feat(notifications): add install-plugin action to What's New panel#4
Open
avivu wants to merge 14 commits into
Open
feat(notifications): add install-plugin action to What's New panel#4avivu wants to merge 14 commits into
avivu wants to merge 14 commits into
Conversation
Adds the ability to install and activate a free WP.org plugin directly from a What's New notification card, without leaving the editor. Changes: - whats-new-item.js: InstallPluginButton component with install/activate/ dismiss flow matching the Elementor Angie install pattern (folder_exists error code, POST for activation via wp.apiFetch) - api.php: ALLOWED_INSTALL_SLUGS allowlist + sanitize_install_fields() strips installPlugin/ctaActivate from CDN responses for unknown slugs - options.php: mark_notification_installed() dismisses a single card by ID using the existing _e_notifications_dismissed user_meta - module.php: notifications_mark_installed AJAX action New notification fields: installPlugin (slug), ctaActivate (label) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use promotion color for install button to match CTA - Track installed notifications separately (_e_notifications_installed) to avoid hiding all read notifications from the panel - Filter out installed notifications server-side on panel open - Invalidate query on panel close so card disappears on next open Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…andlers Both ajax_get_notifications and ajax_mark_notification_installed now require manage_options capability as defense-in-depth, consistent with how other admin-only AJAX handlers work in Elementor. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…n color - Add site-mailer, image-optimization, pojo-accessibility, cookiez, manage to ALLOWED_INSTALL_SLUGS - Change InstallPluginButton color back to primary (pink) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Show an "Open WP Admin to get started" link below the "Installed ✓" button so users know where to go after installing a plugin from the What's New panel. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ity bug is resolved Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Falls back to cta then default 'Install Plugin' for backward compatibility. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…t allowed Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- installErrorText: custom error message shown on install/activation failure - postInstallLink: when set, shows a link after successful install - postInstallText: custom label for post-install link (default: "Explore and get started") - All three fields are stripped alongside installPlugin when the slug is not allowed Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…stall ones - ajax_get_notifications: use edit_posts cap (editors can fetch notifications) - install-plugin notifications are filtered out for non-admin users - ajax_mark_notification_installed: keep manage_options (install = admin only) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds 'angie' to ALLOWED_INSTALL_SLUGS so What's New notifications can trigger Angie installation via the installPlugin field. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-plugin feature - Fix wp_set_script_translations using wrong handle (e-editor-notifications → e-admin-notifications) in admin closure - Remove dead `admin_url` key from get_app_js_config() — was unused by JS - Fix wp_get_current_user() guards: use exists() instead of falsy check (get_current_user always returns WP_User) - Fix has_unread_notifications() to also subtract installed IDs so bell dot clears after plugin install - Fix findAndActivate() to set error state when plugin not found in REST list instead of silently succeeding Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
installPluginslugALLOWED_INSTALL_SLUGS) validates plugin slugs before they reach the browser — protects against a compromised CDN response_e_notifications_installeduser meta) so the card disappears only after the panel is closed, not immediatelymanage_optionscapability checks to both AJAX handlersCommits
feat(notifications)— core install-plugin action wiring (REST API call, button component)fix(notifications)— corrects REST verb from PUT → POST for plugin activationfix(notifications)— UX polish: button color, dismiss timing, query invalidation on closesecurity(notifications)— capability checks on AJAX handlersTest plan
installPlugin: "angie"— Install & Activate button appearsinstallPluginslug has the field stripped server-sidenotifications_getornotifications_mark_installed