* Add rate limiting to cart endpoints based on session
* Handle nonce and rate checks in permission_callback
* Rate limit checkout only
* Debug
* Unused AbstractRoute
* Code standards
* Modify core rate limit table
* Add rate limit at rest api level, not route level
* Rate limit helper
* Remove rate limit from routes
* Usused dep
* Remove custom error logic no longer needed
* Remove dependency
* Remove custom permission_callback
* Hash IP and handle null
* Remove error response handler
* revert error_to_response changes
* Remove add_response_headers
* Remove IDENTIFIER
* Remove white space
* Increase limit
* Missing class comment
* Move rate limiting code within store api codebase
* white space
* Fix return type
* Check rate limit expiry greater than now
* Remove x- prefix
* reorder functions
* remove table
* pass request to add_nonce_headers
* return early and avoid elseif on AbstractCartRoute:get_response()
* Refactor get_ip_address() before implementing options for functionality
* Change rate limit to 5 requests
Co-authored-by: Seghir Nadir <nadir.seghir@gmail.com>
* Change rate limit window to 60 seconds
Co-authored-by: Seghir Nadir <nadir.seghir@gmail.com>
* Disable rate limiting by default
Co-authored-by: Seghir Nadir <nadir.seghir@gmail.com>
* Updated limits comment
* Example for Forwarded header
* Updated "woocommerce_store_api_enable_rate_limit_check" filter doc
* Added filter for the Store API rate limit check proxy support
* Add an action here that carries over the IP address being blocked.
* Added logic around setting the action_id, and returns an error when ip cannot be determined for users not logged in.
* Renamed action for limit exceeded.
* Common rate limiting header naming prefix, and fixed comment typos.
* Doc for Rate Limiting (wip)
* Example for Rate Limiting docs
* Remove private IP range block for rate limiting
* Refactored get_response() to add nonce headers to response instead of request
* Disable batching for Checkout calls to prevent bypassing Rate Limiting.
* Removed redundant arg.
* package-lock.json update
* Removed repeated func calls.
* Fix failing tests.
* Tests wip.
* Request limit and timeframe are now constants for RateLimits utility class.
* Tests for Rate Limit headers.
* Reverted PHPUnit config to enable all tests again.
* Update src/StoreApi/Authentication.php comment wording
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Removed possibly unnecessary get_ip_address() call.
* Changed wording on comment for get_ip_address() method.
* Simplified validate_ip() method.
* Fixed wrong header entry for "Forwarded" check.
* Unit testing for Authentication::get_ip_address()
* Comment explaining the reason to use ReflectionClass for testing get_ip_address().
* Support for error output outside batch request.
* MD linting.
* Refactor to implement options through a single filter.
* fixed md lint error and config file
* reverted accidental default func arg value removal
* re-enabled batch support for checkout
* action for limit exceed now also triggered in case we can't resolve the IP.
* Doc tweak.
* Return unresolved IP address when REMOTE_ADDR isn't set with proxy support disabled.
* Group unresolved ips for rate limiting
* Fixed bug where current limit wasn't properly initialized.
