@automattic/newspack-blocks 4.33.1 → 4.34.0-alpha.2

package/newspack-blocks.php

@@ -7,7 +7,7 @@
  * Author URI:      https://newspack.com/
  * Text Domain:     newspack-blocks
  * Domain Path:     /languages
- * Version:         4.33.1
+ * Version:         4.34.0-alpha.2
  *
  * @package         Newspack_Blocks
  */
@@ -15,7 +15,7 @@
 define( 'NEWSPACK_BLOCKS__PLUGIN_FILE', __FILE__ );
 define( 'NEWSPACK_BLOCKS__BLOCKS_DIRECTORY', 'dist/' );
 define( 'NEWSPACK_BLOCKS__PLUGIN_DIR', plugin_dir_path( NEWSPACK_BLOCKS__PLUGIN_FILE ) );
-define( 'NEWSPACK_BLOCKS__VERSION', '4.33.1' );
+define( 'NEWSPACK_BLOCKS__VERSION', '4.34.0-alpha.2' );
 
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks.php';
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks-api.php';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/newspack-blocks",
-	"version": "4.33.1",
+	"version": "4.34.0-alpha.2",
 	"author": "Automattic",
 	"description": "=== Newspack Blocks === Contributors: (this should be a list of wordpress.org userid's) Donate link: https://example.com/ Tags: comments, spam Requires at least: 4.5 Tested up to: 5.1.1 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html",
 	"repository": {
@@ -57,7 +57,7 @@
 	},
 	"devDependencies": {
 		"@types/lodash": "^4.17.23",
-		"newspack-components": "4.8.0",
+		"newspack-components": "4.8.1-alpha.1",
 		"newspack-scripts": "5.11.0"
 	},
 	"overrides": {

package/src/blocks/author-list/class-wp-rest-newspack-author-list-controller.php

@@ -173,6 +173,11 @@ class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_C
 		];
 		$options         = wp_parse_args( $options, $default_options );
 		$fields          = $options['fields'];
+
+		// Only the component's own author roles can be listed. A caller-chosen role outside them
+		// is dropped, and when nothing usable remains the user query is skipped below rather than
+		// run without a role filter, which would match every user on the site.
+		$options['author_roles'] = array_values( array_intersect( (array) $options['author_roles'], Newspack_Blocks\get_authors_roles_slugs() ) );
 		$current_page    = 1;
 
 		// Array to store all authors.
@@ -219,7 +224,7 @@ class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_C
 			}
 		}
 
-		if ( in_array( $options['author_type'], [ 'all', 'users' ], true ) ) {
+		if ( ! empty( $options['author_roles'] ) && in_array( $options['author_type'], [ 'all', 'users' ], true ) ) {
 			// Reset current page for new query.
 			$current_page         = 1;
 			$exclude_empty        = $options['exclude_empty'] ? true : false;

package/src/blocks/author-profile/class-wp-rest-newspack-authors-controller.php

@@ -65,6 +65,39 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		return array_values( array_diff( $fields, self::USER_MANAGEMENT_FIELDS ) );
 	}
 
