• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

wp-graphql / wp-graphql-woocommerce / 23675172456

28 Mar 2026 02:10AM UTC coverage: 70.983% (-18.4%) from 89.424%
23675172456

Pull #1003

github

web-flow
Merge 05339093d into 6fb7b226f
Pull Request #1003: devops: WC email template tests, COT cursor HPOS fix, checkout account auth

71 of 81 new or added lines in 5 files covered. (87.65%)

3346 existing lines in 124 files now uncovered.

12576 of 17717 relevant lines covered (70.98%)

55.38 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

3.86
/includes/admin/class-general.php
1
<?php
2
/**
3
 * Defines WooGraphQL's general settings.
4
 *
5
 * @package WPGraphQL\WooCommerce\Admin
6
 */
7

8
namespace WPGraphQL\WooCommerce\Admin;
9

10
/**
11
 * General class
12
 */
13
class General extends Section {
14
        /**
15
         * Returns the other nonce values besides the one provided.
16
         *
17
         * @param string $excluded  Slug of nonce value to be excluded.
18
         *
19
         * @return array
20
         */
21
        public static function get_other_nonce_values( $excluded ) {
22
                $nonce_values = apply_filters(
×
23
                        'woographql_authorizing_url_nonce_values',
×
24
                        [
×
25
                                'cart_url'               => woographql_setting( 'cart_url_nonce_param', '_wc_cart' ),
×
26
                                'checkout_url'           => woographql_setting( 'checkout_url_nonce_param', '_wc_checkout' ),
×
27
                                'account_url'            => woographql_setting( 'account_url_nonce_param', '_wc_account' ),
×
28
                                'add_payment_method_url' => woographql_setting( 'add_payment_method_url_nonce_param', '_wc_payment' ),
×
29
                        ]
×
30
                );
×
31

32
                return array_values( array_diff_key( $nonce_values, [ $excluded => '' ] ) );
×
33
        }
34

35
        /**
36
         * Returns the enabled authorizing URL fields.
37
         *
38
         * @return array
39
         */
40
        public static function enabled_authorizing_url_fields_value() {
41
                return apply_filters(
110✔
42
                        'woographql_enabled_authorizing_url_fields',
110✔
43
                        [
110✔
44
                                'cart_url'               => 'cart_url',
110✔
45
                                'checkout_url'           => 'checkout_url',
110✔
46
                                'account_url'            => 'account_url',
110✔
47
                                'add_payment_method_url' => 'add_payment_method_url',
110✔
48
                        ]
110✔
49
                );
110✔
50
        }
51

52
        /**
53
         * Returns General settings fields.
54
         *
55
         * @return array
56
         */
57
        public static function get_fields() {
UNCOV
58
                $custom_endpoint                = apply_filters( 'woographql_authorizing_url_endpoint', null );
×
UNCOV
59
                $enabled_authorizing_url_fields = woographql_setting( 'enable_authorizing_url_fields', [] );
×
UNCOV
60
                $enabled_authorizing_url_fields = ! empty( $enabled_authorizing_url_fields ) ? array_keys( $enabled_authorizing_url_fields ) : [];
×
UNCOV
61
                $all_urls_checked               = self::enabled_authorizing_url_fields_value();
×
62

UNCOV
63
                $cart_url_hardcoded               = defined( 'CART_URL_NONCE_PARAM' ) && ! empty( constant( 'CART_URL_NONCE_PARAM' ) );
×
UNCOV
64
                $checkout_url_hardcoded           = defined( 'CHECKOUT_URL_NONCE_PARAM' ) && ! empty( constant( 'CHECKOUT_URL_NONCE_PARAM' ) );
×
UNCOV
65
                $account_url_hardcoded            = defined( 'ACCOUNT_URL_NONCE_PARAM' ) && ! empty( constant( 'ACCOUNT_URL_NONCE_PARAM' ) );
×
UNCOV
66
                $add_payment_method_url_hardcoded = defined( 'ADD_PAYMENT_METHOD_URL_NONCE_PARAM' ) && ! empty( constant( 'ADD_PAYMENT_METHOD_URL_NONCE_PARAM' ) );
×
67

