Tell options.php the page's capability, and hand emails the shape it reads

The declared capability gated the menu, the render and the admin-post
handlers, but options.php asks option_page_capability_{group} and falls
back to manage_options, so a page registered for a shop manager rendered
and then refused every save. The filter is registered now.

The bridge to wp-register-emails read a key the email editor no longer
stores and returned keys compose() never reads, so an owner's edited
heading and body were discarded. It returns enabled, to, subject, content
and context, and its docblock names the real API.

Sections are scoped by slug rather than by field count, the four files
without strict_types have it, and an unregistered read of an encrypted
setting decrypts instead of returning the ciphertext.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Kwx2STJ4EaVaJofEJJ9Zo

Author: arraypress

src/Core.php

@@ -10,6 +10,12 @@
  * @since       1.0.0
  */
 
+declare( strict_types=1 );
+
+use ArrayPress\FieldKit\Context\EncryptedContext;
+use ArrayPress\FieldKit\Context\OptionContext;
+use ArrayPress\FieldKit\Field;
+use ArrayPress\FieldKit\Registry as Types;
 use ArrayPress\RegisterSettingFields\Registry;
 use ArrayPress\RegisterSettingFields\SettingFields;
 
@@ -70,6 +76,12 @@ function set_setting_field_value( string $settings_id, string $field_key, mixed
 	 *
 	 * Use this instead of get_option() for registered settings.
 	 *
+	 * Before the page is registered — a read that runs earlier in the load
+	 * than the plugin's own registration — the option is read directly, under
+	 * its id. A constant cannot stand in for a value there, because the
+	 * prefix is the page's configuration; an encrypted value is still
+	 * decrypted, because the value itself says whether it needs to be.
+	 *
 	 * @param string $settings_id Settings ID.
 	 * @param string $field_key   Field key.
 	 * @param mixed  $fallback     Default value if not set.
@@ -85,9 +97,28 @@ function get_setting_field_value( string $settings_id, string $field_key, $fallb
 
 		$options = get_option( $settings_id, [] );
 
-		return is_array( $options ) && isset( $options[ $field_key ] )
-			? $options[ $field_key ]
-			: $fallback;
+		if ( ! is_array( $options ) || ! isset( $options[ $field_key ] ) ) {
+			return $fallback;
+		}
+
+		// Nothing here knows whether the field is encrypted, so the read
+		// goes through the kit's decorator as the registered path's does,
+		// with the field marked as though it were: ciphertext the decorator
+		// wrote carries its marker and decrypts, and anything else comes back
+		// as it is. What this used to do was hand the ciphertext back as
+		// though it were the API key.
+		$field = new Field(
+			$field_key,
+			( new Types() )->get( 'text' ),
+			[
+				'type'      => 'text',
+				'encrypted' => true,
+			]
+		);
+
+		$value = ( new EncryptedContext( new OptionContext( $settings_id ) ) )->read( 0, $field );
+
+		return null === $value || '' === $value ? $fallback : $value;
 	}
 }
 