+	/**
+	 * Most IDs one batched lookup resolves.
+	 *
+	 * A page never needs more than it has blocks, and an unbounded list would recreate the long
+	 * PHP request the batched lookup exists to avoid. The editor splits its batches to match.
+	 */
+	const MAX_BATCH_IDS = 100;
+
+	/**
+	 * Whether a WP user holds one of the roles this component treats as an author.
+	 *
+	 * The listing branch has always been narrowed to these roles. The by-id branches have to
+	 * agree with it, or an id becomes a way to read any user's profile fields.
+	 *
+	 * @param WP_User|false $user The user.
+	 * @return bool
+	 */
+	public static function is_author_role_user( $user ) {
+		return $user && ! empty( array_intersect( (array) $user->roles, \Newspack_Blocks\get_authors_roles_slugs() ) );
+	}
+
+	/**
+	 * Turn a comma-separated list (or array) of IDs into unique positive integers.
+	 *
+	 * @param string|array $value Raw request param.
+	 * @return int[] At most MAX_BATCH_IDS of them.
+	 */
+	public static function sanitize_id_list( $value ) {
+		$ids = is_array( $value ) ? $value : explode( ',', (string) $value );
+		$ids = array_filter( array_map( 'absint', $ids ) );
+		return array_slice( array_values( array_unique( $ids ) ), 0, self::MAX_BATCH_IDS );
+	}
+
 	/**
 	 * Registers the necessary REST API routes.
 	 *
@@ -104,6 +137,12 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 						'post_id'             => [
 							'sanitize_callback' => 'absint',
 						],
+						'author_ids'          => [
+							'sanitize_callback' => [ __CLASS__, 'sanitize_id_list' ],
+						],
+						'guest_author_ids'    => [
+							'sanitize_callback' => [ __CLASS__, 'sanitize_id_list' ],
+						],
 					],
 					'permission_callback' => function() {
 						return current_user_can( 'edit_posts' );
@@ -130,6 +169,14 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		$fields              = self::restrict_fields( $fields );
 		$include             = ! empty( $request->get_param( 'include' ) ) ? explode( ',', $request->get_param( 'include' ) ) : null; // Fetch authors by multiple IDs.
 		$post_id             = ! empty( $request->get_param( 'post_id' ) ) ? $request->get_param( 'post_id' ) : 0; // Fetch authors for a specific post (contextual mode).
+		$author_ids          = ! empty( $request->get_param( 'author_ids' ) ) ? $request->get_param( 'author_ids' ) : []; // Fetch several WP users by ID in one request.
+		$guest_author_ids    = ! empty( $request->get_param( 'guest_author_ids' ) ) ? $request->get_param( 'guest_author_ids' ) : []; // Fetch several guest authors by ID in one request.
+
+		// If a list of IDs is provided, resolve them all in one response. A list with no valid ID
+		// is still a list, and gets an empty response rather than the recent-authors listing.
+		if ( $request->has_param( 'author_ids' ) || $request->has_param( 'guest_author_ids' ) ) {
+			return $this->get_authors_by_ids( $author_ids, $guest_author_ids, $fields, $avatar_hide_default );
+		}
 
 		// If post_id is provided, get authors for that specific post.
 		if ( $post_id ) {
@@ -190,7 +237,7 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 			if ( 0 === $guest_author_total ) {
 				$user = get_user_by( 'id', $author_id ); // Get the WP user.
 
-				if ( $user ) {
+				if ( self::is_author_role_user( $user ) ) {
 					$users = [ $user ];
 				}
 			}
@@ -242,29 +289,9 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 			array_reduce(
 				! empty( $guest_authors ) ? $guest_authors : [],
 				function( $acc, $guest_author ) use ( $fields, $avatar_hide_default ) {
-					if ( $guest_author ) {
-						if ( class_exists( 'CoAuthors_Guest_Authors' ) ) {
-							$guest_author_data = [
-								'id'         => intval( $guest_author->ID ),
-								'registered' => $guest_author->post_date,
-								'is_guest'   => true,
-								'slug'       => $guest_author->post_name,
-							];
-
-							$guest_author = ( new CoAuthors_Guest_Authors() )->get_guest_author_by( 'id', $guest_author->ID );
-
-							if ( in_array( 'avatar', $fields, true ) && function_exists( 'coauthors_get_avatar' ) ) {
-								$avatar = coauthors_get_avatar( $guest_author, 256, $avatar_hide_default ? 'blank' : '' );
-
-								if ( \Newspack_Blocks\is_avatar_displayable( $avatar, $avatar_hide_default ) ) {
-									$guest_author_data['avatar'] = $avatar;
-								}
-							}
-
-							$guest_author_data = self::fill_guest_author_data( $guest_author_data, $guest_author, $fields );
-
-							$acc[] = $guest_author_data;
-						}
+					$guest_author_data = self::format_guest_author( $guest_author, $fields, $avatar_hide_default );
+					if ( $guest_author_data ) {
+						$acc[] = $guest_author_data;
 					}
 					return $acc;
 				},
@@ -273,24 +300,9 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 			array_reduce(
 				$users,
 				function( $acc, $user ) use ( $fields, $avatar_hide_default ) {
-					if ( $user ) {
-						$user_data = [
-							'id'         => intval( $user->data->ID ),
-							'registered' => $user->data->user_registered,
-							'is_guest'   => false,
-							'slug'       => $user->data->user_login,
-						];
-
-						if ( in_array( 'avatar', $fields, true ) ) {
-							$avatar = get_avatar( $user->data->ID, 256, $avatar_hide_default ? 'blank' : '' );
-
-							if ( \Newspack_Blocks\is_avatar_displayable( $avatar, $avatar_hide_default ) ) {
-								$user_data['avatar'] = $avatar;
-							}
-						}
-
-						$user_data = self::fill_user_data( $user_data, $user, $fields );
-						$acc[]     = $user_data;
+					$user_data = self::format_user( $user, $fields, $avatar_hide_default );
+					if ( $user_data ) {
+						$acc[] = $user_data;
 					}
 					return $acc;
 				},
@@ -312,6 +324,135 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		return rest_ensure_response( $response );
 	}
 