UNCOV
68
                $enable_auth_urls_hardcoded = defined( 'WPGRAPHQL_WOOCOMMERCE_ENABLE_AUTH_URLS' ) && ! empty( constant( 'WPGRAPHQL_WOOCOMMERCE_ENABLE_AUTH_URLS' ) );
×
69

UNCOV
70
                return [
×
UNCOV
71
                        [
×
UNCOV
72
                                'name'     => 'disable_ql_session_handler',
×
UNCOV
73
                                'label'    => __( 'Disable QL Session Handler', 'wp-graphql-woocommerce' ),
×
UNCOV
74
                                'desc'     => __( 'The QL Session Handler takes over management of WooCommerce Session Management on WPGraphQL request replacing the usage of HTTP Cookies with JSON Web Tokens.', 'wp-graphql-woocommerce' )
×
UNCOV
75
                                        . ( defined( 'NO_QL_SESSION_HANDLER' ) ? __( ' This setting is disabled. The "NO_QL_SESSION_HANDLER" flag has been triggered with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
76
                                'type'     => 'checkbox',
×
UNCOV
77
                                'value'    => defined( 'NO_QL_SESSION_HANDLER' ) ? 'on' : woographql_setting( 'disable_ql_session_handler', 'off' ),
×
UNCOV
78
                                'disabled' => defined( 'NO_QL_SESSION_HANDLER' ),
×
UNCOV
79
                        ],
×
UNCOV
80
                        [
×
UNCOV
81
                                'name'     => 'enable_ql_session_handler_on_ajax',
×
UNCOV
82
                                'label'    => __( 'Enable QL Session Handler on WC AJAX requests.', 'wp-graphql-woocommerce' ),
×
UNCOV
83
                                'desc'     => __( 'Enabling this will enable JSON Web Tokens usage on WC AJAX requests.', 'wp-graphql-woocommerce' )
×
UNCOV
84
                                        . ( defined( 'NO_QL_SESSION_HANDLER' ) ? __( ' This setting is disabled. The "NO_QL_SESSION_HANDLER" flag has been triggered with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
85
                                'type'     => 'checkbox',
×
UNCOV
86
                                'value'    => defined( 'NO_QL_SESSION_HANDLER' ) ? 'off' : woographql_setting( 'enable_ql_session_handler_on_ajax', 'off' ),
×
UNCOV
87
                                'disabled' => defined( 'NO_QL_SESSION_HANDLER' ),
×
UNCOV
88
                        ],
×
UNCOV
89
                        [
×
UNCOV
90
                                'name'     => 'enable_ql_session_handler_on_rest',
×
UNCOV
91
                                'label'    => __( 'Enable QL Session Handler on WP REST requests.', 'wp-graphql-woocommerce' ),
×
UNCOV
92
                                'desc'     => __( 'Enabling this will enable JSON Web Tokens usage on WP REST requests.', 'wp-graphql-woocommerce' )
×
UNCOV
93
                                        . ( defined( 'NO_QL_SESSION_HANDLER' ) ? __( ' This setting is disabled. The "NO_QL_SESSION_HANDLER" flag has been triggered with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
94
                                'type'     => 'checkbox',
×
UNCOV
95
                                'value'    => defined( 'NO_QL_SESSION_HANDLER' ) ? 'off' : woographql_setting( 'enable_ql_session_handler_on_rest', 'off' ),
×
UNCOV
96
                                'disabled' => defined( 'NO_QL_SESSION_HANDLER' ),
×
UNCOV
97
                        ],
×
UNCOV
98
                        [
×
UNCOV
99
                                'name'     => 'set_session_token_type',
×
UNCOV
100
                                'label'    => __( 'Session Token Type', 'wp-graphql-woocommerce' ),
×
UNCOV
101
                                'desc'     => __( 'Choose which session token type(s) to generate. "Legacy" uses GraphQL session tokens only. "Store API" uses WooCommerce Blocks Cart-Token only (requires WooCommerce 5.5.0+). "Both" generates both token types for maximum compatibility with headless implementations using WooCommerce Blocks.', 'wp-graphql-woocommerce' )
×
UNCOV
102
                                        . ( defined( 'NO_QL_SESSION_HANDLER' ) ? __( ' This setting is disabled. The "NO_QL_SESSION_HANDLER" flag has been triggered with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
103
                                'type'     => 'select',
×
UNCOV
104
                                'options'  => [
×
UNCOV
105
                                        'legacy'    => __( 'Legacy (GraphQL Session Token only)', 'wp-graphql-woocommerce' ),
×
UNCOV
106
                                        'store-api' => __( 'Store API (Cart-Token only)', 'wp-graphql-woocommerce' ),
×
UNCOV
107
                                        'both'      => __( 'Both (GraphQL + Store API)', 'wp-graphql-woocommerce' ),
×
UNCOV
108
                                ],
×
UNCOV
109
                                'default'  => 'legacy',
×
UNCOV
110
                                'disabled' => defined( 'NO_QL_SESSION_HANDLER' ),
×
UNCOV
111
                        ],
×
UNCOV
112
                        [
×
UNCOV
113
                                'name'     => 'session_transfer_behavior',
×
UNCOV
114
                                'label'    => __( 'Session Transfer Behavior', 'wp-graphql-woocommerce' ),
×
UNCOV
115