src/Email.php

@@ -11,22 +11,32 @@
  * @since       1.0.0
  */
 
+declare( strict_types=1 );
+
 if ( ! function_exists( 'get_setting_fields_email' ) ) {
 	/**
-	 * Get email editor settings for use by wp-register-emails settings_callback.
+	 * What the site owner typed into an email_editor field, in the shape
+	 * wp-register-emails reads.
+	 *
+	 * The field stores `recipient`, `subject`, `heading` and `body`, and an
+	 * `enabled` toggle if the consumer gave it one. `Emails::compose()` reads
+	 * `enabled`, `to`, `subject`, `content` and `context`. This is the seam
+	 * between the two, and it used to be stale on both sides — it read a
+	 * `message` the field never stored and returned a `title` nothing
+	 * consumed, so an owner's edited heading and body were quietly thrown
+	 * away and the plugin's defaults went out instead.
 	 *
-	 * Reads the stored email_editor field value (enabled, recipient, subject,
-	 * title, subtitle, message) and returns it in the format expected by
-	 * register_email_template's settings_callback.
+	 *     register_email( 'my_plugin', 'purchase_receipt', [
+	 *         'settings' => fn() => get_setting_fields_email( 'my_plugin', 'email_purchase_receipt' ),
+	 *     ] );
 	 *
-	 * Usage in register_email_template:
-	 *   'settings_callback' => fn() => get_setting_fields_email( 'my_plugin', 'email_purchase_receipt' ),
+	 * A part the owner left empty is left out, so the email's registered
+	 * default stands in for it.
 	 *
 	 * @param string $settings_id Settings ID (e.g., 'sugarcart').
 	 * @param string $field_key   The email_editor field key (e.g., 'email_purchase_receipt').
 	 *
-	 * @return array Settings array with 'enabled', 'recipient', 'subject', 'title',
-	 *               'subtitle', 'message' keys. Returns empty array if not found.
+	 * @return array{enabled?: bool, to?: string[], subject?: string, content?: string, context?: array{title: string}}
 	 */
 	function get_setting_fields_email( string $settings_id, string $field_key ): array {
 		$value = get_setting_field_value( $settings_id, $field_key );
@@ -41,25 +51,27 @@ function get_setting_fields_email( string $settings_id, string $field_key ): arr
 			$result['enabled'] = (bool) $value['enabled'];
 		}
 
-		if ( ! empty( $value['recipient'] ) ) {
-			$result['recipient'] = sanitize_email( $value['recipient'] );
-		}
+		// Several addresses, separated by commas — which is what the field
+		// says beside its recipient box.
+		$to = array_filter( array_map( 'sanitize_email', explode( ',', (string) ( $value['recipient'] ?? '' ) ) ) );
 
-		if ( ! empty( $value['subject'] ) ) {
-			$result['subject'] = $value['subject'];
+		if ( [] !== $to ) {
+			$result['to'] = array_values( $to );
 		}
 
-		if ( ! empty( $value['title'] ) ) {
-			$result['title'] = $value['title'];
+		if ( ! empty( $value['subject'] ) ) {
+			$result['subject'] = (string) $value['subject'];
 		}
 
-		if ( ! empty( $value['subtitle'] ) ) {
-			$result['subtitle'] = $value['subtitle'];
+		// The editor stores the body without its <p> tags, as wp_editor
+		// does; wpautop() puts them back.
+		if ( ! empty( $value['body'] ) ) {
+			$result['content'] = wpautop( (string) $value['body'] );
 		}
 
-		// wp_editor stores content without <p> tags; wpautop restores them.
-		if ( ! empty( $value['message'] ) ) {
-			$result['message'] = wpautop( $value['message'] );
+		// The heading is the template's title, which sits above the body.
+		if ( ! empty( $value['heading'] ) ) {
+			$result['context'] = [ 'title' => (string) $value['heading'] ];
 		}
 
 		return $result;
@@ -82,10 +94,10 @@ function get_setting_fields_email_recipient( string $settings_id, string $field_
 		$value = get_setting_field_value( $settings_id, $field_key );
 
 		if ( is_array( $value ) && ! empty( $value['recipient'] ) && is_email( $value['recipient'] ) ) {
-			return $value['recipient'];
+			return (string) $value['recipient'];
 		}
 
-		return get_option( 'admin_email' );
+		return (string) get_option( 'admin_email', '' );
 	}
 }
 

src/Page.php

@@ -10,6 +10,8 @@
  * @since       1.0.0
  */
 
+declare( strict_types=1 );
+
 use ArrayPress\FieldKit\Value;
 
 /** Page Field Helpers ********************************************************/

src/SettingFields.php

@@ -359,6 +359,26 @@ public function register_settings(): void {
 				'default'           => [],
 			]
 		);
+
+		// options.php runs its own capability check before it saves, and it
+		// does not know what the menu was registered with: it asks this
+		// filter and falls back to manage_options. Without it a page
+		// registered for a lower capability drew for its users and then
+		// refused every save with "Sorry, you are not allowed to manage
+		// options."
+		add_filter( 'option_page_capability_' . (string) $this->config['option_group'], [ $this, 'option_page_capability' ] );
+	}
+
+	/**
+	 * The capability options.php checks before it saves this page's option.
+	 *
+	 * The same one that gates the menu, the render and the admin-post
+	 * handlers, so the user who can see the page can save it.
+	 *
+	 * @return string
+	 */
+	public function option_page_capability(): string {
+		return (string) $this->config['capability'];
 	}
 