+	/**
+	 * Return the given users and guest authors in one response.
+	 *
+	 * Backs the editor's batched lookups: a page with many Author Profile blocks resolves every
+	 * author with a single request instead of one per block. Each ID is formatted the way the
+	 * single-ID path formats it, so a record matches what a block received on its own, including
+	 * the guest-to-user fallback: a guest ID means "not known to be a WP user", because blocks
+	 * saved before the `isGuestAuthor` attribute existed default to it for every author.
+	 *
+	 * @param int[] $author_ids          WP user IDs.
+	 * @param int[] $guest_author_ids    Guest author post IDs.
+	 * @param array $fields              Fields to include.
+	 * @param bool  $avatar_hide_default Whether to hide the default avatar.
+	 * @return WP_REST_Response
+	 */
+	public function get_authors_by_ids( $author_ids, $guest_author_ids, $fields, $avatar_hide_default ) {
+		$authors = [];
+
+		if ( $guest_author_ids ) {
+			$guest_authors = get_posts(
+				[
+					'post_type'      => 'guest-author',
+					'post__in'       => $guest_author_ids,
+					'posts_per_page' => count( $guest_author_ids ),
+					'orderby'        => 'post__in',
+				]
+			);
+			$found         = [];
+			foreach ( $guest_authors as $guest_author ) {
+				$found[]           = (int) $guest_author->ID;
+				$guest_author_data = self::format_guest_author( $guest_author, $fields, $avatar_hide_default );
+				if ( $guest_author_data ) {
+					$authors[] = $guest_author_data;
+				}
+			}
+			// Resolve the rest as WP users, the way the single-ID path and the front-end renderer do.
+			$author_ids = array_values( array_unique( array_merge( $author_ids, array_diff( $guest_author_ids, $found ) ) ) );
+		}
+
+		if ( $author_ids ) {
+			// Two queries for the whole list instead of two per user: get_user_by() reads the user
+			// row and its capabilities from the object cache once both are primed.
+			cache_users( $author_ids );
+		}
+
+		foreach ( $author_ids as $author_id ) {
+			$user = get_user_by( 'id', $author_id );
+			if ( ! self::is_author_role_user( $user ) ) {
+				continue;
+			}
+			$user_data = self::format_user( $user, $fields, $avatar_hide_default );
+			if ( $user_data ) {
+				$authors[] = $user_data;
+			}
+		}
+
+		$response = new WP_REST_Response( $authors );
+		$response->header( 'x-wp-total', count( $authors ) );
+
+		return rest_ensure_response( $response );
+	}
+
+	/**
+	 * Format a guest author post as an endpoint record.
+	 *
+	 * @param WP_Post|false $guest_author        Guest author post.
+	 * @param array         $fields              Fields to include.
+	 * @param bool          $avatar_hide_default Whether to hide the default avatar.
+	 * @return array|null Record, or null when there is nothing to format.
+	 */
+	public static function format_guest_author( $guest_author, $fields, $avatar_hide_default ) {
+		if ( ! $guest_author || ! class_exists( 'CoAuthors_Guest_Authors' ) ) {
+			return null;
+		}
+
+		$guest_author_data = [
+			'id'         => intval( $guest_author->ID ),
+			'registered' => $guest_author->post_date,
+			'is_guest'   => true,
+			'slug'       => $guest_author->post_name,
+		];
+
+		$guest_author = ( new CoAuthors_Guest_Authors() )->get_guest_author_by( 'id', $guest_author->ID );
+		if ( ! $guest_author ) {
+			return null;
+		}
+
+		if ( in_array( 'avatar', $fields, true ) && function_exists( 'coauthors_get_avatar' ) ) {
+			$avatar = coauthors_get_avatar( $guest_author, 256, $avatar_hide_default ? 'blank' : '' );
+
+			if ( \Newspack_Blocks\is_avatar_displayable( $avatar, $avatar_hide_default ) ) {
+				$guest_author_data['avatar'] = $avatar;
+			}
+		}
+
+		return self::fill_guest_author_data( $guest_author_data, $guest_author, $fields );
+	}
+
+	/**
+	 * Format a WP user as an endpoint record.
+	 *
+	 * @param WP_User|false $user                The user.
+	 * @param array         $fields              Fields to include.
+	 * @param bool          $avatar_hide_default Whether to hide the default avatar.
+	 * @return array|null Record, or null when there is nothing to format.
+	 */
+	public static function format_user( $user, $fields, $avatar_hide_default ) {
+		if ( ! $user ) {
+			return null;
+		}
+
+		$user_data = [
+			'id'         => intval( $user->data->ID ),
+			'registered' => $user->data->user_registered,
+			'is_guest'   => false,
+			'slug'       => $user->data->user_login,
+		];
+
+		if ( in_array( 'avatar', $fields, true ) ) {
+			$avatar = get_avatar( $user->data->ID, 256, $avatar_hide_default ? 'blank' : '' );
+
+			if ( \Newspack_Blocks\is_avatar_displayable( $avatar, $avatar_hide_default ) ) {
+				$user_data['avatar'] = $avatar;
+			}
+		}
+
+		return self::fill_user_data( $user_data, $user, $fields );
+	}
+
 	/**
 	 * Fill guest author data.
 	 *
@@ -392,7 +533,7 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 			$user_data['url'] = esc_url( get_author_posts_url( $user->data->ID ) );
 		}
 		if ( false === $fields || in_array( 'social', $fields, true ) ) {
-			$user_data['social'] = self::get_social( $user->data->ID );
+			$user_data['social'] = self::get_social( $user->data->ID, false );
 		}
 
