From 804d47964d5aae1e38e8fc07a30304ece4da739a Mon Sep 17 00:00:00 2001 From: Kiro Agent <244629292+kiro-agent@users.noreply.github.com> Date: Wed, 27 May 2026 09:31:48 +0000 Subject: [PATCH] chore(bricks): remove dead constructor hook + document sanitizer contract - REST controller: remove add_action('rest_api_init') from constructor since routes are now registered directly by the rest_api_init hook in slashed-bricks.php. Eliminates redundant double-registration on REST requests. - Token sanitizer: add COMPOUND-PREFIX KEYS docblock to sanitize_color_section() documenting that dark-mode keys (brand_dark_*) intentionally enter the 'direct' bucket and that color names must never end in 'hex' or 'raw'. --- .../bricks/includes/class-rest-controller.php | 14 ++++++++------ .../bricks/includes/class-token-sanitizer.php | 9 +++++++++ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/integrations/bricks/includes/class-rest-controller.php b/integrations/bricks/includes/class-rest-controller.php index da7f07db..0a2ce6ca 100644 --- a/integrations/bricks/includes/class-rest-controller.php +++ b/integrations/bricks/includes/class-rest-controller.php @@ -42,15 +42,17 @@ class Slashed_Bricks_REST_Controller { const NAMESPACE = 'slashed-bricks/v1'; /** - * Constructor — registers the REST routes on rest_api_init. + * Constructor — intentionally empty. * - * Now stateless: previous revisions held a reference to - * `Slashed_Bricks_Admin_Page` to share its private sanitizer; that - * dependency is gone now that sanitization lives in the dedicated - * `Slashed_Bricks_Token_Sanitizer` class. + * Route registration is handled by the caller + * (slashed_bricks_rest_routes_init in slashed-bricks.php) which + * invokes register_routes() directly inside a rest_api_init hook. + * This keeps the class stateless and avoids redundant add_action() + * calls that would fire too late when the controller is instantiated + * during the already-running rest_api_init action. */ public function __construct() { - add_action( 'rest_api_init', array( $this, 'register_routes' ) ); + // No-op. Routes are registered externally via rest_api_init hook. } /** diff --git a/integrations/bricks/includes/class-token-sanitizer.php b/integrations/bricks/includes/class-token-sanitizer.php index 1a1fa91c..531bcb3b 100644 --- a/integrations/bricks/includes/class-token-sanitizer.php +++ b/integrations/bricks/includes/class-token-sanitizer.php @@ -123,6 +123,15 @@ public static function is_hex_color( $value ) { * filter-set values). All-empty rows are omitted from the result * so the framework default applies. * + * COMPOUND-PREFIX KEYS (dark mode): + * Keys like `brand_dark_primary` enter the "direct" bucket because + * they don't end in `_hex` or `_raw`. The Svelte ColorRow merges + * hex/raw client-side and submits the resolved value under the bare + * compound key. This is intentional: dark-mode overrides are never + * submitted as paired `_hex`/`_raw` inputs. Do NOT add color names + * that end in "hex" or "raw" — they would collide with suffix + * stripping. + * * @param array $data Raw form data for the colors section. * @return array Sanitized colors keyed by base token name. */