Co-authored-by: Nadir Seghir <nadir.seghir@gmail.com>
Co-authored-by: Paulo Arromba <17236129+wavvves@users.noreply.github.com>
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Remove object from sanitizeHTML return value
* Import sanitizeHTML from utils
* Fix dangerously set inner HTML format
* Update package-lock
* Update package-lock
* Update package-lock
* Update @types/dompurify version
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Convert checkout context to data store - part 1 (https://github.com/woocommerce/woocommerce-blocks/pull/6232)
* Add checkout data store
* wip on checkout data store
* CheckoutContext now uses the checkout store
* Investigated and removed setting the redirectUrl on the default state
* update extension and address hooks to use checkout data store
* use checkout data store in checkout-processor and use-checkout-button
* trim useCheckoutContext from use-payment-method-interface && use-store-cart-item-quantity
* Remove useCheckoutContext from shipping provider
* Remove isCalculating from state
* Removed useCheckoutContext from lots of places
* Remove useCheckoutContext from checkout-payment-block
* Remove useCheckoutContext in checkout-shipping-methods-block and checkout-shipping-address-block
* add isCart selector and action and update the checkoutstate context
* Fixed redirectUrl bug by using thunks
* Remove dispatchActions from checkout-state
* Change SET_HAS_ERROR action to be neater
* Thomas' feedback
* Tidy up
* Oops, deleted things I shouldn't have
* Typescript
* Fix types
* Fix tests
* Remove isCart
* Update docs and remove unecessary getRedirectUrl() selector
* set correct type for preloadedCheckoutData
* Remove duplicate Address type
* Fix missing addresses from type-defs index
* Update docs/block-client-apis/checkout/checkout-api.md
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Update docs/block-client-apis/checkout/checkout-api.md
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Update docs
* Update docs/block-client-apis/checkout/checkout-api.md
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Update docs/block-client-apis/checkout/checkout-api.md
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Revert feedback changes
* REvert feedback formatting
* Update docs formatting
* Delete empty types.ts file
* remove merge conflict from docs
* Correct linting in docs
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Move checkout state code into thunks and rename `CheckoutState` context to `CheckoutEvents` (https://github.com/woocommerce/woocommerce-blocks/pull/6455)
* Add checkout data store
* wip on checkout data store
* CheckoutContext now uses the checkout store
* Investigated and removed setting the redirectUrl on the default state
* update extension and address hooks to use checkout data store
* use checkout data store in checkout-processor and use-checkout-button
* trim useCheckoutContext from use-payment-method-interface && use-store-cart-item-quantity
* Remove useCheckoutContext from shipping provider
* Remove isCalculating from state
* Removed useCheckoutContext from lots of places
* Remove useCheckoutContext from checkout-payment-block
* Remove useCheckoutContext in checkout-shipping-methods-block and checkout-shipping-address-block
* add isCart selector and action and update the checkoutstate context
* Fixed redirectUrl bug by using thunks
* Remove dispatchActions from checkout-state
* Change SET_HAS_ERROR action to be neater
* Thomas' feedback
* Tidy up
* Oops, deleted things I shouldn't have
* Typescript
* Fix types
* Fix tests
* Remove isCart
* Update docs and remove unecessary getRedirectUrl() selector
* validate event emitter button
* Added thunks in a separate file
* Call thunks from checkout-state
* Checkout logic tested and working
* Remove dependency injection as much as poss, tidy up and fix some TS errors
* Fix types in thunks.ts
* Fixed some ts errors
* WIP
* Fixed bug
* Shift side effects from checkout-state to checkout-processor
* Revert "Shift side effects from checkout-state to checkout-processor"
This reverts commit 059533da4eb34f9982f66cd4adacc7b2c24f939f.
* Rename CheckoutState to CheckoutEvents
* Move status check outside the thunk
* remove duplicate EVENTS constant
* remove temp buttons
* Remove console logs
* Augment @wordpress/data package with our new store types
* Add correct type for CheckoutAction
* Remove createErrorNotice arg from runCheckoutAfterProcessingWithErrorObservers
* Remove createErrorNotice from emit event types
* Use type keyword when importing types
* Add correct types for dispatch and select in thunks
* Update wordpress/data types
* Replace store creation with new preferred method
* Set correct action type on reducer
* Remove unnecessary async from thunk
* add CHECKOUT_ prefix to checkout events again
* export EVENTS with eveything else in checkout0-events/event-emit
* Remove duplicate SelectFromMap and TailParameters
* Updated type for paymentStatus
* TODO remove wp/data experimental thunks
* Remove `setCustomerId` from events and `processCheckoutResponseHeaders` (https://github.com/woocommerce/woocommerce-blocks/pull/6586)
* Prevent passing dispatch, instead get actions direct from store
* Get setCustomerId from the store instead of passing it to processCheckoutResponseHeaders
* Revert "Prevent passing dispatch, instead get actions direct from store"
This reverts commit 4479a2ef5599d9c8d99c3629616b3d662210fc08.