 		if ( class_exists( '\Newspack\Authors_Custom_Fields' ) ) {
@@ -458,10 +599,11 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 	/**
 	 * Get social media URLs and SVGs, if available. Only standard WP users have this user meta.
 	 *
-	 * @param int $author_id Author ID.
+	 * @param int     $author_id       Author ID.
+	 * @param boolean $is_guest_author Whether the ID is a CAP guest author, whose website lives in post meta.
 	 * @return array Array of social links and SVGs.
 	 */
-	public static function get_social( $author_id ) {
+	public static function get_social( $author_id, $is_guest_author = true ) {
 		$social_profiles = [
 			'facebook',
 			'twitter',
@@ -479,9 +621,13 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 
 		return array_reduce(
 			$social_profiles,
-			function( $acc, $profile ) use ( $author_id ) {
+			function( $acc, $profile ) use ( $author_id, $is_guest_author ) {
 				$is_website = 'website' === $profile;
-				$handle     = $is_website ? get_post_meta( $author_id, 'cap-website', true ) : get_the_author_meta( $profile, $author_id );
+				if ( $is_website && ! $is_guest_author ) {
+					// A WP user has no post meta to read, and reading it costs a query per user.
+					return $acc;
+				}
+				$handle = $is_website ? get_post_meta( $author_id, 'cap-website', true ) : get_the_author_meta( $profile, $author_id );
 
 				if ( $handle ) {
 					$url             = 'twitter' === $profile ? esc_url( 'https://x.com/' . $handle ) : esc_url( $handle );
@@ -510,7 +656,9 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 	 */
 	protected function get_post_authors( $post_id, $fields, $avatar_hide_default ) {
 		$post = get_post( $post_id );
-		if ( ! $post ) {
+
+		// Who wrote an unpublished post is not the caller's to know unless they can read it.
+		if ( ! $post || ! current_user_can( 'read_post', $post->ID ) ) {
 			return rest_ensure_response( [] );
 		}
 

package/src/blocks/author-profile/edit.js

@@ -40,6 +40,11 @@ import { pencil, postAuthor, pullLeft, pullRight } from '@wordpress/icons';
 import { __, sprintf } from '@wordpress/i18n';
 import { addQueryArgs } from '@wordpress/url';
 
