[abdul-kaioum]

Why

Outside REST, Request has no way to read headers or the raw body: __call only proxies to WP_REST_Request, and body() is the decoded payload. Static and AJAX routes that authenticate by a header token or an HMAC over the exact bytes (webhooks, setup proofs) have to fall back to $_SERVER and php://input themselves.

What

• InteractsWithHeaders trait, used by Request:
  • header($name, $default = null) accepts any name style (X-Setup-Token or x_setup_token) and returns a sanitized value (sanitize_text_field); headers() returns the sanitized map keyed the way WP_REST_Request canonicalizes names (lowercase, underscores); hasHeader($name).
  • rawHeader($name, $default = null) returns the exact bytes, for HMAC/token verification only.
  • Values come from the hydrated WP_REST_Request when present (multi-value headers joined with , ), else from $_SERVER HTTP_* plus CONTENT_TYPE/CONTENT_LENGTH/CONTENT_MD5. Empty CONTENT_* (FastCGI sends '' on bodyless requests) counts as absent.
• Request::content() returns the raw body: the REST request's when hydrated, else php://input, read once and cached. setBody() now decodes from content(), so the stream is not read twice.
• method() unslashes, sanitizes and upper-cases REQUEST_METHOD, returning '' when absent (it read the raw global with no isset).
• contentType() reads the sanitized Content-Type and strips a case-insensitive leading application/. Bug fix: it used ltrim($type, 'application/'), a character mask, so application/pdf became df and text/plain became ext/plain.
• New public methods stay untyped so consumer Request subclasses can override them (same contract RequestTest pins for the other accessors).

StaticRouter

• Subdirectory installs: routes matched the raw REQUEST_URI against /page/..., so on example.com/blog (and with /index.php/ permalinks) nothing matched and WordPress served a 404. Routes now match WP::$request (home path and index.php already stripped), falling back to the request URI minus the home path under plain permalinks.
• dispatchOnParseRequest() (opt-in): dispatch before the main query runs, so self-responding routes (OAuth callbacks, webhooks) are never flagged 404 or redirected by redirect_canonical. The default stays template_redirect, which page-content routes (bit-connect's portal) need.
• Flush storm: maybeFlushRewriteRules() flushed (and rewrote .htaccess in admin) on every request whenever our rules never persisted. It now skips plain permalinks and retries at most every 5 minutes via a transient.
• Deactivation: flushOnDeactivate() flushed while the router's rules were still registered on the deactivating request, re-saving them so /page/* kept rewriting after the plugin was off. It now empties rewrite_rules (row kept) so WordPress rebuilds it on the next request without them.
• Root rule: RewriteRuleSet added ^page/?$ for any route set; it is now added only for an empty-path route (Route::get('/')), so a non-page page slug is no longer hijacked.

Tests

Tests landed before each implementation commit. RequestTest covers header lookup by name style, CONTENT_* exposure, defaults, the canonical map, sanitized header()/headers() vs exact rawHeader(), REST precedence, method() sanitizing/missing, and contentType() prefix handling (JSON with charset, pdf, mixed case, non-application types, tags); raw body byte-for-byte (JSON and form payloads), empty body, single stream read and REST precedence. A FakePhpInputStream fixture replaces the php:// wrapper so the tests drive the real file_get_contents('php://input') path. The sanitize_text_field stub now mirrors core so sanitization is actually asserted. StaticRoutingTest/RewriteRuleSetTest cover subdirectory and /index.php/ matching, home-path stripping (segment boundary, no WP object, template_redirect's '' argument), default vs parse_request dispatch (unmatched paths, method enforcement), plain-permalink skip, deactivation clearing (also after init), per-page retry windows, activation inside a window and the root rule; the new edge cases were each checked against a mutation of StaticRouter. composer test (298), php-cs-fixer and composer compat pass.

Needed by the PaymentForm plugin to move its /paymentform/* endpoints onto StaticRouter; it will use dispatchOnParseRequest() and read rawHeader()/content() for its token and HMAC checks.

🤖 Generated with Claude Code