Enrich Fluent normalized submission data

[danieliser]

Summary

• extend Core's provider-neutral normalized PHP submission envelope with native_entry_id and server-observed fields
• enrich Fluent Forms' existing before_submission_confirmation dispatch with its authoritative entry receipt, submitted values, and normalized source URL
• keep the one existing dispatch and existing phase policy; no provider-specific feature hook, frontend request, or second success event
• prevent submitted fields, raw fields, and native admin identity from being localized into non-AJAX frontend replay data
• document the server/frontend privacy boundary and regression-test success, deduplication identity, source resolution, filtering, and phase behavior

Why

The shared Pro forms platform can only associate and project a successful Fluent Forms submission when Core's canonical event carries the native entry identity and the values observed by Fluent on the server. The callback already receives all of that data, but previously discarded everything except the form and submission IDs. Lead Magnets and future form-aware consumers would otherwise need their own Fluent hook, splitting success semantics and risking duplicate claims.

This change enriches the existing normalized dispatch instead. submission_id remains the provider-native receipt used by Core's existing cross-runtime deduplication contract. native_entry_id exposes that same receipt explicitly to server-side capability consumers, while fields exposes the provider-confirmed submitted values.

Because Core's frontend replay previously forwarded unknown server keys, adding fields without another guard would expose submitted PII in localized page data after non-AJAX submissions. The replay boundary now removes fields, raw_fields, and native_entry_id; the established browser-safe submissionId remains available.

Contract available to consumers

On pum_integrated_form_submission and pum_integrated_form_submission_actions, a successful Fluent callback now provides:

[
	'form_provider'   => 'fluentforms',
	'form_id'         => $form_id,
	'submission_id'   => $entry_id,
	'native_entry_id' => $entry_id,
	'fields'          => $form_data,
	'source_post_id'  => $resolved_post_id,
	'source_url'      => $normalized_referrer,
	'phases'          => $resolved_phase_policy,
]

Invalid filters cannot replace authoritative native entry identity or fields with malformed values. Submitted fields and native entry identity are server-only and are not included in PUM_Integrations::pum_vars().

Validation

• focused PHPUnit: 35 tests, 113 assertions
• full PHPUnit: 1,200 tests, 2,951 assertions, 20 existing skips
• focused PHPCS: clean
• PHP syntax checks: clean
• Markdown lint: clean

Stacked after #1365.

Supports PopupMaker/Pro#152.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• develop

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cc35738f-46be-43c1-8fc8-a8c0113a1828

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}