v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

assets/js/documentation.js

@@ -3,23 +3,22 @@
  * Peptide Starter Theme
  *
  * Handles:
- * - Auto-generates ToC from h2 headings in the documentation body
- * - Scroll spy highlights the active section in the sidebar
- * - Smooth scrolling on ToC link click
+ * - Auto-generates ToC from h2 headings
+ * - Slugifies heading IDs from the heading text (with collision counter)
+ *   so deep links survive edits that change the author's order
+ * - IntersectionObserver scroll spy highlights the active section
+ * - Smooth scroll with header offset on ToC click
  * - Collapses sidebar to dropdown on mobile
  *
  * @see page-documentation.php — renders the two-column layout
- * @see style.css — .ps-docs-* classes
- *
- * Conditionally enqueued only on pages using the Documentation template.
  */
 
-(function() {
+(function () {
 	'use strict';
 
-	const docsBody   = document.getElementById('ps-docs-body');
-	const tocList    = document.getElementById('ps-docs-toc-list');
-	const sidebar    = document.querySelector('.ps-docs-sidebar');
+	const docsBody = document.getElementById('ps-docs-body');
+	const tocList  = document.getElementById('ps-docs-toc-list');
+	const sidebar  = document.querySelector('.ps-docs-sidebar');
 
 	if (!docsBody || !tocList) {
 		return;
@@ -28,32 +27,51 @@
 	const headings = docsBody.querySelectorAll('h2');
 
 	if (headings.length === 0) {
-		// Hide the sidebar if there are no headings to navigate.
-		if (sidebar) {
-			sidebar.style.display = 'none';
-		}
+		if (sidebar) { sidebar.style.display = 'none'; }
 		return;
 	}
 
 	/**
-	 * Build the Table of Contents from h2 headings.
-	 * Assigns IDs to headings that lack one for anchor linking.
+	 * Deterministic slug derived from heading text. Collisions resolved
+	 * with a numeric suffix so every h2 gets a unique ID even when authors
+	 * repeat titles ("Examples", "Examples", ...).
+	 * @param {string} text
+	 * @returns {string}
 	 */
+	function slugify(text) {
+		return String(text)
+			.toLowerCase()
+			.trim()
+			.replace(/[^\w\s-]/g, '')
+			.replace(/\s+/g, '-')
+			.replace(/-+/g, '-')
+			.replace(/^-|-$/g, '') || 'section';
+	}
+
 	function buildToc() {
-		headings.forEach(function(heading, index) {
-			// Ensure every heading has an ID for anchor links.
+		const used = Object.create(null);
+
+		headings.forEach(function (heading) {
 			if (!heading.id) {
-				heading.id = 'section-' + (index + 1);
+				let base = slugify(heading.textContent || '');
+				let slug = base;
+				let n    = 2;
+				while (document.getElementById(slug) || used[slug]) {
+					slug = base + '-' + n;
+					n++;
+				}
+				heading.id = slug;
+				used[slug] = true;
 			}
 
-			var li   = document.createElement('li');
-			var link = document.createElement('a');
+			const li   = document.createElement('li');
+			const link = document.createElement('a');
 
 			link.href        = '#' + heading.id;
 			link.textContent = heading.textContent;
 			link.className   = 'ps-docs-toc-link';
 
-			link.addEventListener('click', function(e) {
+			link.addEventListener('click', function (e) {
 				e.preventDefault();
 				smoothScrollTo(heading);
 			});
@@ -63,82 +81,53 @@
 		});
 	}
 
-	/**
-	 * Smooth scroll to a target element, accounting for the sticky header.
-	 * @param {HTMLElement} target The element to scroll to.
-	 */
 	function smoothScrollTo(target) {
-		var headerHeight = document.querySelector('.site-header')
-			? document.querySelector('.site-header').offsetHeight
-			: 0;
-		var offset = 24; // Extra breathing room below header.
-		var top    = target.getBoundingClientRect().top + window.pageYOffset - headerHeight - offset;
+		const headerEl     = document.querySelector('.site-header');
+		const headerHeight = headerEl ? headerEl.offsetHeight : 0;
+		const offset       = 24;
+		const top          = target.getBoundingClientRect().top + window.pageYOffset - headerHeight - offset;
 
-		window.scrollTo({
-			top: top,
-			behavior: 'smooth'
-		});
-
-		// Update URL hash without jumping.
+		window.scrollTo({ top: top, behavior: 'smooth' });
 		history.replaceState(null, '', '#' + target.id);
 	}
 
-	/**
-	 * Scroll spy — highlights the ToC link corresponding to the
-	 * currently visible section. Uses IntersectionObserver for performance.
-	 */
 	function initScrollSpy() {
-		var tocLinks = tocList.querySelectorAll('.ps-docs-toc-link');
+		const tocLinks = tocList.querySelectorAll('.ps-docs-toc-link');
+		if (tocLinks.length === 0) return;
 
-		if (tocLinks.length === 0) {
-			return;
-		}
+		const headerEl     = document.querySelector('.site-header');
+		const headerHeight = headerEl ? headerEl.offsetHeight : 0;
 
-		var headerHeight = document.querySelector('.site-header')
-			? document.querySelector('.site-header').offsetHeight
-			: 0;
-
-		var observer = new IntersectionObserver(function(entries) {
-			entries.forEach(function(entry) {
-				if (entry.isIntersecting) {
-					var id = entry.target.id;
-					tocLinks.forEach(function(link) {
-						link.classList.remove('ps-docs-toc-link--active');
-						if (link.getAttribute('href') === '#' + id) {
-							link.classList.add('ps-docs-toc-link--active');
-						}
-					});
-				}
+		const observer = new IntersectionObserver(function (entries) {
+			entries.forEach(function (entry) {
+				if (!entry.isIntersecting) return;
+				const id = entry.target.id;
+				tocLinks.forEach(function (link) {
+					link.classList.remove('ps-docs-toc-link--active');
+					if (link.getAttribute('href') === '#' + id) {
+						link.classList.add('ps-docs-toc-link--active');
+					}
+				});
 			});
 		}, {
 			rootMargin: '-' + (headerHeight + 32) + 'px 0px -60% 0px',
 			threshold: 0
 		});
 
-		headings.forEach(function(heading) {
-			observer.observe(heading);
-		});
+		headings.forEach(function (heading) { observer.observe(heading); });
 	}
 
-	/**
-	 * Mobile dropdown toggle for the sidebar ToC.
-	 */
 	function initMobileToggle() {
-		var tocTitle = document.querySelector('.ps-docs-toc-title');
+		const tocTitle = document.querySelector('.ps-docs-toc-title');
+		if (!tocTitle || !sidebar) return;
 
-		if (!tocTitle) {
-			return;
-		}
-
-		tocTitle.addEventListener('click', function() {
-			// Only toggle on mobile (sidebar is not sticky).
+		tocTitle.addEventListener('click', function () {
 			if (window.innerWidth < 1024) {
 				sidebar.classList.toggle('ps-docs-sidebar--open');
 			}
 		});
 	}
 
-	// Initialize.
 	buildToc();
 	initScrollSpy();
 	initMobileToggle();