fix: keep lexicon data private

Components/CleanupInventory.php

@@ -55,6 +55,7 @@ class CleanupInventory {
 	public const INFRASTRUCTURE_OPTIONS = [
 		'translatewp_version',
 		Migrations::TRANSLATED_MARKS_OPTION,
+		Migrations::LEXICON_PRIVATE_CACHE_PURGED_OPTION,
 		\TranslateWP\Functionality\KeepWarm::PENDING_LANGUAGES_OPTION,
 		QuotaHandoff::OPTION,
 		'translatewp_alt_text_notice',

Components/Migrations.php

@@ -16,6 +16,7 @@ class Migrations {
 
 	public const VERSION_OPTION = 'translatewp_version';
 	public const TRANSLATED_MARKS_OPTION = 'translatewp_translated_marks_backfilled';
+	public const LEXICON_PRIVATE_CACHE_PURGED_OPTION = 'translatewp_lexicon_private_cache_purged';
 
 	private const MIGRATIONS = [
 		'0.9.0-beta.1' => 'migrate_switcher_highlight_to_brand',
@@ -33,6 +34,11 @@ public static function maybe_run(): void {
 		$stored = (string) get_option( self::VERSION_OPTION, '' );
 
 		self::backfill_translated_marks();
+		if ( '' === $stored ) {
+			update_option( self::LEXICON_PRIVATE_CACHE_PURGED_OPTION, time(), true );
+		} elseif ( version_compare( $stored, TRANSLATEWP_VERSION, '<=' ) ) {
+			self::purge_lexicon_private_cache_once();
+		}
 
 		if ( '' !== $stored && version_compare( $stored, TRANSLATEWP_VERSION, '>=' ) ) {
 			return;
@@ -80,7 +86,19 @@ private static function migrate_1_0_0(): void {
 		( new IndexQueue() )->delete_unindexable_rows();
 	}
 
+	private static function purge_lexicon_private_cache_once(): void {
+		if ( get_option( self::LEXICON_PRIVATE_CACHE_PURGED_OPTION ) ) {
+			return;
+		}
+		// Mark before external cache hooks so a failing hook cannot repeat the purge on every init.
+		update_option( self::LEXICON_PRIVATE_CACHE_PURGED_OPTION, time(), true );
+		PageCachePurge::purge_all( 'lexicon_private' );
+	}
+
 	public static function seed_for_fresh_install(): void {
+		if ( '' === (string) get_option( self::VERSION_OPTION, '' ) ) {
+			update_option( self::LEXICON_PRIVATE_CACHE_PURGED_OPTION, time(), true );
+		}
 		update_option( self::VERSION_OPTION, TRANSLATEWP_VERSION );
 	}
 

Components/TranslationAiSettings.php

@@ -27,10 +27,9 @@ private static function allowed_preset( string $value, array $free, string $fall
 	/**
 	 * The translation settings sent with every job.
 	 *
-	 * @param string $language The target language the settings are for; empty for
-	 *                         the browser-bound copy that carries every term with its scope.
+	 * @param string $language The target language; empty includes every term when requested.
 	 */
-	public static function build( string $language = '' ): array {
+	public static function build( string $language = '', bool $include_lexicon = true ): array {
 		$translation_settings = array_merge(
 			[
 				'auto_translate'              => true,
@@ -69,7 +68,7 @@ public static function build( string $language = '' ): array {
 			'tone'                        => self::allowed_preset( (string) $style_settings['tone'], self::FREE_TONES, 'friendly' ),
 			'formality'                   => (int) $style_settings['formality'],
 			'creativity'                  => (int) $style_settings['creativity'],
-			'lexicon_terms'               => '' === $language ? Lexicon::get_all() : Lexicon::terms_for_language( $language ),
+			'lexicon_terms'               => $include_lexicon ? ( '' === $language ? Lexicon::get_all() : Lexicon::terms_for_language( $language ) ) : [],
 		];
 
 		return $settings + self::advanced_controls( $style_settings );

