feat(content-gate): improve usability of the user Access Control report

[dkoo]

All Submissions:

• Have you followed the Newspack Contributing guidelines?
• Does your code follow the WordPress coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

The Access Control report on a user's profile told support whether a reader passes each gate, but not which record grants it. Finding the subscription or order meant a separate trip through WooCommerce. This is especially difficult when the user is granted access through a gifted or group subscription: searching the Subscriptions list page for a gift recipient or group member's name or email address fails to find their subscriptions, as the search only matches subscriptions by owner, not giftee or group member.

The report now links gate titles, product names, and institution names to their admin screens, and for passing "Active subscription" and "One-time purchase" rules lists the granting subscriptions or orders as #id links to their edit screens.

The rule evaluators are unchanged in behavior: has_active_subscription() now delegates to a shared subscription-listing method, and the one-time-purchase order scan reads newest-first in pages and stops at the first match, so the front-end path does no more work than before.

The report's profile hooks run at priority 9 so the section appears above other profile sections from this plugin and third parties. Anecdotal feedback from publishers suggests that they're looking at this info pretty frequently, so it should live relatively high-up in the user profile page.

Before

After

Closes NPPD-2243.

How to test the changes in this Pull Request:

1. On a site with NEWSPACK_CONTENT_GATES defined, publish a content gate with custom access rules for a subscription product, a one-time product, and an institution.
2. Open the profile of a reader with an active subscription to the required subscription product. Expect ✓ and a linked subscription ID after the rule value.
3. Click the #id. Expect the subscription edit screen.
4. Open a reader who is only a member of a group subscription for that product. Expect their group subscription to be listed.
5. Open a reader who owns no subscriptions, but has accepted a subscription gifted by another user. Expect their gifted subscription to be listed.
6. Open a reader with a paid order for the one-time product inside the rule's duration. Expect the linked order ID to be listed; refunded or expired orders are not listed.
7. Open a reader who owns nothing. Expect ✗ with no #id list.
8. Click a product name and the gate title. Expect the product editor and the gate's Access Control screen.
9. Trash the institution. Expect its name to be shown without a link.
10. Save an email-domain rule containing HTML markup such as <b>. Expect the profile to show it as literal text.

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully run tests with your changes locally?

[Copilot]

🟡 Changes recommended

A newly added test helper updates subscription meta without saving, which can make tests pass while diverging from real WooCommerce persistence behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR enhances the newspack-plugin Content Gate “Access Control” section shown on WordPress user profile screens by adding links to the relevant admin screens (gate editor, products, institutions) and by listing/linking the specific subscription(s) or order(s) that grant access for “Active subscription” and “One-time purchase” rules.

Changes:

• Update the user profile Access Control report UI to include linked gate/product/institution titles and (when applicable) linked #<id> granting subscriptions/orders.
• Add request-scoped, memoized helpers to enumerate granting subscription IDs and qualifying paid order IDs (newest-first, bounded/capped).
• Expand unit tests and WooCommerce mocks to cover granting-entity listing/link behavior and output escaping.

File summaries

File	Description
plugins/newspack-plugin/includes/content-gate/class-user-gate-access.php	Renders the updated Access Control report and adds helper logic for formatting linked rule values and listing granting entities.
plugins/newspack-plugin/includes/content-gate/class-access-rules.php	Refactors subscription checks to share an ID-listing path and introduces paged paid-order listing for one-time purchase attribution.
plugins/newspack-plugin/tests/mocks/wc-mocks.php	Extends the WC order mock with get_edit_order_url() to support linking in tests.
plugins/newspack-plugin/tests/unit-tests/content-gate/class-user-gate-access.php	Adds/updates unit tests validating granting-record links, filtering, caps, and HTML escaping.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dkoo]

@adekbadek requesting a human review mainly to ensure that the changes here don't have any side effects that could spiral beyond the user profile page context.

[thomasguillot]

Design looks good to me. I ran it locally against a reader whose access comes from a group subscription, and having the granting #id right there in the report is exactly the shortcut that was missing.