Code review follow-ups: security, a11y, ops polish (1.47.0)

Security
- Atomic rate-limit helper (wp_cache_incr path, transient fallback) replaces
  the read-then-write race in review submissions.
- Public AJAX endpoints (rtg_get_tires, rtg_get_filter_options,
  rtg_track_click, rtg_track_search) are now rate limited per fingerprint
  in their own buckets. Analytics drops silently when throttled so user
  typing isn't penalized; reviews keep the tight 3/5min ceiling.
- submit_guest_tire_rating trims guest_name before the empty check so
  whitespace-only names are rejected.
- roamer_assign / roamer_hide / roamer_restore now validate every ID
  against RTG_Database::validate_tire_id() and cap the batch at 50.

UX / a11y
- Cards render immediately; ratings swap in on XHR resolution instead of
  blocking the first paint.
- Server pagination shows a dimmed, input-blocking overlay only after
  500ms so fast responses don't flash.
- Mobile filter drawer moves keyboard focus to the first control on open.
- Switch-slider toggles replace inline onclick= with data-toggle-target +
  a delegated listener in rivian-tires.js.

Ops
- Admin gets an HTML email when cron Roamer sync fails (wp_error / non-200
  / bad JSON), throttled to once per 12h per reason. Manual admin runs
  don't email (errors already surface in the UI). Honors the existing
  roamer_notify_enabled setting.

Code health
- RTG_Ajax::ALLOWED_SORTS centralizes the sort whitelist.
- Admin dashboard "missing links/images" strings now go through _n().
- Removed stale "AI" comment + production console.time in search.js.
- New PHPUnit test covers rate-limit overflow behavior.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: RivianTrackr

CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to the Rivian Tire Guide plugin will be documented in this f
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.47.0] - 2026-04-20
+
+### Security
+- **Rate limiting hardened end-to-end.** Replaced the read-then-write
+  transient pattern with an atomic `wp_cache_add` / `wp_cache_incr` path
+  when a persistent object cache is available, falling back to transients
+  otherwise. Rate-limit counters no longer drift under concurrent writes
+  when Redis/Memcached is present.
+- **Public AJAX endpoints now rate limited.** `rtg_get_tires`,
+  `rtg_get_filter_options`, `rtg_track_click`, and `rtg_track_search`
+  previously relied only on a nonce that is exposed in page source, so a
+  scraper could harvest it and hammer the endpoint. Reads now cap at 120
+  req/min per fingerprint; analytics caps at 240 req/min and drops silently
+  when throttled so user typing isn't penalized. Reviews keep the existing
+  tighter 3-per-5-minute limit in its own bucket so normal browsing can't
+  starve review submissions or vice versa.
+- **Guest name validation now trims first.** `submit_guest_tire_rating`
+  rejected `""` but accepted `"   "` — whitespace-only submissions are now
+  rejected with the same error.
+- **Roamer assign/hide/restore batches now validate each tire ID** against
+  the canonical regex and cap the batch at 50 entries. A malformed JSON
+  payload can no longer slip a bad ID into `update_tire()`.
+
+### Added
+- **Admin email on Roamer sync failure.** When a scheduled cron sync can't
+  reach the feed (wp_error, non-200, or invalid JSON), the admin gets an
+  HTML email with the failure reason and a link to the Roamer Sync page.
+  Throttled to one email per reason per 12h so an extended outage doesn't
+  flood the inbox. Manual admin runs don't email (errors already show in
+  the UI). Honors the existing `roamer_notify_enabled` setting.
+- **Slow-response loading state for server-side pagination.** `#tireCards`
+  gets a dimmed, input-blocking overlay after 500ms of fetch latency so
+  fast responses don't flash a spinner but slow ones give feedback.
+- **Rate-limit concurrency test.** New PHPUnit test issues max + 2 rapid
+  guest submissions and asserts the overflow is blocked.
+
+### Changed
+- **Ratings no longer block card render.** `loadTireRatings` now runs in
+  parallel with `renderCards`, and rating blocks are swapped in via
+  `updateRatingDisplay` once the batch response arrives. Saves ~200ms of
+  perceived latency on the first paint for each page.
+- **Switch-slider toggles no longer use inline `onclick`.** The 3PMS/OEM
+  filter pills now use `data-toggle-target` + a delegated listener wired
+  up in `rivian-tires.js`, which plays nicer with strict CSP headers.
+- **Mobile filter drawer manages keyboard focus on open.** The first
+  focusable control inside `#mobileFilterContent` receives focus when the
+  drawer opens, matching the WCAG 2.1 focus-management pattern used by
+  the other modals/drawers.
+- **Admin dashboard widget strings are now `_n()`-translatable.** "Missing
+  links / missing images" copy goes through `_n()` + `__()` so translators
+  can pluralize properly.
+- **Sort whitelist centralized.** `RTG_Ajax::ALLOWED_SORTS` is the single
+  source of truth for the sort keys accepted by `get_tires()`.
+
+### Removed
+- **Stale AI references in frontend code.** `search.js` no longer mentions
+  the removed "AI" button in its module docstring; the leftover
+  `console.time('Building search index')` production log is gone.
+
 ## [1.46.0] - 2026-04-15
 