Entities/CPTs/Lexicon.php

@@ -45,8 +45,7 @@ public static function languages_of( int $post_id ): array {
 	/**
 	 * The terms the translator receives for one target language: every term
 	 * scoped to that language or to no language, reduced to the two fields the
-	 * translation service reads. The same reduction runs in the browser so the
-	 * two sides fingerprint the same settings.
+	 * translation service reads.
 	 *
 	 * @return array<int, array{term: string, description: string}>
 	 */
@@ -112,11 +111,14 @@ public function register(): void {
 					'all_items'          => __( 'Lexicon', 'translate' ),
 				],
 				'public'             => false,
+				'publicly_queryable' => false,
+				'exclude_from_search' => true,
 				'show_ui'            => false,
 				'show_in_menu'       => false,
-				'show_in_rest'       => true,
+				'show_in_rest'       => false,
 				'has_archive'        => false,
-				'rewrite'            => [ 'slug' => 'lexicon' ],
+				'rewrite'            => false,
+				'query_var'          => false,
 				'supports'           => [ 'title' ],
 				'menu_icon'          => 'dashicons-book-alt',
 				'taxonomies'         => [ self::CATEGORY_TAXONOMY ],
@@ -144,9 +146,10 @@ public function register(): void {
 				'show_admin_column' => false,
 				'show_tagcloud'     => false,
 				'show_in_nav_menus' => false,
-				'show_in_rest'      => true,
+				'show_in_rest'      => false,
 				'hierarchical'      => false,
 				'rewrite'           => false,
+				'query_var'         => false,
 			]
 		);
 	}

Entities/Scripts/Admin.php

@@ -3,6 +3,7 @@
 namespace TranslateWP\Entities\Scripts;
 
 use TranslateWP\Components\ProEligibility;
+use TranslateWP\Components\Access;
 use TranslateWP\Components\RemoteApi;
 use TranslateWP\Components\SiteConnection;
 use TranslateWP\Components\Sites;
@@ -46,7 +47,7 @@ public function context_data(): string {
                     'settings_scope'       => (object) \TranslateWP\Components\SettingsScope::subsite_scope(),
                 ],
                 'can'           => \TranslateWP\Entities\Scripts\TranslateWP::manager_flags()['can'],
-                'lexicon_terms' => Lexicon::get_all(),
+                'lexicon_terms' => Access::can( Access::LEXICON ) || Access::can( Access::EDIT ) ? Lexicon::get_all() : [],
             ],
             JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
         ) . ' );';

Entities/Scripts/TranslateWP.php

@@ -327,7 +327,7 @@ public function get_frontend_options(): array {
                 'includeAttributes' => ! (bool) $translation_settings['preserve_html_attributes'],
                 'excludedAreas'     => PageAreas::excluded( $translation_settings ),
             ],
-            'ai_settings'    => TranslationAiSettings::build(),
+            'ai_settings'    => TranslationAiSettings::build( '', false ),
         ];
     }
 }

Functionality/Endpoints/Admin.php

@@ -130,6 +130,14 @@ public function define_endpoints() {
         );
         $get_lexicon_terms->useMiddleware( $cors );
 
+        $get_lexicon_categories = new GetEndpoint(
+            $this->namespace,
+            'get-lexicon-categories',
+            [ $this, 'get_lexicon_categories' ],
+            [ $this, 'lexicon_or_edit_permissions_check' ]
+        );
+        $get_lexicon_categories->useMiddleware( $cors );
+
         $clear_cache = new PostEndpoint(
             $this->namespace,
             'clear-cache',
@@ -179,6 +187,7 @@ public function define_endpoints() {
             $update_lexicon_term,
             $delete_lexicon_term,
             $get_lexicon_terms,
+            $get_lexicon_categories,
             $clear_cache,
             $dashboard_metrics,
             $settings_revision,
@@ -839,6 +848,28 @@ static function ( $term ) {
         ];
     }
 
+    public function get_lexicon_categories( $request ) {
+        unset( $request );
+		$terms = get_terms(
+			[
+				'taxonomy'   => Lexicon::CATEGORY_TAXONOMY,
+				'hide_empty' => false,
+			]
+		);
+        if ( is_wp_error( $terms ) ) {
+            return $terms;
+        }
+
+        return array_map(
+			static fn( $term ): array => [
+				'id'   => (int) $term->term_id,
+				'name' => (string) $term->name,
+				'slug' => (string) $term->slug,
+            ],
+            $terms
+        );
+    }
+
 	private function is_admin_data_path_allowed( string $path ): bool {
 		return in_array( $path, self::ADMIN_DATA_PATHS, true );
 	}