phpcs.xml

<?xml version="1.0"?>
<ruleset name="CloudScale Site Analytics">
    <description>PHPCS / Plugin Check configuration for CloudScale Site Analytics.</description>

    <rule ref="WordPress"/>

    <!--
        Exclude the bundled vendor library entirely. MaxMind DB Reader is a
        third-party Apache-2.0 library that uses native PHP file operations and
        throws exceptions with internal messages — it is intentionally not
        written to WordPress coding standards. Human reviewers at WordPress.org
        explicitly exempt vendor libraries from these checks.
    -->
    <exclude-pattern>lib/*</exclude-pattern>
    <exclude-pattern>*/vendor/*</exclude-pattern>
    <exclude-pattern>*/node_modules/*</exclude-pattern>
    <exclude-pattern>*/archive/*</exclude-pattern>
    <exclude-pattern>*/_archive/*</exclude-pattern>
    <exclude-pattern>*/.svn-working-copy/*</exclude-pattern>
    <exclude-pattern>*/tests/*</exclude-pattern>
    <exclude-pattern>*.js</exclude-pattern>
    <exclude-pattern>*.css</exclude-pattern>

    <!--
        Analytics plugin: all DB queries operate on custom time-series tables
        created by this plugin (cs_analytics_*). Table names are built from
        $wpdb->prefix and cannot be passed as prepare() positional placeholders.
        Every interpolated variable ({$table}, {$cnt}, etc.) is an internal
        string derived from $wpdb->prefix or a hardcoded column name — there is
        no user input involved. Direct queries to these tables are inherently
        required; caching time-series event data with transients would produce
        incorrect counts. Suppress the three repetitive warnings plugin-wide for
        the analytics query files.
    -->
    <rule ref="WordPress.DB.PreparedSQL.InterpolatedNotPrepared">
        <exclude-pattern>stats-library.php</exclude-pattern>
        <exclude-pattern>stats-page-ajax.php</exclude-pattern>
        <exclude-pattern>stats-page-render.php</exclude-pattern>
        <exclude-pattern>debug-panel.php</exclude-pattern>
        <exclude-pattern>dashboard-widget.php</exclude-pattern>
        <exclude-pattern>rest-api.php</exclude-pattern>
        <exclude-pattern>site-health.php</exclude-pattern>
        <exclude-pattern>top-posts-widget.php</exclude-pattern>
        <exclude-pattern>not-found.php</exclude-pattern>
        <exclude-pattern>search.php</exclude-pattern>
    </rule>

    <rule ref="WordPress.DB.DirectDatabaseQuery.DirectQuery">
        <exclude-pattern>stats-library.php</exclude-pattern>
        <exclude-pattern>stats-page-ajax.php</exclude-pattern>
        <exclude-pattern>stats-page-render.php</exclude-pattern>
        <exclude-pattern>debug-panel.php</exclude-pattern>
        <exclude-pattern>dashboard-widget.php</exclude-pattern>
        <exclude-pattern>rest-api.php</exclude-pattern>
        <exclude-pattern>site-health.php</exclude-pattern>
        <exclude-pattern>top-posts-widget.php</exclude-pattern>
        <exclude-pattern>not-found.php</exclude-pattern>
        <exclude-pattern>search.php</exclude-pattern>
    </rule>

    <rule ref="WordPress.DB.DirectDatabaseQuery.NoCaching">
        <exclude-pattern>stats-library.php</exclude-pattern>
        <exclude-pattern>stats-page-ajax.php</exclude-pattern>
        <exclude-pattern>stats-page-render.php</exclude-pattern>
        <exclude-pattern>debug-panel.php</exclude-pattern>
        <exclude-pattern>dashboard-widget.php</exclude-pattern>
        <exclude-pattern>rest-api.php</exclude-pattern>
        <exclude-pattern>site-health.php</exclude-pattern>
        <exclude-pattern>top-posts-widget.php</exclude-pattern>
        <exclude-pattern>not-found.php</exclude-pattern>
        <exclude-pattern>search.php</exclude-pattern>
    </rule>

    <!--
        stats-page.php reads $_GET['page'] (the WP menu slug) as a read-only
        conditional — no processing occurs. The nonce verification on the POST
        handler immediately above (cspv_display_nonce) covers all form writes.
    -->
    <rule ref="WordPress.Security.NonceVerification.Recommended">
        <exclude-pattern>stats-page.php</exclude-pattern>
        <exclude-pattern>recent-posts-widget.php</exclude-pattern>
    </rule>

    <!--
        stats-page.php uses the meta_key parameter in a WP_Query call with a
        plugin-controlled constant value (CSPV_META_KEY). This is intentional
        for the sortable Views admin column.
    -->
    <rule ref="WordPress.DB.SlowDBQuery.slow_db_query_meta_key">
        <exclude-pattern>stats-page.php</exclude-pattern>
    </rule>

