Licensing and Update API Improvements

[jakejackson1]

Description

Backports the Licensing and Update API work to the 6.16.0 hot-patch line so Gravity PDF works fully against the new api.gravitypdf.com server. The API URL was already switched, but update checks and license activation still used the legacy edd_action flow the new server no longer matches. This branch migrates the updater and license handling, adds GPDF_LICENSE_KEY support, makes the API traffic Multisite-safe, and redacts secrets from the debug log.

Squashed into a single commit on top of hot-patch-6.16.0.

What's included

Plugin updater

• Replace EDD_SL_Plugin_Updater with the rewritten, self-contained updater (get_version API, standardize_api_response, gpdf_sl_* cache keys, Multisite changelog / update-notice support)
• Bootstrap: explicit init(), wp_override on force-check, expose the updater via Helper_Data, log the decoded JSON API response
• 6.16.0 upgrade routine purges the legacy edd_sl_* update cache and the 6.15.0 failed-request backoff option

License settings + GPDF_LICENSE_KEY constant

• Move activation / deactivation / delete into the add-on framework (Helper_Abstract_Addon) + bulk license verification
• Define a license via the GPDF_LICENSE_KEY PHP constant (auto-activation; settings field locked read-only when set)
• Reworked License settings page + AJAX deactivation (Model_Settings, Controller_Settings, licence-info view, setupLicenseDeactivation.js)
• Access Pass keys shared across sibling add-ons on activation and deactivation
• Clear cached licensing data on uninstall (incl. the network-shared gpdf_sl_net_* cache)

Multisite: restrict API checks to the primary site

• On a network-activated Multisite, WP-Cron runs per-site, so every subsite was independently scheduling its own weekly bulk license check and plugin update check — one API call per subsite (worst case: a network-wide GPDF_LICENSE_KEY makes every subsite hit the API with the same key)
• Helper_Misc::is_secondary_network_site() reads the active_sitewide_plugins network option, so it's safe in cron / front-end where is_plugin_active_for_network() isn't loaded
• Gate the bulk license check and the update version check to the primary site; subsites read the network-wide update_plugins transient the primary site populates

Log redaction

• Redact_Processor (Monolog) masks license keys, signed update / package URLs, tokens, cookies and nonces in the debug log — key-based (recursing into context arrays / objects) plus pattern-scrubbing of message bodies and string leaves, with CRLF / control-char neutralisation to prevent log injection

Post-review hardening (from an expert review of the initial implementation)

• Prevent a Multisite network-update-check request storm, with a schedule floor to avoid a tight reschedule loop
• Guard the updater against non-object / scalar / corrupted-cache API payloads (PHP 8 fatal-safety on plugins_api and cached data)
• Redact string leaves and raw response bodies in log context; add set-cookie to the deny set
• Sync the cleared license into the in-memory copy when the key is emptied (status / message no longer go stale within the request)
• Correct expired-license date handling, add-on public-action guards, and docblock / version drift

Scope notes

• @since markers and the upgrade-routine version gate are set to 6.16.0.
• Deliberately excluded (separate epics, not needed here): the broader uninstaller-interface refactor, log rotation, and PSR-Log v1/2/3 groundwork.
• setupLicenseDeactivation.js is a source change — the built asset needs regenerating at release (yarn build).
• Version constant / changelog reshuffle for 6.16.0 is not part of this PR.

Testing

Automated (PHPUnit, wp-env)

• Single-site: 1132 tests, 3567 assertions — 0 failures / 0 errors (29 intentional skips)
• Multisite: 1132 tests, 3639 assertions — 0 failures / 0 errors (2 intentional skips)
• PHPCS: clean on all changed files

Live / manual — run against production api.gravitypdf.com on a subdirectory Multisite (5 sites, GF 2.10.5), with GF logging on to verify redaction:

• License activation via the settings field — activates live; status valid ✓
• Access Pass sibling sharing — activating one add-on auto-activates its pass sibling; an unrelated add-on is left untouched ✓
• Update check — all four plugins resolve to their correct current versions (no false update, no missing entries, no fatal) ✓
• Invalid key — clear error surfaced; other add-ons unaffected ✓
• Empty-key clear — wipes key / status / message in both the DB and the in-memory copy ✓
• Deactivation — one deactivate clears both Access Pass siblings; DB cleared ✓
• Log redaction — license key, checksum and nonce all [redacted]; the raw key never appears in plaintext across the full activate → deactivate lifecycle ✓
• GPDF_LICENSE_KEY constant — auto-activates covered add-ons, fields read-only, correct "not valid for this product" on an uncovered add-on ✓
• Multisite gating — secondary subsite front-end returns HTTP 200 (no is_plugin_active_for_network fatal) and cron runs clean; is_secondary_network_site skips secondaries / runs on the primary; License tab hidden on secondary sites ✓
• Uninstaller — removes all options across every site, the network gpdf_sl_net_* cache and the PDF folder structure; deactivation clears all scheduled gfpdf_* cron events ✓

Checklist

• I've tested the code.
• My code is easy to read, follow, and understand
• My code has proper inline documentation / docblocks.

🤖 Generated with Claude Code