* Auto stash before revert of "Prevent passing dispatch, instead get actions direct from store"
* Remove duplicate dispatch
* Fix unit tests
Co-authored-by: Thomas Roberts <thomas.roberts@automattic.com>
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
* Refactor selectors to not return functions anymore
This is a poor DevEx and naming did not reflect what the selector was returning.
* Update combobox to be more explicit when selecting validation error
* Update useValidation to use the new getValidationError selector
* Include @woocommerce/base-hooks in tsconfig
* Update ValidationInputError to use new selector
* Update ValidatedTextInput to use new selectors
* Prevent reference errors when getting validation errors in ComboBox
* Defend against case where message prop of error object is undefined
* Fix totals/coupon to use new validation selector
* Use validation data store in CheckoutTerms block
* Update AddressForm to use new validation selector
* Update AttributeSelectControl to use new validation selector
* Fix syntax error in ValidatedTextInput
* Fix multiple import error from rebase
* Fix lint issue in useStoreCartItemQantity
* Fix tests to reflect new selector API
* Remove unused validation prop from CheckoutTermsBlock
* Change CheckoutTermsBlock unit tests to use validation data store
* Fix JSDOC syntax
* fix merge conflict in checkout-api.md
Co-authored-by: Alex Florisca <alex.florisca@automattic.com>
Co-authored-by: Niels Lange <info@nielslange.de>
* Add checkout data store
* wip on checkout data store
* CheckoutContext now uses the checkout store
* Investigated and removed setting the redirectUrl on the default state
* update extension and address hooks to use checkout data store
* use checkout data store in checkout-processor and use-checkout-button
* trim useCheckoutContext from use-payment-method-interface && use-store-cart-item-quantity
* Remove useCheckoutContext from shipping provider
* Remove isCalculating from state
* Removed useCheckoutContext from lots of places
* Remove useCheckoutContext from checkout-payment-block
* Remove useCheckoutContext in checkout-shipping-methods-block and checkout-shipping-address-block
* add isCart selector and action and update the checkoutstate context
* Fixed redirectUrl bug by using thunks
* Remove dispatchActions from checkout-state
* Change SET_HAS_ERROR action to be neater
* Thomas' feedback
* Tidy up
* Oops, deleted things I shouldn't have
* Typescript
* Fix types
* Fix tests
* Remove isCart
* Update docs and remove unecessary getRedirectUrl() selector
* validate event emitter button
* Added thunks in a separate file
* Call thunks from checkout-state
* Checkout logic tested and working
* Remove dependency injection as much as poss, tidy up and fix some TS errors
* Fix types in thunks.ts
* Fixed some ts errors
* WIP
* Fixed bug
* Shift side effects from checkout-state to checkout-processor
* Revert "Shift side effects from checkout-state to checkout-processor"
This reverts commit 059533da4eb34f9982f66cd4adacc7b2c24f939f.
* Rename CheckoutState to CheckoutEvents
* Move status check outside the thunk
* remove duplicate EVENTS constant
* remove temp buttons
* Remove console logs
* Augment @wordpress/data package with our new store types
* Add correct type for CheckoutAction
* Remove createErrorNotice arg from runCheckoutAfterProcessingWithErrorObservers
* Remove createErrorNotice from emit event types
* Use type keyword when importing types
* Add correct types for dispatch and select in thunks
* Update wordpress/data types
* Replace store creation with new preferred method
* Set correct action type on reducer
* Remove unnecessary async from thunk
* add CHECKOUT_ prefix to checkout events again
* export EVENTS with eveything else in checkout0-events/event-emit
* Remove duplicate SelectFromMap and TailParameters
* Updated type for paymentStatus
* TODO remove wp/data experimental thunks
* Remove `setCustomerId` from events and `processCheckoutResponseHeaders` (https://github.com/woocommerce/woocommerce-blocks/pull/6586)
* Prevent passing dispatch, instead get actions direct from store
* Get setCustomerId from the store instead of passing it to processCheckoutResponseHeaders
* Revert "Prevent passing dispatch, instead get actions direct from store"
This reverts commit 4479a2ef5599d9c8d99c3629616b3d662210fc08.
