Address code review feedback

- Detect the [edac_simplified_summary] shortcode in block theme template
  content, not just the block, when suppressing automatic insertion.
- Gate explicit shortcode post_id values on is_post_publicly_viewable()
  so summaries of draft/private posts cannot be exposed.
- Output block wrapper attributes in the render callback so the
  supports.spacing.margin styles reach the front end, with a guard for
  direct calls outside an active block render.
- Make the render callback's $block parameter optional with an
  instanceof check.
- Use lint-approved lowercase currentcolor in the editor stylesheet.
- Reset the block template global in tearDown and add regression tests
  for the template shortcode and non-public post cases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: SteveJonesDev

includes/classes/Blocks/SimplifiedSummaryBlock.php

@@ -106,20 +106,33 @@ public function register() {
 	 *
 	 * @since 1.xx.x
 	 *
-	 * @param array    $attributes The block attributes.
-	 * @param string   $content    The block content.
-	 * @param WP_Block $block      The block instance.
+	 * @param array         $attributes The block attributes.
+	 * @param string        $content    The block content.
+	 * @param WP_Block|null $block      The block instance.
 	 * @return string
 	 */
-	public function render( $attributes, $content, $block ) {
-		$post_id = isset( $block->context['postId'] )
+	public function render( $attributes, $content, $block = null ) {
+		$post_id = ( $block instanceof WP_Block && isset( $block->context['postId'] ) )
 			? (int) $block->context['postId']
 			: (int) get_the_ID();
 
 		if ( ! $post_id ) {
 			return '';
 		}
 
-		return ( new Simplified_Summary() )->simplified_summary_markup( $post_id );
+		$markup = ( new Simplified_Summary() )->simplified_summary_markup( $post_id );
+
+		if ( ! $markup ) {
+			return '';
+		}
+
+		// The wrapper carries the block supports output (margin classes/styles).
+		// get_block_wrapper_attributes() requires an active block render; guard
+		// against direct calls to this callback outside of one.
+		$wrapper_attributes = null !== \WP_Block_Supports::$block_to_render
+			? get_block_wrapper_attributes()
+			: 'class="wp-block-edac-simplified-summary"';
+
+		return sprintf( '<div %s>%s</div>', $wrapper_attributes, $markup );
 	}
 }

includes/classes/Shortcodes/SimplifiedSummaryShortcode.php

@@ -43,6 +43,8 @@ public function init_hooks() {
 	 *
 	 * Renders regardless of the edac_simplified_summary_prompt option because
 	 * manual placement is a deliberate act, matching edac_get_simplified_summary().
+	 * An explicit post_id must reference a publicly viewable post so the
+	 * shortcode cannot expose summaries of draft or private posts.
 	 *
 	 * @since 1.xx.x
 	 *
@@ -56,9 +58,13 @@ public function render( $atts ) {
 			self::SHORTCODE
 		);
 
-		$post_id = absint( $atts['post_id'] )
-			? absint( $atts['post_id'] )
-			: (int) get_the_ID();
+		$explicit_post_id = absint( $atts['post_id'] );
+
+		if ( $explicit_post_id && ! is_post_publicly_viewable( $explicit_post_id ) ) {
+			return '';
+		}
+
+		$post_id = $explicit_post_id ? $explicit_post_id : (int) get_the_ID();
 
 		if ( ! $post_id ) {
 			return '';

includes/classes/class-simplified-summary.php

@@ -89,7 +89,10 @@ public function is_manually_placed( $post = null ): bool {
 		if (
 			! $manually_placed &&
 			! empty( $_wp_current_template_content ) &&
-			has_block( 'edac/simplified-summary', $_wp_current_template_content )
+			(
+				has_block( 'edac/simplified-summary', $_wp_current_template_content ) ||
+				has_shortcode( $_wp_current_template_content, 'edac_simplified_summary' )
+			)
 		) {
 			$manually_placed = true;
 		}

src/simplifiedSummaryBlock/sass/simplified-summary-block.scss

@@ -1,7 +1,7 @@
 // Editor-only styles for the simplified summary block placeholder.
 .edac-simplified-summary {
 	.edac-simplified-summary-block__placeholder {
-		border: 1px dashed currentColor;
+		border: 1px dashed currentcolor;
 		border-radius: 2px;
 		opacity: 0.62;
 		padding: 0.75em 1em;

tests/phpunit/includes/classes/Blocks/SimplifiedSummaryBlockTest.php

@@ -130,6 +130,7 @@ public function test_block_renders_through_do_blocks() {
 
 		$output = do_blocks( '<!-- wp:edac/simplified-summary /-->' );
 		$this->assertStringContainsString( 'Do blocks summary.', $output );
+		$this->assertStringContainsString( 'wp-block-edac-simplified-summary', $output );
 	}
 
 	/**

tests/phpunit/includes/classes/Shortcodes/SimplifiedSummaryShortcodeTest.php

@@ -68,6 +68,22 @@ public function test_shortcode_returns_empty_string_without_summary() {
 		$this->assertSame( '', $output );
 	}
 
+	/**
+	 * Tests that the shortcode does not expose summaries of non-public posts.
+	 *
+	 * @return void
+	 */
+	public function test_shortcode_does_not_render_non_public_posts() {
+		$draft_id = self::factory()->post->create( [ 'post_status' => 'draft' ] );
+		update_post_meta( $draft_id, '_edac_simplified_summary', 'Draft summary.' );
+
+		$private_id = self::factory()->post->create( [ 'post_status' => 'private' ] );
+		update_post_meta( $private_id, '_edac_simplified_summary', 'Private summary.' );
+
+		$this->assertSame( '', do_shortcode( '[edac_simplified_summary post_id="' . $draft_id . '"]' ) );
+		$this->assertSame( '', do_shortcode( '[edac_simplified_summary post_id="' . $private_id . '"]' ) );
+	}
+
 	/**
 	 * Tests that the shortcode returns an empty string outside the loop with no post_id.
 	 *

tests/phpunit/includes/classes/SimplifiedSummaryTest.php

@@ -34,6 +34,19 @@ public function setUp(): void {
 		$this->simplified_summary = new Simplified_Summary();
 	}
 
+	/**
+	 * Clean up the test fixture.
+	 *
+	 * The core test framework does not reset the block template global.
+	 *
+	 * @return void
+	 */
+	public function tearDown(): void {
+		global $_wp_current_template_content;
+		$_wp_current_template_content = null;
+		parent::tearDown();
+	}
+
 	/**
 	 * Tests output of simplified_summary_markup with a summary.
 	 *
@@ -136,7 +149,23 @@ public function test_output_simplified_summary_suppressed_when_block_in_template
 
 		$output = $this->simplified_summary->output_simplified_summary( 'Post content.' );
 
-		$_wp_current_template_content = null;
+		$this->assertStringNotContainsString( 'edac-simplified-summary', $output );
+	}
+
+	/**
+	 * Tests that auto-insertion is suppressed when the shortcode is in the current block theme template.
+	 *
+	 * Covers a core Shortcode block containing [edac_simplified_summary] in an FSE template.
+	 *
+	 * @return void
+	 */
+	public function test_output_simplified_summary_suppressed_when_shortcode_in_template() {
+		$this->create_post_in_loop();
+
+		global $_wp_current_template_content;
+		$_wp_current_template_content = '<!-- wp:shortcode -->[edac_simplified_summary]<!-- /wp:shortcode --><!-- wp:post-content /-->';
+
+		$output = $this->simplified_summary->output_simplified_summary( 'Post content.' );
 
 		$this->assertStringNotContainsString( 'edac-simplified-summary', $output );
 	}