From d84d485ec7eb604c11f51b953fcff1773e3b7ad3 Mon Sep 17 00:00:00 2001
From: unknown <kate522@88.com>
Date: Sat, 5 Sep 2026 23:41:12 +0800
Subject: [PATCH] refactor(submit): remove unused aksrt_update_post ajax
 endpoint

No caller anywhere: front JS updates via aksrt_submit_post (posts_id),
guests via aksrt_save_draft. Re-pin the one-captcha-admission contract
to ajax_submit_post, the only non-draft entry point.
---
 src/Core/FrontSubmit.php                      | 20 -------------------
 .../front-submit-editor-contract.test.cjs     |  9 +++++----
 2 files changed, 5 insertions(+), 24 deletions(-)

diff --git a/src/Core/FrontSubmit.php b/src/Core/FrontSubmit.php
index e20e43fb..d71025a2 100644
--- a/src/Core/FrontSubmit.php
+++ b/src/Core/FrontSubmit.php
@@ -30,7 +30,6 @@ class FrontSubmit {
     public function init(): void {
         add_action('wp_ajax_aksrt_submit_post', [$this, 'ajax_submit_post']);
         add_action('wp_ajax_aksrt_save_draft', [$this, 'ajax_save_draft']);
-        add_action('wp_ajax_aksrt_update_post', [$this, 'ajax_update_post']);
         add_action('wp_ajax_aksrt_delete_draft', [$this, 'ajax_delete_draft']);
         add_action('wp_ajax_aksrt_delete_post', [$this, 'ajax_delete_post']);
 
@@ -383,25 +382,6 @@ class FrontSubmit {
         $this->send_result($result);
     }
 
-    public function ajax_update_post(): void {
-        $this->verify_nonce();
-        $data = wp_unslash($_POST);
-        if (!is_array($data)) {
-            $data = [];
-        }
-        $post_id = absint($data['posts_id'] ?? $data['post_id'] ?? $data['edit_id'] ?? 0);
-        if ($post_id <= 0) {
-            wp_send_json_error(['message' => __('文章 ID 无效', 'aksrt')]);
-        }
-        $data['posts_id'] = $post_id;
-        $action = (($data['status'] ?? '') === 'draft') ? 'posts_draft' : 'posts_save';
-        if ($action !== 'posts_draft') {
-            $this->verify_captcha();
-        }
-        $result = $this->persist($data, $action);
-        $this->send_result($result);
-    }
-
     public function ajax_delete_draft(): void {
         $this->verify_nonce();
         $user_id = get_current_user_id();
diff --git a/tests/widget-system/front-submit-editor-contract.test.cjs b/tests/widget-system/front-submit-editor-contract.test.cjs
index 37347731..4749b2a0 100644
--- a/tests/widget-system/front-submit-editor-contract.test.cjs
+++ b/tests/widget-system/front-submit-editor-contract.test.cjs
@@ -100,12 +100,13 @@ test('public theme does not inject a global focus-visible ring', () => {
 
 test('non-draft front-submit updates require one server captcha admission', () => {
   const controller = read('src/Core/FrontSubmit.php');
-  const start = controller.indexOf('public function ajax_update_post(): void');
-  const end = controller.indexOf('\n    public function ajax_delete_draft', start);
+  // Edits ride the same submit endpoint (posts_id + posts_save), which is the
+  // only non-draft entry point and always verifies captcha before persisting.
+  const start = controller.indexOf('public function ajax_submit_post(): void');
+  const end = controller.indexOf('\n    public function ajax_save_draft', start);
   const body = controller.slice(start, end);
 
-  assert.match(body, /\$action = \(\(\$data\['status'\] \?\? ''\) === 'draft'\) \? 'posts_draft' : 'posts_save';/);
-  assert.match(body, /if \(\$action !== 'posts_draft'\) \{\s*\$this->verify_captcha\(\);\s*\}/);
+  assert.match(body, /\$this->verify_nonce\(\);\s*\$this->verify_captcha\(\);\s*\$data = wp_unslash\(\$_POST\);\s*\$result = \$this->persist\(is_array\(\$data\) \? \$data : \[\], 'posts_save'\);/);
   assert.match(controller, /get_error_code\(\)/);
   assert.match(controller, /get_error_message\(\)/);
 });