                                'desc'     => __( 'Controls how cart data is handled when a user logs in with an existing session from another device. "Keep new" keeps the current session data (default). "Keep old" restores the previously saved session data. "Merge" combines cart items from both sessions.', 'wp-graphql-woocommerce' ),
×
UNCOV
116
                                'type'     => 'select',
×
UNCOV
117
                                'options'  => [
×
UNCOV
118
                                        'keep_new_fallback_old' => __( 'Keep new, fallback to old (default)', 'wp-graphql-woocommerce' ),
×
UNCOV
119
                                        'keep_new'              => __( 'Keep new (always use current session)', 'wp-graphql-woocommerce' ),
×
UNCOV
120
                                        'keep_old'              => __( 'Keep old (restore previously saved session)', 'wp-graphql-woocommerce' ),
×
UNCOV
121
                                ],
×
UNCOV
122
                                'default'  => 'keep_new_fallback_old',
×
UNCOV
123
                                'disabled' => defined( 'NO_QL_SESSION_HANDLER' ),
×
UNCOV
124
                        ],
×
UNCOV
125
                        [
×
UNCOV
126
                                'name'     => 'enable_transliteration',
×
UNCOV
127
                                'label'    => __( 'Transliterate non-latin characters', 'wp-graphql-woocommerce' ),
×
UNCOV
128
                                'desc'     => __( 'Converts non-latin characters (Cyrillic, Chinese, Arabic, etc.) to their latin equivalents in GraphQL type and enum names. Enable this if your WooCommerce tax classes, product attributes, or taxonomies use non-latin names. Requires the PHP intl extension.', 'wp-graphql-woocommerce' )
×
UNCOV
129
                                        . ( ! function_exists( 'transliterator_transliterate' ) ? __( ' <strong>Warning:</strong> The PHP intl extension is not available. This setting will have no effect.', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
130
                                'type'     => 'checkbox',
×
UNCOV
131
                                'default'  => 'off',
×
UNCOV
132
                                'disabled' => ! function_exists( 'transliterator_transliterate' ),
×
UNCOV
133
                        ],
×
UNCOV
134
                        [
×
UNCOV
135
                                'name'    => 'enable_unsupported_product_type',
×
UNCOV
136
                                'label'   => __( 'Enable Unsupported types', 'wp-graphql-woocommerce' ),
×
UNCOV
137
                                'desc'    => __( 'Substitute unsupported product types with SimpleProduct', 'wp-graphql-woocommerce' ),
×
UNCOV
138
                                'type'    => 'checkbox',
×
UNCOV
139
                                'default' => 'off',
×
UNCOV
140
                        ],
×
UNCOV
141
                        [
×
UNCOV
142
                                'name'              => 'enable_authorizing_url_fields',
×
UNCOV
143
                                'label'             => __( 'Enable User Session transferring URLs', 'wp-graphql-woocommerce' ),
×
UNCOV
144
                                'desc'              => __( 'URL fields to add to the <strong>Customer</strong> type.', 'wp-graphql-woocommerce' )
×
UNCOV
145
                                        . ( $enable_auth_urls_hardcoded ? __( ' This setting is disabled. The "WPGRAPHQL_WOOCOMMERCE_ENABLE_AUTH_URLS" flag has been triggered with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
146
                                'type'              => 'multicheck',
×
UNCOV
147
                                'options'           => apply_filters(
×
UNCOV
148
                                        'woographql_settings_enable_authorizing_url_options',
×
UNCOV
149
                                        [
×
UNCOV
150
                                                'cart_url'               => __( 'Cart URL. Field name: <strong>cartUrl</strong>', 'wp-graphql-woocommerce' ),
×
UNCOV
151
                                                'checkout_url'           => __( 'Checkout URL. Field name: <strong>checkoutUrl</strong>', 'wp-graphql-woocommerce' ),
×
UNCOV
152
                                                'account_url'            => __( 'Account URL. Field name: <strong>accountUrl</strong>', 'wp-graphql-woocommerce' ),
×
UNCOV
153
                                                'add_payment_method_url' => __( 'Add Payment Method URL. Field name: <strong>addPaymentMethodUrl</strong>', 'wp-graphql-woocommerce' ),
×
UNCOV
154
                                        ]
×
UNCOV
155
                                ),
×
UNCOV
156
                                'value'             => $enable_auth_urls_hardcoded ? $all_urls_checked : woographql_setting( 'enable_authorizing_url_fields', [] ),
×
UNCOV
157
                                'disabled'          => $enable_auth_urls_hardcoded,
×
UNCOV
158
                                'sanitize_callback' => static function ( $value ) {
×
159
                                        if ( empty( $value ) ) {
×
160
                                                return [];
×
161
                                        }
162

