From 9f731bfe0a16124433318bf2a23fca71fa95d604 Mon Sep 17 00:00:00 2001
From: dwindown <dwinx.ramz@gmail.com>
Date: Thu, 20 Nov 2025 12:27:53 +0700
Subject: [PATCH] fix: Remove addon-specific defaults - maintain zero
 dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**Issue:** Core had default allowed meta fields for specific addons
- OrdersController: _tracking_number, _tracking_provider, etc.
- ProductsController: _custom_field

**Problem:** This violates our core principle:
❌ WooNooW Core = Zero addon dependencies
❌ We do NOT support specific plugins in core
❌ We do NOT hardcode addon fields

**Solution:** Empty defaults, plugins register via filters

**Before:**
```php
$allowed = apply_filters('woonoow/order_allowed_private_meta', [
    '_tracking_number',  // ❌ Addon-specific
    '_tracking_provider', // ❌ Addon-specific
], $order);
```

**After:**
```php
// Core has ZERO defaults - plugins register via filter
$allowed = apply_filters('woonoow/order_allowed_private_meta', [], $order);
```

**How Plugins Register:**
```php
// Shipment Tracking plugin (or any plugin)
add_filter('woonoow/order_allowed_private_meta', function($allowed) {
    $allowed[] = '_tracking_number';
    $allowed[] = '_tracking_provider';
    return $allowed;
});
```

**Principle Maintained:**
✅ Core has ZERO addon dependencies
✅ Core does NOT know about specific plugins
✅ Plugins register themselves via standard WP filters
✅ Community does the integration, not core

**Changed:**
- OrdersController: Empty defaults for allowed/updatable meta
- ProductsController: Empty defaults for allowed/updatable meta
- Added comments: 'Core has ZERO defaults - plugins register via filter'

**Result:**
- Public meta (no underscore): Always exposed automatically
- Private meta (starts with _): Only if plugin registers via filter
- Clean separation: Core provides mechanism, plugins use it
---
 includes/Api/OrdersController.php   | 26 ++++----------------------
 includes/Api/ProductsController.php | 16 ++++------------
 2 files changed, 8 insertions(+), 34 deletions(-)

diff --git a/includes/Api/OrdersController.php b/includes/Api/OrdersController.php
index 437ab98..9df31bf 100644
--- a/includes/Api/OrdersController.php
+++ b/includes/Api/OrdersController.php
@@ -2216,20 +2216,8 @@ class OrdersController {
       }
       
       // Private meta (starts with _) - check if allowed
-      $allowed_private = apply_filters( 'woonoow/order_allowed_private_meta', [
-        // Common shipping tracking fields
-        '_tracking_number',
-        '_tracking_provider',
-        '_tracking_url',
-        '_shipment_tracking_items',
-        '_wc_shipment_tracking_items',
-        
-        // Payment gateway meta
-        '_transaction_id',
-        '_payment_method_title',
-        
-        // Allow plugins to add their meta via filter
-      ], $order );
+      // Core has ZERO defaults - plugins register via filter
+      $allowed_private = apply_filters( 'woonoow/order_allowed_private_meta', [], $order );
       
       if ( in_array( $key, $allowed_private, true ) ) {
         $meta_data[ $key ] = $value;
@@ -2247,14 +2235,8 @@ class OrdersController {
    */
   private static function update_order_meta_data( $order, $meta_updates ) {
     // Get allowed updatable meta keys
-    $allowed = apply_filters( 'woonoow/order_updatable_meta', [
-      // Common shipping tracking fields
-      '_tracking_number',
-      '_tracking_provider',
-      '_tracking_url',
-      
-      // Allow plugins to add their meta via filter
-    ], $order );
+    // Core has ZERO defaults - plugins register via filter
+    $allowed = apply_filters( 'woonoow/order_updatable_meta', [], $order );
     
     foreach ( $meta_updates as $key => $value ) {
       // Skip internal WooCommerce meta
diff --git a/includes/Api/ProductsController.php b/includes/Api/ProductsController.php
index 86b80ee..6c15f5d 100644
--- a/includes/Api/ProductsController.php
+++ b/includes/Api/ProductsController.php
@@ -743,12 +743,8 @@ class ProductsController {
 			}
 			
 			// Private meta (starts with _) - check if allowed
-			$allowed_private = apply_filters('woonoow/product_allowed_private_meta', [
-				// Common custom fields
-				'_custom_field',
-				
-				// Allow plugins to add their meta via filter
-			], $product);
+			// Core has ZERO defaults - plugins register via filter
+			$allowed_private = apply_filters('woonoow/product_allowed_private_meta', [], $product);
 			
 			if (in_array($key, $allowed_private, true)) {
 				$meta_data[$key] = $value;
@@ -766,12 +762,8 @@ class ProductsController {
 	 */
 	private static function update_product_meta_data($product, $meta_updates) {
 		// Get allowed updatable meta keys
-		$allowed = apply_filters('woonoow/product_updatable_meta', [
-			// Common custom fields
-			'_custom_field',
-			
-			// Allow plugins to add their meta via filter
-		], $product);
+		// Core has ZERO defaults - plugins register via filter
+		$allowed = apply_filters('woonoow/product_updatable_meta', [], $product);
 		
 		foreach ($meta_updates as $key => $value) {
 			// Skip internal WooCommerce meta