zbatte/hub-insurance
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(instanda): hygiene pass + v1.1.0 (uninstall, notices, cron, resubmit, theme)

Browse Source 
- F-15: uninstall now removes ALL espinstanda_* options and transients (incl. the
  encrypted password and its self-provisioned key).
- F-16: register the "Gravity Forms required" admin notice unconditionally so it is
  reachable when GF is inactive (gform_loaded never fires then).
- F-22: self-heal the daily retention cron on admin_init (matches the schema self-heal).
- F-19: re-validate the stored payload via Field_Mapper::validate_payload() before a
  resubmit (DB-tamper trust boundary).
- F-20: increment the retry count on resubmit and dispatch the previously-dead
  espinstanda_resubmit_success notification event.
- F-23: emit the theme's Form-5 date-range JS only on pages that embed a Gravity Form
  and disconnect the MutationObserver (was observing the DOM subtree forever).
- F-24: bump plugin to 1.1.0; add readme.txt changelog documenting the audit fixes and
  the required ops actions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
zbatte
2026-07-02 16:20:10 -06:00
co-authored by Claude Fable 5
parent 0732dd662d
commit 5d2e9cb7e5
7 changed files with 175 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-content/plugins/esp-instanda-integration/esp-instanda-integration.php
+22 -11
View File
@@ -3,7 +3,7 @@
* Plugin Name: ESP INSTANDA Start Quote Integration
* Plugin URI: https://getfused.com
* Description: Pushes Gravity Forms "Start a Quote" submissions into INSTANDA's Package API with write-ahead transaction logging, native entry recording, admin resubmit, and a test-mode lock. Form-agnostic - attach the feed to any form.
* Version: 1.0.7
* Version: 1.1.0
* Requires at least: 7.0
* Requires PHP: 8.5
* Author: Getfused
@@ -75,25 +75,36 @@ function platform_blockers(): array {
}
\add_action('admin_init', static function (): void {
if (!empty(platform_blockers())) {
return;
}
// Keep the schema current if the plugin was updated without re-activation.
if (empty(platform_blockers()) && Transaction_Store::needs_migration()) {
if (Transaction_Store::needs_migration()) {
Transaction_Store::install_table();
}
// Self-heal the retention cron if its scheduled event was ever lost (the schema
// self-heals above; the cron must too, or retention silently stops forever).
if (!\wp_next_scheduled(CLEANUP_HOOK)) {
\wp_schedule_event(time(), 'daily', CLEANUP_HOOK);
}
});
// Requirements notice registered UNCONDITIONALLY: gform_loaded never fires when Gravity
// Forms is absent, so a notice registered only inside it would be unreachable in exactly
// the case (GF missing) an admin most needs to see it.
\add_action('admin_notices', static function (): void {
$errors = platform_blockers();
if ($errors) {
echo '<div class="notice notice-error"><p><strong>ESP INSTANDA Integration is inactive:</strong> '
. esc_html(implode(' ', $errors)) . '</p></div>';
}
});
/* ------------------------------------------------ Gravity Forms Add-On registration */
\add_action('gform_loaded', Guard::wrap(static function (): void {
if (!empty(platform_blockers()) || !method_exists('GFForms', 'include_feed_addon_framework')) {
\add_action('admin_notices', static function (): void {
$errors = platform_blockers();
if (!$errors) {
return;
}
echo '<div class="notice notice-error"><p><strong>ESP INSTANDA Integration is inactive:</strong> '
. esc_html(implode(' ', $errors)) . '</p></div>';
});
return;
return; // the requirements notice is registered unconditionally above
}
\GFForms::include_feed_addon_framework();
wp-content/plugins/esp-instanda-integration/includes/class-field-mapper.php
+31
View File
@@ -121,6 +121,37 @@ final class Field_Mapper {
return $errors;
}
/**
* Sanity-check a stored StartQuote wire body before re-sending it (resubmit trust
* boundary): the DB is treated as untrusted input. Returns error codes (empty = ok).
* Pure - uses a fixed UTC zone since only Y-m-d well-formedness is being checked.
*
* @param array<string,mixed> $body A body previously built by to_payload().