163
                                        return $value;
×
UNCOV
164
                                },
×
UNCOV
165
                        ],
×
UNCOV
166
                        [
×
UNCOV
167
                                'name'     => 'authorizing_url_endpoint',
×
UNCOV
168
                                'label'    => __( 'Endpoint for Authorizing URLs', 'wp-graphql-woocommerce' ),
×
UNCOV
169
                                'desc'     => sprintf(
×
170
                                        /* translators: %1$s: Site URL, %2$s: WooGraphQL Auth Endpoint */
UNCOV
171
                                        __( 'The endpoint (path) for transferring user sessions on the site. <a target="_blank" href="%1$s/%2$s">%1$s/%2$s</a>.', 'wp-graphql-woocommerce' ),
×
UNCOV
172
                                        site_url(),
×
UNCOV
173
                                        woographql_setting( 'authorizing_url_endpoint', 'transfer-session' )
×
UNCOV
174
                                ),
×
UNCOV
175
                                'type'     => 'text',
×
UNCOV
176
                                'default'  => ! empty( $custom_endpoint ) ? $custom_endpoint : 'transfer-session',
×
UNCOV
177
                                'disabled' => empty( $enabled_authorizing_url_fields ),
×
UNCOV
178
                        ],
×
UNCOV
179
                        [
×
UNCOV
180
                                'name'              => 'cart_url_nonce_param',
×
UNCOV
181
                                'label'             => __( 'Cart URL nonce name', 'wp-graphql-woocommerce' ),
×
UNCOV
182
                                'desc'              => __( 'Query parameter name of the nonce included in the "cartUrl" field', 'wp-graphql-woocommerce' )
×
UNCOV
183
                                        . ( $cart_url_hardcoded ? __( ' This setting is disabled. The "CART_URL_NONCE_PARAM" flag has been set with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
184
                                'type'              => 'text',
×
UNCOV
185
                                'value'             => $cart_url_hardcoded ? CART_URL_NONCE_PARAM : woographql_setting( 'cart_url_nonce_param', '_wc_cart' ),
×
UNCOV
186
                                'disabled'          => defined( 'CART_URL_NONCE_PARAM' ) || ! in_array( 'cart_url', $enabled_authorizing_url_fields, true ),
×
UNCOV
187
                                'sanitize_callback' => static function ( $value ) {
×
188
                                        $other_nonces = self::get_other_nonce_values( 'cart_url' );
×
189
                                        if ( in_array( $value, $other_nonces, true ) ) {
×
190
                                                add_settings_error(
×
191
                                                        'cart_url_nonce_param',
×
192
                                                        'unique',
×
193
                                                        __( 'The <strong>Cart URL nonce name</strong> field must be unique', 'wp-graphql-woocommerce' ),
×
194
                                                        'error'
×
195
                                                );
×
196

