New: Settings page rebuilt with React UI and REST API

[KingYes]

✨ PR Description

1. Problem & Context

Settings page was a legacy PHP form-based UI; migrating to React + REST API for modern UX and maintainability. Enables settings management via REST while deprecating old AJAX pattern.

2. What Changed (Where)

File	Change
class-aal-rest.php	Added /settings GET/PUT routes; new /logs/erase POST route; check_settings_permissions() with nonce validation
class-aal-settings.php	Replaced 400+ lines of WordPress Settings API boilerplate with React entry point; removed AJAX reset handler
settings.js (new)	React component consuming REST API; handles form state, validation feedback, log erasure with confirmation
api.js	Added fetchSettings(), saveSettings(), eraseLogs() wrappers; moved EXPORT_FILTER_KEYS constant inside function
settings-index.js (new)	React root mount for settings page
package.json	Added settings-index.js to build scripts
test-settings-rest.php (new)	210-line test suite covering permissions, nonce validation, sanitization, edge cases

3. How It Works

Request flow: React component calls fetchSettings() → REST API returns field schema + current values → user edits state → saveSettings() sends PUT with nonce header → PHP validates each field per type (numeric bounds, enum whitelist, empty string handling) → merges with existing options → returns success/error.

Permission gate: manage_options check + nonce verification via X-AAL-Settings-Nonce header on every settings/erase endpoint. Field sanitization is per-key with explicit allowed values (IP sources hardcoded, yes/no enum, numeric bounds).

4. Risks

Nonce misuse: Passing nonce via custom header instead of POST body—verify client-side code always includes it on PUT/POST (not a GET param). Backward compat: Removed AJAX reset callback and Settings API registration; verify no third-party code hooked ajax_aal_reset_items. Build dependency: Settings page now requires npm build; missing assets show admin notice but could silently fail if build skipped.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}