* @return list<string>
*/
public function validate_payload(array $body): array {
$errors = [];
foreach (['Role', 'ActivityType', 'PQ_LocationState_CHOICE'] as $key) {
if (trim((string) ($body[$key] ?? '')) === '') {
$errors[] = $key . '_missing';
}
}
if (!$this->is_positive_integer($body['PQ_MaximumDailyAttendance_NUM'] ?? null)) {
$errors[] = 'attendance_invalid';
}
$email = trim((string) ($body['PQ_CustomerEmailAddress_TXT'] ?? ''));
if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
$errors[] = 'email_invalid';
}
$tz = new \DateTimeZone('UTC');
foreach (['PQ_EventStart_DATE', 'PQ_EventEnd_DATE'] as $key) {
if ($this->parse_date((string) ($body[$key] ?? ''), $tz) === null) {
$errors[] = $key . '_invalid';
}
}
return $errors;
}
/** D8 - inclusive consecutive-day count: (end - start) + 1; a single-day event is 1. */
private function consecutive_days(\DateTimeImmutable $start, \DateTimeImmutable $end): int {
return (int) $start->diff($end)->days + 1;
wp-content/plugins/esp-instanda-integration/includes/class-instanda-addon.php
+1 -1
View File
@@ -18,7 +18,7 @@ namespace ESP\Instanda;
final class Instanda_AddOn extends \GFFeedAddOn {
protected $_version = '1.0.7';
protected $_version = '1.1.0';
protected $_min_gravityforms_version = '2.10.3';
protected $_slug = 'espinstanda';
protected $_path = 'esp-instanda-integration/esp-instanda-integration.php';
wp-content/plugins/esp-instanda-integration/includes/class-transactions-table.php
+26 -1
View File
@@ -159,14 +159,24 @@ final class Resubmit_Handler {
$store->append_event($tx_id, 'Resubmit aborted - stored payload unreadable.', 'error');
return;
}
// Trust boundary: the stored body is untrusted input on the way back out to the
// insurer - re-validate it before re-sending (guards against DB tampering).
$payload_errors = (new Field_Mapper())->validate_payload($body);
if ($payload_errors) {
$store->append_event($tx_id, 'Resubmit aborted - stored payload failed re-validation: ' . implode(', ', $payload_errors), 'error');
return;
}
$store->increment_retry($tx_id); // this attempt is a retry - keep the count truthful
$result = (new Api_Client())->start_quote($body, $tx->dedupe_key);
if ($result->ok && $result->quote_ref !== null) {
if ($result->ok && $result->quote_ref !== null && $result->quote_ref !== '') {
$store->mark_success($tx_id, $result->quote_ref, $result->url_single_use, $result->http_status);
Failure_Surface::bump();
if ($tx->entry_id) {
Entry_Integration::record($tx->entry_id, $result->quote_ref, (string) $result->url_single_use, 'delivered', $tx->environment);
self::notify_resubmit_success((int) $tx->entry_id);
} else {
// Stranded lead (no entry) - mint a fresh link and email the customer (option B).
$fresh = (string) $result->url_single_use;
@@ -182,4 +192,19 @@ final class Resubmit_Handler {
Failure_Surface::bump();
}
}
/** Dispatch the registered espinstanda_resubmit_success notification event for an entry. */
private static function notify_resubmit_success(int $entry_id): void {
if (!class_exists('\GFAPI')) {
return;
}
$entry = \GFAPI::get_entry($entry_id);
if (is_wp_error($entry)) {
return;
}
$form = \GFAPI::get_form((int) $entry['form_id']);
if ($form) {
\GFAPI::send_notifications($form, $entry, 'espinstanda_resubmit_success');
}
}
}
wp-content/plugins/esp-instanda-integration/readme.txt
+67
View File
@@ -0,0 +1,67 @@
=== ESP INSTANDA Start Quote Integration ===
Contributors: getfused
Requires at least: 7.0
Requires PHP: 8.5
Stable tag: 1.1.0
Pushes Gravity Forms "Start a Quote" submissions into INSTANDA's Package API with
write-ahead transaction logging, native entry recording, admin resubmit, and a test-mode lock.
== Changelog ==
= 1.1.0 =
Remediation of the 2026-07 security/reliability/PII audit (see docs/audit-esp-instanda-2026-07.md).
No duplicate policies / no lost quotes:
* Dedupe key is now content-addressed (form id + mapped field values) instead of a
per-request token, so an identical re-POST or a retry-after-error reuses the existing
quote instead of creating a second one at INSTANDA (F-01). Adds a 30-minute
short-circuit window and a content-key race lock.
* Refuse to resubmit an already-delivered transaction (F-12); scope the resubmit
self-recovery guard to the content dedupe key so a customer's *different* event is not
skipped (F-18).
* A 2xx response with a missing/empty quoteRef is now recorded as ambiguous
(possible_duplicate = 1), not a hard failure (F-10, F-17).
* Aborts the StartQuote when the write-ahead insert fails, so no unaudited call is made (F-14).
Go-live safety:
* switch_to_live() now also sets the environment to Live; previously the go-live button
left real quotes hitting the Test endpoint (F-03).
* Go-live advisory flags when more than one active INSTANDA feed exists (F-02).