197
                                                return '_wc_cart';
×
198
                                        }
199

200
                                        return $value;
×
UNCOV
201
                                },
×
UNCOV
202
                        ],
×
UNCOV
203
                        [
×
UNCOV
204
                                'name'              => 'checkout_url_nonce_param',
×
UNCOV
205
                                'label'             => __( 'Checkout URL nonce name', 'wp-graphql-woocommerce' ),
×
UNCOV
206
                                'desc'              => __( 'Query parameter name of the nonce included in the "checkoutUrl" field', 'wp-graphql-woocommerce' )
×
UNCOV
207
                                        . ( $checkout_url_hardcoded ? __( ' This setting is disabled. The "CHECKOUT_URL_NONCE_PARAM" flag has been set with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
208
                                'type'              => 'text',
×
UNCOV
209
                                'value'             => $checkout_url_hardcoded ? CHECKOUT_URL_NONCE_PARAM : woographql_setting( 'checkout_url_nonce_param', '_wc_checkout' ),
×
UNCOV
210
                                'disabled'          => defined( 'CHECKOUT_URL_NONCE_PARAM' ) || ! in_array( 'checkout_url', $enabled_authorizing_url_fields, true ),
×
UNCOV
211
                                'sanitize_callback' => static function ( $value ) {
×
212
                                        $other_nonces = self::get_other_nonce_values( 'checkout_url' );
×
213
                                        if ( in_array( $value, $other_nonces, true ) ) {
×
214
                                                add_settings_error(
×
215
                                                        'checkout_url_nonce_param',
×
216
                                                        'unique',
×
217
                                                        __( 'The <strong>Checkout URL nonce name</strong> field must be unique', 'wp-graphql-woocommerce' ),
×
218
                                                        'error'
×
219
                                                );
×
220

221
                                                return '_wc_checkout';
×
222
                                        }
223

224
                                        return $value;
×
UNCOV
225
                                },
×
UNCOV
226
                        ],
×
UNCOV
227
                        [
×
UNCOV
228
                                'name'              => 'account_url_nonce_param',
×
UNCOV
229
                                'label'             => __( 'Account URL nonce name', 'wp-graphql-woocommerce' ),
×
UNCOV
230
                                'desc'              => __( 'Query parameter name of the nonce included in the "accountUrl" field', 'wp-graphql-woocommerce' )
×
UNCOV
231
                                        . ( $account_url_hardcoded ? __( ' This setting is disabled. The "ACCOUNT_URL_NONCE_PARAM" flag has been set with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
232
                                'type'              => 'text',
×
UNCOV
233
                                'value'             => $account_url_hardcoded ? ACCOUNT_URL_NONCE_PARAM : woographql_setting( 'account_url_nonce_param', '_wc_account' ),
×
UNCOV
234
                                'disabled'          => defined( 'ACCOUNT_URL_NONCE_PARAM' ) || ! in_array( 'account_url', $enabled_authorizing_url_fields, true ),
×
UNCOV
235
                                'sanitize_callback' => static function ( $value ) {
×
236
                                        $other_nonces = self::get_other_nonce_values( 'account_url' );
×
237
                                        if ( in_array( $value, $other_nonces, true ) ) {
×
238
                                                add_settings_error(
×
239
                                                        'account_url_nonce_param',
×
240
                                                        'unique',
×
241
                                                        __( 'The <strong>Account URL nonce name</strong> field must be unique', 'wp-graphql-woocommerce' ),
×
242
                                                        'error'
×
243
                                                );
×
244

