feat(reader-activation): frontend registration API for integrations by jason10lee · Pull Request #4626 · Automattic/newspack-plugin

feat: initial reader registration API rollup from working branch

jason10lee

committed

docs: annotated new functions with type hints

jason10lee

committed

fix: centralize, normalize definition of `$referer`

jason10lee

committed

fix: use returned status rather than hardcoded value

jason10lee

committed

test: annotate with group like we do elsewhere for isolated testing

jason10lee

committed

docs: note to self about parameterizing `verify_captcha()`

jason10lee

committed

docs: note about better mitigating attacks

jason10lee

committed

docs: note potential disclosure and mitigation path

jason10lee

committed

fix: merge into existing `reader` now that we are out of POC

jason10lee

committed

fix: condition reCAPTCHA v3 actions on their `ready()`

jason10lee

committed

style: explicit fallback for `wp_parse_url()` as suggested by Copilot

jason10lee

committed

fix: make endpoint available only when RAS is enabled, per Copilot

jason10lee

committed

test: properly tear down our new routes

jason10lee

committed

feat: localize reCAPTCHA site key and version for both v2 and v3

jason10lee

committed

feat: add reCAPTCHA v2 invisible support to register()

jason10lee

committed

fix: move grecaptcha.execute inside try block to prevent Promise leak

jason10lee

committed

fix: add isolated flag to v2 invisible widget to prevent interference

jason10lee

committed

fix: add 30s timeout to v2 invisible token acquisition to prevent hang

jason10lee

committed

docs: note potential concurrent-call guard for v2 invisible token

jason10lee

committed

fix: gracefully reject calls if essential config is missing

jason10lee

committed

docs: potential future directions for rate limiting

jason10lee

committed

fix: address potential race condition on multiple registrations with same email

jason10lee

committed

fix: ensure idempotency by making sure callers get current reader data for logged-in readers

jason10lee

committed

fix: condition config output on RAS

jason10lee

committed

fix: use server-side email, not submitted email, for logged-in users

jason10lee

committed

fix: reject Promise and provide helpful error if reCAPTCHA not happy

jason10lee

committed

fix: move reCAPTCHA behind rate limiting to protect metered service from floods

jason10lee

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(reader-activation): frontend registration API for integrations#4626

feat(reader-activation): frontend registration API for integrations#4626
jason10lee wants to merge 32 commits intotrunkfrom
feat/integrations-reader-registration

Commits on Apr 3, 2026

feat: initial reader registration API rollup from working branch

docs: annotated new functions with type hints

fix: centralize, normalize definition of `$referer`

fix: use returned status rather than hardcoded value

test: annotate with group like we do elsewhere for isolated testing

docs: note to self about parameterizing `verify_captcha()`

docs: note about better mitigating attacks

docs: note potential disclosure and mitigation path

fix: merge into existing `reader` now that we are out of POC

fix: condition reCAPTCHA v3 actions on their `ready()`

style: explicit fallback for `wp_parse_url()` as suggested by Copilot

fix: make endpoint available only when RAS is enabled, per Copilot

test: properly tear down our new routes

feat: localize reCAPTCHA site key and version for both v2 and v3

feat: add reCAPTCHA v2 invisible support to register()

fix: move grecaptcha.execute inside try block to prevent Promise leak

fix: add isolated flag to v2 invisible widget to prevent interference

fix: add 30s timeout to v2 invisible token acquisition to prevent hang

docs: note potential concurrent-call guard for v2 invisible token

fix: gracefully reject calls if essential config is missing

docs: potential future directions for rate limiting

fix: address potential race condition on multiple registrations with same email

fix: ensure idempotency by making sure callers get current reader data for logged-in readers

fix: condition config output on RAS

fix: use server-side email, not submitted email, for logged-in users

fix: reject Promise and provide helpful error if reCAPTCHA not happy

fix: move reCAPTCHA behind rate limiting to protect metered service from floods

Commits on Apr 4, 2026

test: regression test for race condition

test: test our referrer normalization

test: regression test reCAPTCHA at the filter level, as mocking the API looks prohibitively messy

test: verify registry gating on RAS

test: verify stability of our integration keys