feat(integrations): add content gate metadata

[chickenn00dle]

Summary

Implements the Content_Gate metadata class for reader activation sync, adding two fields that track whether a reader has access to gated content and what grants that access.

• Content_Access: "Yes", "No", or empty — whether the reader can bypass any published content gate with custom access rules. Empty when no content gates are configured.
• Content_Access_Source: The entity granting access — subscription product name(s), "domain" (email domain rule), or "group" (institutional access). Empty when Content_Access is "No" or empty.

Makes User_Gate_Access::evaluate_gate_for_user() public so the metadata class can reuse its detailed per-rule evaluation results.

Fixes get_access_source_labels to only include product names the user has actually purchased, rather than all products configured on the gate rule. Uses Access_Rules::has_active_subscription() to check each product individually, covering both individual and group subscriptions.

Closes NPPD-1390

Test plan

1. Enabled the following in wp-config.php:

define( 'NEWSPACK_LOG_LEVEL', 3 );
define( 'NEWSPACK_CONTENT_GATES', true );
define( 'NEWSPACK_SYNC_METADATA_VERSION', '1.0' );
define( 'NEWSPACK_INTEGRATIONS_SETTINGS_ENABLED', true );

2. Navigate to Audience > Integrations > ESP and confirm the Content Access and Content Access Source fields are available in the outgoing metadata section
3. Check them both and save, confirming they persist on reload
4. Create two subscription products (e.g., "Premium Plan" and "Basic Plan")
5. Create a content gate with a subscription access rule that includes both products
6. As a new reader, register to the site
7. Check the logs and verify the contact is synced with Content_Access = "No" and Content_Access_Source = empty (since the reader has no subscriptions)
8. As the same reader, purchase only one of the two subscription products (e.g., "Basic Plan")
9. Check the logs for another sync entry — verify Content_Access = "Yes" and Content_Access_Source = only the purchased product name (e.g., "Basic Plan"), NOT both products
   
10. Now purchase the second subscription product as well
11. Check the logs — verify Content_Access_Source now includes both product names
12. Test with an email domain access rule — verify the source label is "domain" when the reader's email matches
13. Test with an institution access rule — verify the source label is "group" when the reader matches
14. Verify that when no custom access gates are configured, Content_Access is empty with empty source

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds Reader Activation Sync contact metadata for Content Gate access so ESP/CRM contacts can be annotated with whether they can bypass custom content gates and what grants that access.

Changes:

• Implement Reader_Activation\Sync\Contact_Metadata\Content_Gate to compute Content_Access and Content_Access_Source from published content gates’ custom access rules.
• Expose User_Gate_Access::evaluate_gate_for_user() publicly for reuse by the metadata class.
• Add unit tests covering basic content-gate metadata behavior (primarily email domain rules).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
includes/reader-activation/sync/contact-metadata/class-content-gate.php	Computes and returns Content Gate metadata fields for sync, including source derivation from per-rule evaluation.
includes/content-gate/class-user-gate-access.php	Makes evaluate_gate_for_user() public so other components can reuse detailed evaluation results.
tests/unit-tests/content-gate/class-content-gate-metadata.php	Adds unit tests validating metadata output for no gates, invalid user, and email-domain rule scenarios.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[leogermani]

Hmmm.. if there's no content gate, I think we should return either No or an empty string here

[chickenn00dle]

Sounds good. I went with the empty string so its easy to distinguish between when there is no gate configured and when there is but the reader doesn't have access: 3b8de35