feat(reader-activation): frontend registration API for integrations#4626

Draft

jason10lee wants to merge 47 commits intotrunkfrom

feat/integrations-reader-registration

Commits on Apr 3, 2026

feat: initial reader registration API rollup from working branch
jason10lee
committed
docs: annotated new functions with type hints
jason10lee
committed
fix: centralize, normalize definition of `$referer`
jason10lee
committed
fix: use returned status rather than hardcoded value
jason10lee
committed
test: annotate with group like we do elsewhere for isolated testing
jason10lee
committed
docs: note to self about parameterizing `verify_captcha()`
jason10lee
committed
docs: note about better mitigating attacks
jason10lee
committed
docs: note potential disclosure and mitigation path
jason10lee
committed
fix: merge into existing `reader` now that we are out of POC
jason10lee
committed
fix: condition reCAPTCHA v3 actions on their `ready()`
jason10lee
committed
style: explicit fallback for `wp_parse_url()` as suggested by Copilot
jason10lee
committed
fix: make endpoint available only when RAS is enabled, per Copilot
jason10lee
committed
test: properly tear down our new routes
jason10lee
committed
feat: localize reCAPTCHA site key and version for both v2 and v3
jason10lee
committed
feat: add reCAPTCHA v2 invisible support to register()
jason10lee
committed
fix: move grecaptcha.execute inside try block to prevent Promise leak
jason10lee
committed
fix: add isolated flag to v2 invisible widget to prevent interference
jason10lee
committed
fix: add 30s timeout to v2 invisible token acquisition to prevent hang
jason10lee
committed
docs: note potential concurrent-call guard for v2 invisible token
jason10lee
committed
fix: gracefully reject calls if essential config is missing
jason10lee
committed
docs: potential future directions for rate limiting
jason10lee
committed
fix: address potential race condition on multiple registrations with same email
jason10lee
committed
fix: ensure idempotency by making sure callers get current reader data for logged-in readers
jason10lee
committed
fix: condition config output on RAS
jason10lee
committed
fix: use server-side email, not submitted email, for logged-in users
jason10lee
committed
fix: reject Promise and provide helpful error if reCAPTCHA not happy
jason10lee
committed
fix: move reCAPTCHA behind rate limiting to protect metered service from floods
jason10lee
committed

Commits on Apr 9, 2026

Commits on Apr 14, 2026

Commits on Apr 16, 2026