245
                                                return '_wc_account';
×
246
                                        }
247

248
                                        return $value;
×
UNCOV
249
                                },
×
UNCOV
250
                        ],
×
UNCOV
251
                        [
×
UNCOV
252
                                'name'              => 'add_payment_method_url_nonce_param',
×
UNCOV
253
                                'label'             => __( 'Add Payment Method URL nonce name', 'wp-graphql-woocommerce' ),
×
UNCOV
254
                                'desc'              => __( 'Query parameter name of the nonce included in the "addPaymentMethodUrl" field', 'wp-graphql-woocommerce' )
×
UNCOV
255
                                        . ( $add_payment_method_url_hardcoded ? __( ' This setting is disabled. The "ADD_PAYMENT_METHOD_URL_NONCE_PARAM" flag has been set with code', 'wp-graphql-woocommerce' ) : '' ),
×
UNCOV
256
                                'type'              => 'text',
×
UNCOV
257
                                'value'             => $add_payment_method_url_hardcoded ? ADD_PAYMENT_METHOD_URL_NONCE_PARAM : woographql_setting( 'add_payment_method_url_nonce_param', '_wc_payment' ),
×
UNCOV
258
                                'disabled'          => defined( 'ADD_PAYMENT_METHOD_URL_NONCE_PARAM' ) || ! in_array( 'add_payment_method_url', $enabled_authorizing_url_fields, true ),
×
UNCOV
259
                                'sanitize_callback' => static function ( $value ) {
×
260
                                        $other_nonces = self::get_other_nonce_values( 'add_payment_method_url' );
×
261
                                        if ( in_array( $value, $other_nonces, true ) ) {
×
262
                                                add_settings_error(
×
263
                                                        'add_payment_method_url_nonce_param',
×
264
                                                        'unique',
×
265
                                                        __( 'The <strong>Add Payment Method URL nonce name</strong> field must be unique', 'wp-graphql-woocommerce' ),
×
266
                                                        'error'
×
267
                                                );
×
268

269
                                                return '_wc_payment';
×
270
                                        }
271

272
                                        return $value;
×
UNCOV
273
                                },
×
UNCOV
274
                        ],
×
UNCOV
275
                        [
×
UNCOV
276
                                'name'    => 'enable_pre_auth_download_urls',
×
UNCOV
277
                                'label'   => __( 'Enable pre-authenticated download URLs', 'wp-graphql-woocommerce' ),
×
UNCOV
278
                                'desc'    => __( 'Adds a "preAuthDownloadUrl" field to downloadable items that generates a tokenized URL allowing downloads without cookie-based authentication. Useful for headless frontends where users cannot be redirected through the session transfer endpoint.', 'wp-graphql-woocommerce' ),
×
UNCOV
279
                                'type'    => 'checkbox',
×
UNCOV
280
                                'default' => 'off',
×
UNCOV
281
                        ],
×
UNCOV
282
                        [
×
UNCOV
283
                                'name'    => 'download_url_nonce_param',
×
UNCOV
284
                                'label'   => __( 'Download URL nonce name', 'wp-graphql-woocommerce' ),
×
UNCOV
285
                                'desc'    => __( 'Query parameter name of the nonce included in the "downloadUrl" field on downloadable items.', 'wp-graphql-woocommerce' ),
×
UNCOV
286
                                'type'    => 'text',
×
UNCOV
287
                                'default' => '_wc_download',
×
UNCOV
288
                        ],
×
UNCOV
289
                ];
×
290
        }
291
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc