0.6.6: Fix REST guard not blocking anonymous direct reads

0.6.6 - 2026-09-27

• Fixed the 0.6.5 REST content guard not actually blocking anonymous direct reads of the protected bonus page: the direct-item check ran on rest_pre_dispatch, which fires before WordPress resolves the request's URL parameters, so it always read an empty post ID and silently passed every request through. Moved the check to rest_request_before_callbacks, which runs after routing, and changed its fail-closed response to a WP_Error (matching WordPress's own convention) so it can no longer be overwritten before the route callback executes.
• Added a WP-CLI contract check that exercises the real WP_REST_Server dispatch pipeline via rest_do_request() for /wp/v2/pages/100164, instead of calling the guard method directly with a hand-set parameter, so this exact regression is caught by CI/contract checks going forward.

0.6.5: Block MemberPress content leaks through WordPress REST

0.6.5 - 2026-09-26

• Closed a WordPress REST authorization bypass that exposed the body of a MemberPress-protected bonus page to anonymous callers even though its normal frontend route redirected to login.
• Enforced MemberPress authorization for direct core REST item reads and collection results without introducing a second membership list.
• Added private/no-store, no-sniff, and no-index headers for protected direct REST responses plus a fail-closed anonymous fallback for the known sensitive page.
• Added source and live WP-CLI contract checks that never embed or print the course password, bucket name, or object URLs.

Version 0.6.4

v0.6.4

Release 0.6.4 with cookie consent off switch

v0.6.3 — Fix Brave/ad-blocker blocking the cookie banner script

Fixes the cookie-consent banner being completely dead in Brave (and browsers with an ad-blocker cookie-notice list, e.g. uBlock).

Root cause: cookie-notice filter lists (EasyList Cookie / Fanboy Cookiemonster, which Brave and uBlock use) network-block any URL matching /cookie-consent.js. The banner script was served from assets/features/cookie-consent/cookie-consent.js, so it was blocked (ERR_BLOCKED_BY_CLIENT), never ran, and no button did anything.

Fix: renamed the browser-served assets to assets/features/consent-ui/ (consent-ui.js / consent-ui.css), verified clean against the cookie filter lists. Also includes the 0.6.2 script-injection hardening (dismiss the banner before applying consent; wrap gated-script appends).

After updating, hard-refresh in Brave (or a fresh Brave window) to clear any cached page/script.

v0.6.2 — Brave cookie banner dismissal fix

Fixes the cookie-consent banner failing to dismiss for Brave users (and any browser shield that blocks a consent-gated script).

The accept/reject/save handlers applied consent — which injects gated tracker scripts via document.head.appendChild — before hiding the banner. Brave's shields make that append throw synchronously, aborting the handler so the banner stayed open ("clicking a selection does not make the pop-up go away"). Handlers now dismiss the UI first, and all gated-script appends are wrapped so a blocked/malformed snippet can neither throw into the handler nor stop other scripts. Consent still persists in all cases.

Regression covered in tests/cookie-consent-browser-contract.js.

v0.6.1 — TSOL Site Companion

Patch release on top of v0.6.0.

• Repointed the two WP-CLI utilities in tools/ at the renamed MemberLibrary_* classes; both previously fatalled with Class "TSOL_Library_Content_Model" not found. Neither is loaded at runtime, so v0.6.0 was functionally unaffected.
• Removed the orphaned Library admin CSS/JS the v0.6.0 strip left behind.

⚠️ Still breaking vs 0.5.x — install the canonical plugin first

The member Library is not in this plugin as of 0.6.x. It lives in the Member Library Platform plugin. Install and activate that before applying this version, or the Library will disappear from the site.

v0.6.0 — TSOL Site Companion

⚠️ Breaking — install the canonical plugin first

This release removes the member Library from this plugin. The Library now lives in the separate Member Library Platform plugin (member-library-plugin.php), shared by every brand site.

Applying this update on a site where that plugin is not installed and active will remove the Library. Install and activate it first — see Phase 8 in docs/plans/plugin-cutover-runbook.md.

What changed

• Stripped back to the TSOL site-specific features this plugin now owns: the accountability modal and cookie consent (−30,334 lines), plus the orphaned Library admin CSS/JS.
• Kept the 8 TSOL legacy data-migration modules here as TSOL-specific data history. They load only under WP-CLI and operate on the content model provided by the canonical plugin.
• Plugin header renamed to "Tom's School Of Life — Site Companion".

v0.5.1

Moves the WebVTT transcript upload and synchronization status into the Library Content editor's Media panel, directly beneath the primary playback source.\n\nValidated against the local production clone with the transcript delivery and Content admin contracts.

Version 0.5.0

Adds private WebVTT transcript uploads for Library Content, signed retryable delivery to the School app, exact content/video identity checks, and migration-package portability for WordPress-owned transcript sources.

v0.4.6

Makes the WordPress Library migration resumable. Bundled files are verified in two-file requests with visible progress, interrupted work resumes from its stored cursor, and the existing verified ZIP remains reusable for 24 hours. Catalogue records are applied only after all 77 bundled files are ready; active locks remain protected and interrupted locks recover after five minutes.