 ### Removed

frontend/css/rivian-tires.css

@@ -2874,6 +2874,17 @@ a.rtg-user-review-tire-link:hover {
   }
 }
 
+/* Server-pagination slow-response indicator.
+   Applied to #tireCards after a 500ms delay so fast responses don't flash. */
+.rtg-cards-loading {
+  opacity: 0.55;
+  pointer-events: none;
+  transition: opacity 0.2s ease;
+}
+@media (prefers-reduced-motion: reduce) {
+  .rtg-cards-loading { transition: none; }
+}
+
 /* === Accessibility: Focus Styles === */
 .info-tooltip-trigger:focus-visible {
   outline: 2px solid var(--rtg-accent);

frontend/css/rivian-tires.min.css

@@ -9,7 +9,7 @@ import { rtgIcon, safeString, getDOMElement, debounce, updateSliderBackground, s
 import { VALIDATION_PATTERNS, NUMERIC_BOUNDS, ALLOWED_SORT_OPTIONS, sanitizeInput, validateNumeric } from './validation.js';
 import { RTG_ANALYTICS } from './analytics.js';
 import { renderCards, preloadNextPageImages } from './cards.js';
-import { loadTireRatings } from './ratings.js';
+import { loadTireRatings, updateRatingDisplay } from './ratings.js';
 import { isPreciseMatch } from './search.js';
 import { isServerSide, serverSideFilterAndRender } from './server.js';
 
@@ -234,27 +234,35 @@ function render() {
 
   const tireIds = visible.map(row => row[0]).filter(Boolean);
 
-  loadTireRatings(tireIds).then(() => {
-    renderCards(visible);
-    renderPaginationControls(state.filteredRows);
-
-    const noResults = getDOMElement("noResults");
-    const tireCards = getDOMElement("tireCards");
-    if (state.filteredRows.length === 0) {
-      renderSmartNoResults();
-      noResults.style.display = "block";
-      tireCards.style.display = "none";
-    } else {
-      noResults.style.display = "none";
-      tireCards.style.display = "grid";
-    }
+  // Kick off ratings fetch in parallel — don't block the card render on it.
+  // Cards render immediately with a "No reviews" placeholder, and we swap in
+  // the real rating display once the batch response arrives. Sort-by-rating
+  // paths load ratings earlier in filterAndRender(), so they're already warm.
+  const ratingsPromise = loadTireRatings(tireIds);
+
+  renderCards(visible);
+  renderPaginationControls(state.filteredRows);
+
+  const noResults = getDOMElement("noResults");
+  const tireCards = getDOMElement("tireCards");
+  if (state.filteredRows.length === 0) {
+    renderSmartNoResults();
+    noResults.style.display = "block";
+    tireCards.style.display = "none";
+  } else {
+    noResults.style.display = "none";
+    tireCards.style.display = "grid";
+  }
 
-    if ('requestIdleCallback' in window) {
-      requestIdleCallback(() => preloadNextPageImages());
-    } else {
-      setTimeout(preloadNextPageImages, 100);
-    }
+  ratingsPromise.then(() => {
+    tireIds.forEach(id => updateRatingDisplay(id));
   });
+
+  if ('requestIdleCallback' in window) {
+    requestIdleCallback(() => preloadNextPageImages());
+  } else {
+    setTimeout(preloadNextPageImages, 100);
+  }
 }
 
 // Delegated once at module load: every click inside #paginationControls

frontend/js/modules/filters.js

@@ -4,8 +4,7 @@
  * Smart search — index building, fuzzy matching, and button-based search.
  *
  * The user types a query and explicitly clicks the "Search" button (or
- * presses Enter) to filter locally, or clicks the "AI" button to get
- * AI-powered recommendations.
+ * presses Enter) to filter the local tire list.
  */
 
 import { state } from './state.js';
@@ -23,8 +22,6 @@ let searchIndex = {
 };
 
 export function buildSearchIndex() {
-  console.time('Building search index');
-
   Object.values(searchIndex).forEach(index => index.clear());
 
   state.allRows.forEach((row, rowIndex) => {

frontend/js/modules/search.js

@@ -51,7 +51,19 @@ export function fetchTiresFromServer(page) {
   body.append('sort', sortMap[sortVal] || sortVal);
 