Security & PII:
* Corrected the at-rest-secret docblock: the "DB dump never exposes a secret" guarantee
only holds when SPG_INSTANDA_KEY is set as a constant (F-04).
* Retention now scrubs PII from stale failed/pending rows (previously kept forever) and
exempts stranded delivered leads from the purge (F-05, F-13); wired WordPress's Erase
Personal Data tool to delete a customer's transactions (F-05).
* Uninstall now removes ALL plugin options and transients, including the encrypted
password and its key (F-15).
* Added per-IP (20/h) and per-email (5/h) rate limiting on the public create (F-06).
Reliability & correctness:
* Timestamps are written in UTC to match the retention/dedupe cutoffs and displayed in
site-local time (F-07). NOTE: rows created before 1.1.0 were stored in site-local time;
clear the transaction table (test data) at deploy to avoid a mixed-timezone history.
* Fail closed on an unexpected error in the create path (no quote-less entry) and alert
admins, instead of silently passing (F-11); log when async recording cannot resolve a
transaction (F-09).
* The "Gravity Forms required" admin notice is now shown even when Gravity Forms is
inactive (F-16); the daily retention cron self-heals on admin_init (F-22).
* Resubmit re-validates the stored payload before re-sending (F-19); the Retries count is
now incremented and the resubmit-success notification event is dispatched (F-20).
Theme:
* The Form-5 date-range inline JS is emitted only on pages that embed a Gravity Form and
its MutationObserver now disconnects instead of watching the DOM forever (F-23).
Operations required alongside this release (see the audit report, Ops checklist):
* Set SPG_INSTANDA_KEY + SPG_INSTANDA_USERNAME_LIVE/_PASSWORD_LIVE + SPG_INSTANDA_ENV in
production wp-config.php (blocking) - OPS-1 / F-04.
* Deactivate the INSTANDA feed on the test Form 6 in production (blocking) - OPS-3 / F-02.
* Configure espinstanda_alert_emails and the quote-success notification (blocking) - OPS-4.
* Rotate the SendGrid API key out of committed wp-config.php - OPS-2 / F-08.
* Add reCAPTCHA/Akismet to the canonical quote form - OPS-5 / F-06.
= 1.0.7 =
* Initial audited release.
wp-content/plugins/esp-instanda-integration/uninstall.php
+12 -3
View File
@@ -20,10 +20,19 @@ try {
// Table name is a trusted internal constant, not user input.
$wpdb->query("DROP TABLE IF EXISTS {$table}");
delete_option('espinstanda_db_version');
delete_option('espinstanda_operating_mode_audit');
// Remove EVERY plugin option and transient - including the encrypted Test password
// and its self-provisioned key - so no recoverable secret survives uninstall.
$opt = $wpdb->esc_like('espinstanda_') . '%';
$tr = '_transient_' . $wpdb->esc_like('espinstanda_') . '%';
$trt = '_transient_timeout_' . $wpdb->esc_like('espinstanda_') . '%';
$wpdb->query($wpdb->prepare(
"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s",
$opt,
$tr,
$trt
));
// Clear any scheduled cleanup that may still be queued.
// Clear any scheduled events that may still be queued.
wp_clear_scheduled_hook('esp_instanda_cleanup');
} catch (\Throwable $e) {
if (function_exists('error_log')) {
wp-content/themes/GFeneratePress/functions.php
+16 -2
View File
@@ -189,7 +189,17 @@ function gf_validate_date_range( $validation_result ) {
add_action( 'wp_footer', 'gf_date_range_scripts' );
function gf_date_range_scripts() {
if ( ! class_exists( 'GFForms' ) ) {
if ( ! class_exists( 'GFForms' ) || is_admin() ) {
return;
}
// Only emit this inline script on requests whose content embeds a Gravity Form -
// keeps ~220 lines of JS off every other page. Server-side validation is unaffected.
// If the post cannot be inspected, fall back to emitting (safe default).
$post = get_post();
if ( $post instanceof WP_Post
&& ! has_shortcode( (string) $post->post_content, 'gravityform' )
&& ! has_block( 'gravityforms/form', $post )
&& false === strpos( (string) $post->post_content, 'gform' ) ) {
return;
}
?>
@@ -410,10 +420,14 @@ function gf_date_range_scripts() {
}
if ( ! attachListeners() ) {
var tries = 0;
var observer = new MutationObserver( function () {
if ( attachListeners() ) observer.disconnect();
// Stop once the fields are wired, or after a bounded number of tries, so we
// never observe the whole document subtree indefinitely on non-form pages.
if ( attachListeners() || ++tries > 20 ) observer.disconnect();
} );
observer.observe( document.body, { childList: true, subtree: true } );
setTimeout( function () { observer.disconnect(); }, 10000 );
}
} )();