AccountRenderer

Corex\Profile\Block\AccountRenderer · class · Add-ons layer

Pure renderer for the front-office account block. Given a request context it returns the correct panel — the login/register/recovery forms for a guest, or the profile, sessions, and notifications panels for a signed-in user. All dynamic values are escaped; every form posts to the corex/v1/account/* REST routes via account.js, with the REST nonce the block carries in data-nonce. No WordPress state is read here, so the panel is unit-testable headlessly. What the server answers is written under the button that asked: each form, and the session buttons, have a message line of their own (spec 068, FR-161a). A browser that runs no scripts is told above the forms that they need them (FR-161d). Somebody who arrives from a reset email with a key WordPress takes is shown the new-password form and nothing else, whoever is signed in on that browser (FR-158b). A field’s id holds the block it is in and its form, so no two fields of a page share one and a label names the field printed beside it (spec 068, FR-161b). A field also says what it is for, in the words a browser and a password manager read (spec 068, FR-161c). With a captcha provider on, the registration form carries the provider’s check above its button: challenge is the markup corex-captcha prints for it (already escaped there), and challengeAttribute the attribute that tells the provider’s script the form is one of its own (spec 115, US-AUT-02).

Public API

render(array $ctx): string

instance is what the ids of this block’s fields start with. A page that holds the block more than once hands each one its own; without one they start corex-account.