Review: Append some information to the ZIP urls

[dd32]

When a plugin is in review state, reviewers often copy the download URL and pass that to a script to help run their reviews.

It would be helpful to the reviewers if there was an easy way to infer extra details about the plugin while performing the review.

So far the only thing requested has been the slug of the plugin in the ZIP, but I expect that it would be helpful to know the ID of the in-review plugin post and possibly other items in the future.

It seems the simplest way right now to provide scripts with extra details is just to append to the ZIP URL, ie https://wordpress.org/plugins/.....dsplugin.zip?slug=d-test-plugin&post_id=12345&....=....

cc @frantorres @davidperez

[davidperez]

I see a good solution before we could get that info via API. I'd suggest to add the email of the author and domain of the header uri, so we could check the owner issues.

[frantorres]

I think it would be great to have:

• Plugin slug.
• Plugin ID.
• Author username.
• Author email.
• Plugin status in the repository (so we know we are checking a new plugin or a plugin already published in the repository)

The domain of the header URI won't be needed as that will be already in the plugin files and can be taken from there.

[dd32]

In 13610:

Plugin Directory: Add a 'pending plugin' API endpoint to fetch information about a plugin in review.

This is intended to be used by the Reviewer tools, such that the tools can use information known to the plugin directory about the ZIP being reviewed.

See #7385.

[dd32]

The above changeset adds a link to a private API endpoint that details information about the plugin the ZIP is attached to.

The API data is the same as the regular plugin_information API endpoint, but for pending plugins, with some additional fields.

For example, you'd see:

{
  "ID": 12345,
  "post_status": "new",
  "edit_url": "https://wordpress.org/plugins/wp-admin/post.php?action=edit&id=12345",
  "submitter": {
    "user_login": "example_user_login",
    "user_email": "user_email@example.org"
  },
  # Everything below this point would be the same as from plugin_information
  "name": "Test Plugin",
  "slug": "d-test-plugin",
  "version": "1.0",
  ....

The API endpoint is attached to the ZIP urls in wp-admin, for example:

https://wordpress.org/plugins/files/example-file-upload.zip?info=https%3A%2F%2Fwordpress.org%2Fplugins%2Fwp-json%2Fplugins%2Fv1%2Fpending-plugin%2F12345-md5tokenhere%2F

Additional data/fields can be added as needed.

[dd32]

In 13611:

Plugin Directory: Review: Cleanup the filename displayed on the plugin list.

See #7385.

[dd32]

In 13636:

Plugin Directory: Review: Suffix ZIP urls with the API through .zip#wporgapi:https://.... rather than through .zip?info=https...

This will improve the experience for reviewers, as otherwise ? needs to be escaped on the command line.

See #7385.

[dd32]

In 13645:

Plugin Directory: API: Overwrite the global $post, to ensure it works with pending plugins.

The public plugin endpoint was operational, but the pending wasn't after [13620].

See #7385.

[dd32]

Followup requests from the team:

• Make it work for all plugins, not just pending plugins.
• Make the plugin ZIP links in Helpscout have the API too.
• Reviewer api to get next review in queue

The API should also:

• Include the pending ZIPs in the output (ie. for non-published plugins)

I'm thinking of changing the API from .../pending-plugin/{id}-{token}/ to .../plugin-review/{id}-{token}/ instead, and see about .../plugin-review/ (or POST plugin-review/fetch-and-assign.. Which will probably require an authenticated API request with an app password, where as the existing pending api was auth'd via the token in the URL only to side-step auth issues.

[dd32]

In 13649:

Plugin Directory: Review API: Expand the API used for reviews.

• Make it work for all plugins, regardless of status.
• Include the ZIPs
• Include helpful links.

See #7385.

[dd32]

In 13650:

Plugin Directory: Centralise the Helpscout email table query code.

See #7385.

[dd32]

In 13651:

Plugin Directory: Helpscout: Include the info endpoint on download urls in Helpscout.

See #7385.

[dd32]

In 13655:

Helpscout: Plugins: Limit the API endpoint to the plugins inbox.

See [13651].
See #7385.

[dd32]

In 13721:

Plugin Directory: Avoid issues when filtering attachment URLs for other blogs.

This avoids issues when the attachment has no post parent (For example, site icons) on other network sites (for example, the My Sites multisite menu).

See [13610].
See #7385.