag to existing register customer tests
The existing wpunit tests for registerCustomer rely on the user being
authenticated after registration to assert on customer.databaseId and
viewer.userId. Now that authenticate defaults to false, the tests must
explicitly pass authenticate: true.
* test: add authenticate flag to testCustomerMutationsWithMeta
* fix: use explicit billing emails in CustomerQueriesTest assertions
Use wildcard index matching with specific email values instead of
hardcoded node indices with NOT_NULL checks. This prevents failures
when other users in the DB shift the node positions.
* fix: resolve REQUEST_URI fatal error and JWT key length issues in CI
QLSessionHandlerTest::tearDown() was calling unset($_SERVER) which
destroyed the entire superglobal. WordPress cron.php then fataled on
shutdown when accessing $_SERVER['REQUEST_URI']. Changed to only unset
the specific HTTP_WOOCOMMERCE_SESSION key.
Also updated JWT secret keys to meet firebase/php-jwt v7's minimum
32-byte requirement for HS256 in both test config and Docker entrypoint.
* fix: the rest of the files added
* devops: php7.4 removed from matrix
* chore: Linter compliances met
* devops: More broken test updated
* devops: Tests updated for CI
* fix: QLSessionHandlerCest fixed
* fix: QLSessionHandlerCest fixed
* devops: CI fixed
* feat: Add Store API Cart-Token compatibility and session handler improvements
* chore: Linter compliances met
* chore: linter compliances met
* chore: linter compliances met
* feat: QL Session Handler functionality expanded to support cookies on non-GraphQL requests
* chore: Linter and PHPStan compliance met
* devops: QLSessionHandlerTest patched for suite testing
* chore: Linter and PHPStan compliance met
* fix: More cart session save triggered implemented
* fix: More cart session save triggered implemented
* chore: Linter compliance met
* chore: Linter compliance met
* feat: forgetSession mutation added
* feat: forgetSession mutation added
* fix: product connection resolution refactored to better work with the ProductQuery class
* chore: Linter and PHPStan compliance met
* devops: New product connection tests implemented and passing
* fix: products connection pricing filters fixed
* devops: CartTransactionQueueCest skipped until failing PHP version removed from CI matrix
* dev!: namespace Composer dependencies with strauss
* chore: include vendor-prefixed when stanning
* Strauss configurations properly applied. Contribution docs restored.
* Linter and PHPStan compliance met
* `platform` removed from `composer.json`
* devops: PHP7.3 removed from CI matrix
---------
Co-authored-by: Geoff Taylor <geoff@axistaylor.com>
