review-code

Review the specified code or recent changes for quality, security, and standards compliance.

Review Checklist

1. WordPress Coding Standards (WPCS)

Check PHP code for:

• [ ] Proper indentation (tabs, not spaces)
• [ ] Yoda conditions (if ( 'value' === $var ))
• [ ] Space inside parentheses (function( $param ))
• [ ] Proper docblocks for functions and classes
• [ ] No trailing whitespace
• [ ] File header comments with @package

2. Security Review

Check for vulnerabilities:

• [ ] Input Sanitization: All $_GET, $_POST, $_REQUEST sanitized
  • sanitize_text_field(), absint(), sanitize_email(), etc.
  • wp_unslash() before sanitization
• [ ] Output Escaping: All output escaped
  • esc_html(), esc_attr(), esc_url(), wp_kses_post()
• [ ] Nonce Verification: Forms and AJAX have nonce checks
  • wp_verify_nonce() or check_ajax_referer()
• [ ] Capability Checks: current_user_can() for privileged operations
• [ ] SQL Safety: Use $wpdb->prepare() for queries
• [ ] File Operations: No direct file inclusion from user input

3. Saman SEO Patterns

Check adherence to project patterns:

• [ ] Namespace: Uses Saman\SEO namespace hierarchy
• [ ] Service Pattern: New features use service classes with boot() method
• [ ] Filter Hooks: Extensibility points use saman_seo_ prefix
• [ ] Options: Use SAMAN_SEO_ prefix for options
• [ ] Meta Keys: Use _SAMAN_SEO_ prefix for post meta
• [ ] Text Domain: All strings use 'saman-seo' text domain
• [ ] Helper Usage: Uses \Saman\SEO\Helpers\ functions where appropriate
• [ ] Routing: Services must NOT call add_submenu_page() or add_menu_page() — only Admin_V2 registers pages. Check for duplicate slug registrations that would break the React SPA.

4. JavaScript/React Standards

For src-v2/ files:

• [ ] Uses @wordpress/element for React
• [ ] Uses @wordpress/i18n for translations (__(), _n())
• [ ] Uses @wordpress/api-fetch for API calls
• [ ] Proper component structure with hooks
• [ ] No console.log in production code
• [ ] Error handling for async operations

5. Performance

• [ ] No unnecessary database queries in loops
• [ ] Proper use of transients/caching for expensive operations
• [ ] Lazy loading where appropriate
• [ ] No blocking operations on frontend

6. Documentation

• [ ] Functions have proper PHPDoc
• [ ] Complex logic has inline comments
• [ ] New filters documented in FILTERS.md
• [ ] New CLI commands documented in WP_CLI.md
• [ ] Public functions documented in TEMPLATE_TAGS.md

Review Process

1. Read the changes - Understand what was modified
2. Check each file against the checklist above
3. Test mentally - Consider edge cases
4. Security scan - Look for common vulnerabilities
5. Summarize findings with specific line references

Common Issues to Flag

Security Issues (Critical)

// BAD: Unsanitized input
$title = $_POST['title'];

// GOOD: Sanitized input
$title = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';

Escaping Issues

// BAD: Unescaped output
echo $user_data;

// GOOD: Escaped output
echo esc_html( $user_data );

SQL Injection Risk

// BAD: Direct variable in query
$wpdb->query( "SELECT * FROM table WHERE id = $id" );

// GOOD: Prepared statement
$wpdb->query( $wpdb->prepare( "SELECT * FROM table WHERE id = %d", $id ) );

Missing Capability Check

// BAD: No permission check
function delete_item( $id ) {
    // Delete directly
}

// GOOD: With permission check
function delete_item( $id ) {
    if ( ! current_user_can( 'manage_options' ) ) {
        return new WP_Error( 'forbidden', 'Access denied' );
    }
    // Delete
}

Output Format

Provide review in this format:

## Code Review Summary

**Files Reviewed:** [list files]
**Overall Assessment:** [PASS/NEEDS CHANGES/CRITICAL ISSUES]

### Issues Found

#### Critical (Must Fix)
- [file:line] Description of security/critical issue

#### Important (Should Fix)
- [file:line] Description of standards violation

#### Minor (Nice to Have)
- [file:line] Description of style/preference issue

### Positive Notes
- What was done well

### Recommendations
- Suggested improvements

Arguments

$ARGUMENTS - File paths or "recent" to review git changes