+/**
+ * Internal dependencies
+ */
+import { fetchAuthorById, fetchAuthorList } from '../../shared/js/author-fetch';
+
 /**
  * Register block bindings source for author data in the editor.
  * This enables core blocks to display author data via bindings.
@@ -274,7 +279,6 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 		isGuestAuthor,
 		isContextual,
 		layoutVersion,
-		showSocial,
 		showEmail,
 		textSize,
 		showAvatar,
@@ -398,22 +402,15 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 		setError( null );
 		setIsLoading( true );
 		try {
-			const params = {
-				author_id: authorId,
-				is_guest_author: isGuestAuthor ? 1 : 0,
+			// Shared with every other Author Profile block on the page, so a page of profiles
+			// costs one request instead of one per block.
+			const _author = await fetchAuthorById( {
+				authorId,
+				isGuestAuthor,
 				fields: 'id,name,bio,email,social,avatar,url',
-			};
-
-			if ( avatarHideDefault ) {
-				params.avatar_hide_default = 1;
-			}
-
-			const response = await apiFetch( {
-				path: addQueryArgs( '/newspack-blocks/v1/authors', params ),
+				avatarHideDefault,
 			} );
 
-			const _author = response.pop();
-
 			if ( ! _author ) {
 				throw sprintf(
 					/* translators: %s: error text for when no authors are found. */
@@ -476,21 +473,16 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 				fields.push( 'email' );
 			}
 			const results = await Promise.all(
-				bylineAuthorIds.map( id => {
-					const params = {
-						author_id: id,
-						is_guest_author: 0,
+				bylineAuthorIds.map( id =>
+					fetchAuthorById( {
+						authorId: id,
+						isGuestAuthor: false,
 						fields: fields.join( ',' ),
-					};
-					if ( avatarHideDefault ) {
-						params.avatar_hide_default = 1;
-					}
-					return apiFetch( {
-						path: addQueryArgs( '/newspack-blocks/v1/authors', params ),
-					} );
-				} )
+						avatarHideDefault,
+					} )
+				)
 			);
-			setContextualAuthors( results.flat().filter( Boolean ) );
+			setContextualAuthors( results.filter( Boolean ) );
 		} catch ( e ) {
 			setError( e.message || e || __( 'Error fetching byline authors.', 'newspack-blocks' ) );
 			setContextualAuthors( [] );
@@ -535,17 +527,6 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 		};
 	}, [ authorsToRender, previewAuthorIndex, layoutVersion, clientId ] );
 
-	// Combine social links and email, which are shown together.
-	const getSocialLinks = authorData => {
-		const socialLinks = ( showSocial && authorData?.social ) || {};
-		if ( showEmail && authorData?.email ) {
-			socialLinks.email = authorData.email;
-		} else {
-			delete socialLinks.email;
-		}
-		return socialLinks;
-	};
-
 	// Determine if we're in nested layout mode (publisher-controlled composition).
 	// In nested mode, hide field toggles since publishers control display by adding/removing blocks.
 	const isNestedLayout = layoutVersion === 2;
@@ -767,16 +748,7 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 								if ( authorId && ! error ) {
 									return [];
 								}
-								const response = await apiFetch( {
-									parse: false,
-									path: addQueryArgs( '/newspack-blocks/v1/authors', {
-										search,
-										offset,
-										fields: 'id,name',
-									} ),
-								} );
-								const total = parseInt( response.headers.get( 'x-wp-total' ) || 0, 10 );
-								const authors = await response.json();
+								const { authors, total } = await fetchAuthorList( { search, offset, fields: 'id,name' } );
 								if ( ! maxItemsToSuggest && ! search ) {
 									setMaxItemsToSuggest( total );
 								}
@@ -922,11 +894,7 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 				{ inspectorControls }
 				{ blockControls }
 				{ authorsToRender.map( authorData => (
-					<SingleAuthor
-						key={ authorData.id }
-						author={ { ...authorData, social: getSocialLinks( authorData ) } }
-						attributes={ attributes }
-					/>
+					<SingleAuthor key={ authorData.id } author={ authorData } attributes={ attributes } />
 				) ) }
 			</div>
 		);
@@ -938,7 +906,7 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 			<div { ...blockProps }>
 				{ inspectorControls }
 				{ blockControls }
-				<SingleAuthor author={ { ...author, social: getSocialLinks( author ) } } attributes={ attributes } />
+				<SingleAuthor author={ author } attributes={ attributes } />
 			</div>
 		);
 	}
@@ -972,17 +940,7 @@ const AuthorProfile = ( { attributes, setAttributes, context, clientId } ) => {
 								return [];
 							}
 