   const tireCountEl = getDOMElement("tireCount");
-  if (tireCountEl) tireCountEl.textContent = 'Loading...';
+  const tireCardsEl = getDOMElement("tireCards");
+
+  // Only surface a loading state if the request is genuinely slow (>500ms).
+  // Fast responses shouldn't flash a spinner/overlay.
+  const loadingTimer = setTimeout(() => {
+    if (tireCountEl) tireCountEl.textContent = 'Loading...';
+    if (tireCardsEl) tireCardsEl.classList.add('rtg-cards-loading');
+  }, 500);
+
+  const clearLoadingState = () => {
+    clearTimeout(loadingTimer);
+    if (tireCardsEl) tireCardsEl.classList.remove('rtg-cards-loading');
+  };
 
   return fetch(rtgData.settings.ajaxurl, {
     method: 'POST',
@@ -60,6 +72,7 @@ export function fetchTiresFromServer(page) {
   })
   .then(res => res.json())
   .then(json => {
+    clearLoadingState();
     if (!json.success) {
       console.error('Server tire fetch failed:', json);
       return;
@@ -148,6 +161,7 @@ export function fetchTiresFromServer(page) {
     loadTireRatings(tireIds);
   })
   .catch(err => {
+    clearLoadingState();
     if (err.name !== 'AbortError') console.error('Fetch error:', err);
   });
 }

frontend/js/modules/server.js

@@ -420,9 +420,28 @@ document.addEventListener("DOMContentLoaded", () => {
       const badge = toggleBtn.querySelector('.mobile-filter-badge');
       const badgeHTML = badge ? ` <span class="mobile-filter-badge">${badge.textContent}</span>` : '';
       toggleBtn.innerHTML = `<i class="fa-solid fa-sliders" aria-hidden="true"></i>&nbsp; ${isOpen ? "Hide" : "Show"} Filters${badgeHTML}`;
+
+      // Move keyboard focus into the drawer on open (WCAG 2.1 focus mgmt).
+      if (isOpen) {
+        const firstFocusable = filterContent.querySelector(
+          'select, input:not([type="hidden"]), button, [tabindex]:not([tabindex="-1"])'
+        );
+        if (firstFocusable && typeof firstFocusable.focus === 'function') {
+          firstFocusable.focus({ preventScroll: true });
+        }
+      }
     });
   }
 
+  // Wire switch-slider proxy clicks (keyboard + pointer) to their checkbox.
+  // Replaces legacy inline onclick= handlers for accessibility.
+  document.querySelectorAll('.switch-slider[data-toggle-target]').forEach(slider => {
+    const targetId = slider.dataset.toggleTarget;
+    const target = targetId ? document.getElementById(targetId) : null;
+    if (!target) return;
+    slider.addEventListener('click', () => target.click());
+  });
+
   const trigger = getDOMElement("wheelDrawerTrigger");
   const drawer = getDOMElement("wheelDrawer");
   const wheelCallout = getDOMElement("wheelDrawerContainer");

frontend/js/rivian-tires.js

@@ -82,7 +82,7 @@
             </div>
           </span>
           <input type="checkbox" id="filter3pms" aria-label="3PMS Rated" />
-          <span class="switch-slider" onclick="document.getElementById('filter3pms').click()"></span>
+          <span class="switch-slider" data-toggle-target="filter3pms"></span>
         </div>
         <div class="switch-label">
           <span class="switch-text">
@@ -94,7 +94,7 @@
             </div>
           </span>
           <input type="checkbox" id="filterOEM" aria-label="OEM"/>
-          <span class="switch-slider" onclick="document.getElementById('filterOEM').click()"></span>
+          <span class="switch-slider" data-toggle-target="filterOEM"></span>
         </div>
       </div>
     </div>

frontend/js/rivian-tires.min.js

@@ -126,10 +126,18 @@ public function render_dashboard_widget() {
             echo '<p style="margin:4px 0;color:#666;">';
             $notices = array();
             if ( $missing_links > 0 ) {
-                $notices[] = sprintf( '%d missing links', $missing_links );
+                $notices[] = sprintf(
+                    /* translators: %d is the number of tires missing affiliate links. */
+                    _n( '%d missing link', '%d missing links', $missing_links, 'rivian-tire-guide' ),
+                    $missing_links
+                );
             }
             if ( $missing_images > 0 ) {
-                $notices[] = sprintf( '%d missing images', $missing_images );
+                $notices[] = sprintf(
+                    /* translators: %d is the number of tires missing images. */
+                    _n( '%d missing image', '%d missing images', $missing_images, 'rivian-tire-guide' ),
+                    $missing_images
+                );
             }
             echo esc_html( implode( ' · ', $notices ) );
             echo '</p>';