* Auto stash before revert of "Prevent passing dispatch, instead get actions direct from store"
* Remove duplicate dispatch
* Fix unit tests
Co-authored-by: Thomas Roberts <thomas.roberts@automattic.com>
Co-authored-by: Thomas Roberts <5656702+opr@users.noreply.github.com>
Sanitizing the merchant store link in the error message added in WooPay when in some
cases the customer could run into an issue where we need to tell them an error occurred
and they have to go back to the merchant store and re-initialize WooPay to fix it.
Because previously we were only expecting strings, the text was not sanitized.
* Add default page notice
* show notice all inner blocks
* support flow when page isnt saved
* switch from where we get the current post id
* update lock
* fix types
* Remove old compatibility notices from Cart and Checkout
* Move useCompatibilityNotice to sidebar-compatibility-notice directory
* Remove old CartCheckoutCompatibilityNotice
* Create sidebar compatibility notice hoc
* Add isCartOrCheckoutOrInnerBlock function
* Refactor defaultNotice to use new isCartOrCheckoutOrInnerBlock func
* Remove BlockSettings from checkout edit and export from checkout-shared
* Change so component still renders, it is just hidden with display: none
This is required because when it returns null the component gets skipped from being added to the Slot, then when it does return a component, then it gets rendered at the bottom of the Slot. By ensuring it always renders we can have it at the top all the time.
* Set the priorities of the hoc filters so compat notice renders first
* Make isCartOrCheckoutInnerBlock a hook
* Remove old compatibility notice related tests
* Remove BlockSettings from Cart
* Remove withDefaultNotice hoc
* Include DefaultNotice in compatibility notice
* Remove DefaultNotice from Checkout
* Rename withSidebarCompatibilityNotice to withSidebarNotices
This is because it includes the sidebar compatibility notice and the default notices
* Remove useIsCartOrCheckoutOrInnerBlock hook
* Remove compatibility notice code from tests
* Revert DefaultNotice back to the old one
* Remove unused components
* Remove withBlockSettings HOC and fix TS types
This is an abstraction that is no longer required, we can just include BlockSettings in the Cart and Checkout blocks
* Remove CartCheckoutFeedbackPrompt from BlockSettings
It will be included in sidebar-notices instead
* Fix TS Types in DefaultNotice
* Add BlockSettings to cart and checkout edit
* Editor: Add feedback box to the Cart & Checkout Inner Blocks (https://github.com/woocommerce/woocommerce-blocks/pull/6881)
* Show "Feedback prompt" for all inner blocks
* Fix the "feedback" notice position for these blocks
The "checkout fields", "checkout billing address" and
"checkout shipping address" have the addressFields option which
gets rerendered and placed at the bottom of the inspector controls.
* Tidy up the address-fields hoc
* Use correct block name to check for billing or shipping address
* Revert "Editor: Add feedback box to the Cart & Checkout Inner Blocks (https://github.com/woocommerce/woocommerce-blocks/pull/6881)"
This reverts commit 5f3d6cf15ce08d9c303e62ec3e0d0315ead1281f.
* Add hack to get feedback prompt to render last
* Fix TS errors for context and attributes
* Include CartCheckoutFeedbackPrompt in accountcontrols & addresscontrols
* Do not include feedback prompt if on an address block or contact info
* Remove unused hoc for address fields
Co-authored-by: Nadir Seghir <nadir.seghir@gmail.com>
Co-authored-by: Saad Tarhi <saad.trh@gmail.com>
Mike Jolley
Luigi Teschio
Thomas Roberts
dependabot[bot]
Paulo Arromba
Daniel W. Robert
Hsing-yu Flowers
Alex Florisca
Thomas Roberts
Lucio Giannotta
Niels Lange
Saad Tarhi
Tarun Vijwani
Albert Juhé Lluveras
renovate[bot]
Alba Rincón
Nadir Seghir