-							const response = await apiFetch( {
-								parse: false,
-								path: addQueryArgs( '/newspack-blocks/v1/authors', {
-									search,
-									offset,
-									fields: 'id,name',
-								} ),
-							} );
-
-							const total = parseInt( response.headers.get( 'x-wp-total' ) || 0, 10 );
-							const authors = await response.json();
+							const { authors, total } = await fetchAuthorList( { search, offset, fields: 'id,name' } );
 
 							// Set max items for "load more" functionality in suggestions list.
 							if ( ! maxItemsToSuggest && ! search ) {

package/src/blocks/author-profile/single-author.js

@@ -12,6 +12,11 @@ import { autop } from '@wordpress/autop';
  */
 import classnames from 'classnames';
 
+/**
+ * Internal dependencies
+ */
+import { getSocialLinks } from './social-links';
+
 // Show a link to the author's post archive page, if available.
 const MaybeLink = ( { author, children, showArchiveLink } ) =>
 	showArchiveLink && author && author.url ? (
@@ -25,18 +30,8 @@ const MaybeLink = ( { author, children, showArchiveLink } ) =>
 export const SingleAuthor = ( { author, attributes } ) => {
 	const { showBio, showSocial, showEmail, showArchiveLink, showAvatar, textSize, avatarAlignment, avatarBorderRadius, avatarSize } = attributes;
 
-	// Combine social links and email, which are shown together.
-	const socialLinks = ( showSocial && author && author.social ) || {};
-	if ( showEmail && author && author.email ) {
-		socialLinks.email = author.email;
-	} else {
-		delete socialLinks.email;
-	}
-	if ( attributes.shownewspack_phone_number && author && author.newspack_phone_number ) {
-		socialLinks.newspack_phone_number = author.newspack_phone_number;
-	} else {
-		delete socialLinks.newspack_phone_number;
-	}
+	// Combine social links and contact links, which are shown together.
+	const socialLinks = getSocialLinks( author, { showSocial, showEmail, showPhone: attributes.shownewspack_phone_number } );
 
 	const employment = [ attributes.shownewspack_role && author.newspack_role, attributes.shownewspack_employer && author.newspack_employer ]
 		.filter( Boolean )

package/src/blocks/author-profile/social-links.js

@@ -0,0 +1,25 @@
+/**
+ * Combine an author's social links with the contact links a block chooses to show.
+ *
+ * Returns a new object. Author records are shared between every block on the page that shows
+ * the same author, so a block must not write its own choices into the record it was given.
+ *
+ * @param {Object}  author             Author record from the authors endpoint.
+ * @param {Object}  options
+ * @param {boolean} options.showSocial Whether to include the social links.
+ * @param {boolean} options.showEmail  Whether to include the email link.
+ * @param {boolean} options.showPhone  Whether to include the phone number link.
+ * @return {Object} Links keyed by service.
+ */
+export function getSocialLinks( author, { showSocial, showEmail, showPhone } ) {
+	const links = { ...( ( showSocial && author?.social ) || {} ) };
+	delete links.email;
+	delete links.newspack_phone_number;
+	if ( showEmail && author?.email ) {
+		links.email = author.email;
+	}
+	if ( showPhone && author?.newspack_phone_number ) {
+		links.newspack_phone_number = author.newspack_phone_number;
+	}
+	return links;
+}