 	/**
@@ -660,15 +680,15 @@ private function render_sections( string $tab ): void {
 				printf( '<p class="description">%s</p>', wp_kses_post( (string) $section['description'] ) );
 			}
 
-			$this->render_table( $set, $in_section );
+			$this->render_table( $set, $in_section, (string) $slug );
 		}
 
 		// A field no section claimed still has to appear, or a typo in a
 		// section name silently removes it from the page.
 		$loose = array_diff_key( $fields, array_flip( $shown ) );
 
 		if ( [] !== $loose ) {
-			$this->render_table( $set, $loose );
+			$this->render_table( $set, $loose, '' );
 		}
 	}
 
@@ -677,13 +697,19 @@ private function render_sections( string $tab ): void {
 	 *
 	 * @param FieldSet $set    The field set.
 	 * @param Field[]  $fields The fields to render.
+	 * @param string   $scope  The section these belong to, or empty for the
+	 *                         fields no section claimed.
 	 *
 	 * @return void
 	 */
-	private function render_table( FieldSet $set, array $fields ): void {
+	private function render_table( FieldSet $set, array $fields, string $scope ): void {
 		$layout = Sections::split( $fields );
 
 		if ( [] !== $layout ) {
+			// Scoped by the section rather than by how many fields it has.
+			// Two sections on one tab with the same number of fields got the
+			// same ids for their tab strips, and the second strip drove the
+			// first one's panels.
 			$sections = Sections::render(
 				$layout,
 				function ( array $group ) use ( $set ): string {
@@ -696,7 +722,7 @@ function ( array $group ) use ( $set ): string {
 
 					return (string) ob_get_clean();
 				},
-				$this->id . '-' . count( $fields )
+				$this->id . '-' . $scope
 			);
 
 			echo $sections; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped as it is built.
@@ -1239,11 +1265,6 @@ public function get_value( string $field_key, mixed $fallback = null ): mixed {
 		return null === $value || '' === $value ? $fallback : $value;
 	}
 
-	/**
-	 * Get the field configuration.
-	 *
-	 * @return array<string, array<string, mixed>>
-	 */
 	/**
 	 * Write one value, through the same decorators a form save uses.
 	 *
@@ -1295,6 +1316,14 @@ public function delete_value( string $field_key ): bool {
 		return true;
 	}
 
+	/**
+	 * Get the field configuration, keyed by field key.
+	 *
+	 * As configured, with a badged section's badge copied onto each of its
+	 * fields.
+	 *
+	 * @return array<string, array<string, mixed>>
+	 */
 	public function get_fields(): array {
 		return $this->fields;
 	}

src/TypeCheck.php

@@ -10,6 +10,8 @@
  * @since       1.0.0
  */
 
+declare( strict_types=1 );
+
 use ArrayPress\FieldKit\Value;
 
 /*

tests/SetValueTest.php

@@ -93,6 +93,27 @@ public function test_writing_one_field_leaves_the_others_alone(): void {
 		$this->assertSame( 'second', $page->get_value( 'other' ) );
 	}
 
+	/**
+	 * Read before the page is registered, an encrypted value is still the
+	 * value.
+	 *
+	 * The helper falls back to the option when the page is not registered
+	 * yet, and it used to hand back what the option held — the ciphertext —
+	 * as though it were the key.
+	 */
+	public function test_an_encrypted_value_is_readable_before_the_page_is_registered(): void {
+		$page = $this->page();
+
+		$page->set_value( 'secret', 'sk_test_example' );
+		$page->set_value( 'plain', 'hello' );
+
+		Registry::instance()->unregister( 'sf_set' );
+
+		$this->assertSame( 'sk_test_example', get_setting_field_value( 'sf_set', 'secret' ) );
+		$this->assertSame( 'hello', get_setting_field_value( 'sf_set', 'plain' ) );
+		$this->assertSame( 'fallback', get_setting_field_value( 'sf_set', 'missing', 'fallback' ) );
+	}
+
 	public function test_an_unknown_field_writes_nothing(): void {
 		$this->assertFalse( $this->page()->set_value( 'nothing', 'x' ) );
 	}