[cs1m0n]

Changes

• Send site report now (Settings → BCC Login → Maintenance → Site report) sends the report right away, however recently it was sent, and shows the result on the page:

  • what was sent: the URL, versions, users and subscribers;
  • or why it couldn't be sent: Auth0's error, the API's HTTP status, or a network error.

  It lets a site's administrators check its Auth0 setup without SSH or logs.

  • Like the rest of Maintenance, only administrators see it.
  • The form has a nonce.
  • Messages are escaped, since Auth0's error description is outside input.
  • It clears the last claim instead of claiming the next 12 hours, so the next daily report still goes out at its usual time, also after a press that failed.

• Fix: the daily report stopped after two days on sites with a persistent object cache (Redis, Memcached).

  • WP_Upgrader::create_lock() re-creates an expired lock by deleting the option and adding it again. The re-add leaves the option cached as missing, because add_option() sees 0 changed rows and returns early. From then on, create_lock() finds no lock and gives up, every day.
  • Reproduced in WordPress 7.0.2: the report went out on day 1 and day 2, and never again after that.
  • The window is now claimed with SQL on the same option, bypassing the option cache. INSERT IGNORE adds the first claim, and an UPDATE that only matches a claim at least 12 hours old moves it forward.
  • Both statements count a row only when they claim the window, also on connections with MYSQLI_CLIENT_FOUND_ROWS. Of two runs at once, only one claims it.
  • The option name stays the same, so existing locks are still honoured and wp option delete bcc_login_site_report.lock still works.

• Refactor: sending is split into send() (daily), send_now() (the button) and deliver() (shared by both). The daily report logs the same messages as before.

Testing

In a throwaway WordPress 7.0.2 on PHP 7.4 and MariaDB 10.5, against a mock Auth0 and a mock API:

• The section renders under Maintenance for administrators. A user with manage_options who isn't an administrator doesn't see it, and pressing does nothing for them.
• Pressing sends even when the last claim is an hour old, shows what was sent, and clears the claim. The daily cron right after sends, and the one after that doesn't.
• An Auth0 403 with <script> in its description is shown escaped, and an API 401 is shown.
• A bad nonce or a subscriber does nothing.
• Six cron runs at once send exactly one report, in two rounds, with and without MYSQLI_CLIENT_FOUND_ROWS. Failures are logged as before.
• The claim keeps working past day 3 in a long-lived process, including when the cache is left exactly as the old lock left it.

PHPStan with the CI config passes, and php -l passes on PHP 7.4 and 8.4.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No blocking issues were identified in authorization, output escaping, delivery handling, or atomic report claims.

No open issues 🎉

What changed in this PR

Adds manual site reporting to BCC Login and fixes daily reporting on sites with persistent object caches.

Changes:

• Adds an administrator-only, nonce-protected button with escaped delivery results.
• Replaces upgrader locks with atomic SQL claims.
• Shares delivery logic between manual and daily reports.

File	Description
plugins/​bcc-login/​includes/​class-bcc-login-site-report.php	Adds manual reporting, shared delivery logic, and SQL-based claims.
plugins/​bcc-login/​includes/​class-bcc-login-settings.php	Adds the maintenance hook for the reporting controls.

_{Review effort: Balanced}