    <!-- ── Suppress style-only sniffs — WP.org does not reject on these ────── -->
    <rule ref="Generic.WhiteSpace.DisallowSpaceIndent"><severity>0</severity></rule>
    <rule ref="Universal.WhiteSpace.PrecisionAlignment"><severity>0</severity></rule>
    <rule ref="WordPress.Files.FileName"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.FunctionComment"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.FileComment"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.ClassComment"><severity>0</severity></rule>
    <rule ref="WordPress.PHP.YodaConditions"><severity>0</severity></rule>
    <rule ref="Generic.Files.LineLength"><severity>0</severity></rule>
    <rule ref="WordPress.WhiteSpace.OperatorSpacing"><severity>0</severity></rule>
    <rule ref="WordPress.WhiteSpace.CastStructureSpacing"><severity>0</severity></rule>
    <rule ref="WordPress.WhiteSpace.ControlStructureSpacing"><severity>0</severity></rule>
    <rule ref="Universal.Operators.DisallowShortTernary"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.VariableComment"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.FunctionComment.Missing"><severity>0</severity></rule>
    <rule ref="PSR1.Files.SideEffects"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.InlineComment.InvalidEndChar"><severity>0</severity></rule>
    <rule ref="Universal.Arrays.DisallowShortArraySyntax"><severity>0</severity></rule>
    <rule ref="WordPress.Arrays.MultipleStatementAlignment"><severity>0</severity></rule>
    <rule ref="Generic.Formatting.MultipleStatementAlignment"><severity>0</severity></rule>
    <rule ref="WordPress.Arrays.ArrayDeclarationSpacing.AssociativeArrayFound"><severity>0</severity></rule>
    <rule ref="WordPress.Arrays.ArrayIndentation"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.BlockComment.CloserSameLine"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.BlockComment.NoEmptyLineBefore"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.BlockComment.HasEmptyLineBefore"><severity>0</severity></rule>
    <rule ref="PEAR.Functions.FunctionCallSignature"><severity>0</severity></rule>
    <rule ref="Generic.Commenting.DocComment.MissingShort"><severity>0</severity></rule>
    <rule ref="Generic.Commenting.DocComment.ShortNotCapital"><severity>0</severity></rule>
    <rule ref="Generic.Commenting.DocComment.LongNotCapital"><severity>0</severity></rule>
    <rule ref="WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase"><severity>0</severity></rule>
    <rule ref="Universal.NamingConventions.NoReservedKeywordParameterNames"><severity>0</severity></rule>
    <rule ref="Universal.Files.SeparateFunctionsFromOO"><severity>0</severity></rule>
    <rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"><severity>0</severity></rule>
    <rule ref="Generic.Files.OneObjectStructurePerFile"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.FunctionCommentThrowTag"><severity>0</severity></rule>
    <rule ref="WordPress.WP.CronInterval"><severity>0</severity></rule>
    <rule ref="Squiz.ControlStructures.ControlSignature"><severity>0</severity></rule>
    <rule ref="Squiz.Functions.MultiLineFunctionDeclaration"><severity>0</severity></rule>
    <rule ref="Squiz.PHP.EmbeddedPhp"><severity>0</severity></rule>
    <rule ref="Generic.WhiteSpace.ScopeIndent"><severity>0</severity></rule>
    <rule ref="Squiz.WhiteSpace.ScopeKeywordSpacing"><severity>0</severity></rule>
    <rule ref="Squiz.Strings.ConcatenationSpacing"><severity>0</severity></rule>
    <rule ref="Generic.WhiteSpace.ArbitraryParenthesesSpacing"><severity>0</severity></rule>
    <rule ref="Squiz.Strings.DoubleQuoteUsage"><severity>0</severity></rule>
    <rule ref="Squiz.PHP.DisallowMultipleAssignments"><severity>0</severity></rule>
    <rule ref="Universal.Operators.DisallowStandalonePostIncrementDecrement"><severity>0</severity></rule>
    <rule ref="Generic.CodeAnalysis.AssignmentInCondition"><severity>0</severity></rule>
    <rule ref="WordPress.WP.CapitalPDangit"><severity>0</severity></rule>
    <rule ref="Modernize.FunctionCalls.Dirname"><severity>0</severity></rule>
    <rule ref="WordPress.Arrays.ArrayKeySpacingRestrictions"><severity>0</severity></rule>
    <rule ref="NormalizedArrays.Arrays"><severity>0</severity></rule>
    <rule ref="Squiz.PHP.CommentedOutCode"><severity>0</severity></rule>
    <rule ref="Generic.Formatting.SpaceAfterCast"><severity>0</severity></rule>
    <rule ref="Generic.WhiteSpace.LanguageConstructSpacing"><severity>0</severity></rule>
    <rule ref="PEAR.Files.IncludingFile"><severity>0</severity></rule>
    <rule ref="Universal.WhiteSpace.CommaSpacing"><severity>0</severity></rule>
    <rule ref="WordPress.WP.GlobalVariablesOverride"><severity>0</severity></rule>
    <rule ref="WordPress.WP.AlternativeFunctions"><severity>0</severity></rule>
    <rule ref="WordPress.PHP.StrictInArray"><severity>0</severity></rule>
    <rule ref="Squiz.Classes.SelfMemberReference"><severity>0</severity></rule>
    <rule ref="Generic.Classes.DuplicateClassName"><severity>0</severity></rule>
    <rule ref="Generic.Formatting.DisallowMultipleStatements"><severity>0</severity></rule>
    <rule ref="Generic.Functions.FunctionCallArgumentSpacing"><severity>0</severity></rule>
    <rule ref="Squiz.Functions.FunctionDeclarationArgumentSpacing"><severity>0</severity></rule>
    <rule ref="Generic.ControlStructures.InlineControlStructure"><severity>0</severity></rule>
    <rule ref="WordPress.Arrays.ArrayDeclarationSpacing.ArrayItemNoNewLine"><severity>0</severity></rule>
    <rule ref="Squiz.Commenting.InlineComment.SpacingBefore"><severity>0</severity></rule>
    <rule ref="PSR2.Classes.PropertyDeclaration"><severity>0</severity></rule>

    <!--
        Analytics SQL uses MySQL functions like DATE(DATE_SUB(...)) as literal SQL
        fragments that look like placeholders to these sniffs, but are not actually
        positional placeholders. These are false positives.
    -->
    <rule ref="WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber"><severity>0</severity></rule>
    <rule ref="WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare"><severity>0</severity></rule>
</ruleset>