package/src/blocks/author-profile/social-links.test.js

@@ -0,0 +1,42 @@
+import { getSocialLinks } from './social-links';
+
+const author = () => ( {
+	social: { twitter: { url: 'https://x.com/a' } },
+	email: { url: 'mailto:a@example.test' },
+	newspack_phone_number: { url: 'tel:1' },
+} );
+
+describe( 'getSocialLinks', () => {
+	it( 'adds the email to the social links when it is shown', () => {
+		expect( getSocialLinks( author(), { showSocial: true, showEmail: true } ) ).toEqual( {
+			twitter: { url: 'https://x.com/a' },
+			email: { url: 'mailto:a@example.test' },
+		} );
+	} );
+
+	it( 'returns only the email when social links are hidden', () => {
+		expect( getSocialLinks( author(), { showSocial: false, showEmail: true } ) ).toEqual( { email: { url: 'mailto:a@example.test' } } );
+	} );
+
+	it( 'adds the phone number when it is shown', () => {
+		expect( getSocialLinks( author(), { showSocial: false, showEmail: false, showPhone: true } ) ).toEqual( {
+			newspack_phone_number: { url: 'tel:1' },
+		} );
+	} );
+
+	it( 'leaves the author record untouched', () => {
+		const record = author();
+
+		getSocialLinks( record, { showSocial: true, showEmail: true } );
+		expect( record.social ).toEqual( { twitter: { url: 'https://x.com/a' } } );
+
+		// A record shared between blocks may already carry a link another block added.
+		record.social.email = { url: 'mailto:other@example.test' };
+		expect( getSocialLinks( record, { showSocial: true, showEmail: false } ) ).toEqual( { twitter: { url: 'https://x.com/a' } } );
+		expect( record.social.email ).toEqual( { url: 'mailto:other@example.test' } );
+	} );
+
+	it( 'returns an empty object for a missing author', () => {
+		expect( getSocialLinks( undefined, { showSocial: true, showEmail: true } ) ).toEqual( {} );
+	} );
+} );

package/src/blocks/checkout-button/view.php

@@ -178,8 +178,10 @@ function render_callback( $attributes ) {
 		$hidden_fields .= $after_success_behavior ? '<input type="hidden" name="after_success_behavior" value="' . esc_attr( $after_success_behavior ) . '" />' : '';
 		$hidden_fields .= $after_success_button_label ? '<input type="hidden" name="after_success_button_label" value="' . esc_attr( $after_success_button_label ) . '" />' : '';
 		$hidden_fields .= $after_success_url ? '<input type="hidden" name="after_success_url" value="' . esc_attr( $after_success_url ) . '" />' : '';
-		// Vouched for here because this is the last point the destination is known to come
-		// from the block's own settings rather than from the request.
+		// Vouched for here because this is the last point the destination is known to
+		// come from the block's own settings — or, for a URL-triggered render, from a
+		// value already restricted to allowed hosts (see
+		// Modal_Checkout::build_url_triggered_button_attrs()).
 		$after_success_token = $after_success_url ? Modal_Checkout::get_after_success_token( $after_success_url ) : '';
 		$hidden_fields      .= $after_success_token ? '<input type="hidden" name="after_success_token" value="' . esc_attr( $after_success_token ) . '" />' : '';
 	}

package/src/blocks/homepage-articles/templates/article.php

@@ -142,24 +142,7 @@ call_user_func(
 				?>
 				<div class="newspack-post-subtitle newspack-post-subtitle--in-homepage-block">
 					<?php
-					$allowed_tags = array(
-						'b'      => true,
-						'strong' => true,
-						'i'      => true,
-						'em'     => true,
-						'mark'   => true,
-						'u'      => true,
-						'small'  => true,
-						'sub'    => true,
-						'sup'    => true,
-						'a'      => array(
-							'href'   => true,
-							'target' => true,
-							'rel'    => true,
-						),
-					);
-
-					echo wptexturize( wp_kses( $subtitle, $allowed_tags ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+					echo wptexturize( Newspack_Blocks::sanitize_post_subtitle( $subtitle ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
 					?>
 				</div>
 			<?php endif; ?>