[Glomberg]

https://app.doboard.com/1/task/58996

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 33.69%. Comparing base (0f98955) to head (ba27fb9).

Files with missing lines	Patch %	Lines
lib/Cleantalk/ApbctWP/Firewall/AntiFlood.php	71.42%	8 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##                dev     #910      +/-   ##
============================================
+ Coverage     33.39%   33.69%   +0.30%     
- Complexity     6983     6991       +8     
============================================
  Files           297      297              
  Lines         27314    27311       -3     
============================================
+ Hits           9121     9203      +82     
+ Misses        18193    18108      -85     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟡 Changes recommended

Fallback token validation, PHP compatibility, and database-load issues remain unresolved.

3 open issues

• Removing api_key declaration creates a PHP 8.2 dynamic property · New
• Fallback password token is not valid hexadecimal · New
• Per-block token rows amplify database load during floods · New

1 file not reviewed

• tests/ApbctWP/Firewall/TestAntiFlood.php: Excluded by your content exclusion settings

What changed in this PR

This PR replaces reusable AntiFlood pass cookies with short-lived, single-use tokens.

Changes:

• Adds IP-bound token storage and atomic consumption.
• Logs passed requests in the activity counter.
• Reduces the browser cookie lifetime to one minute.

File	Description
lib/​Cleantalk/​ApbctWP/​Firewall/​die_page_antiflood.html	Shortens pass-cookie expiration.
lib/​Cleantalk/​ApbctWP/​Firewall/​AntiFlood.php	Implements token issuance, consumption, and pass accounting.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-sensitive token lifecycle needs human validation because the changed AntiFlood tests were unavailable for review.

No open issues 🎉

3 resolved since last review

• Per-block token rows amplify database load during floods
• Fallback password token is not valid hexadecimal
• Removing api_key declaration creates a PHP 8.2 dynamic property

1 file not reviewed

• tests/ApbctWP/Firewall/TestAntiFlood.php: Excluded by your content exclusion settings

_{Review effort: Balanced}