feat(access-control): auto-signup on renewal only for already subscribed lists

[dkoo]

All Submissions:

• Have you followed the Newspack Contributing guideline?
• Does your code follow the WordPress' coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

#4589 added functionality to auto-signup users to restricted lists when they meet access requirements for those lists. However, if a reader purchases a subscription that includes access to restricted lists, then subsequently unsubscribe from a restricted list outside of the site (such as by clicking on the "unsubscribe from this newsletter" link in the delivered email), we don't want to automatically re-add them to this list, which could result in frustration on the user's part.

This PR adds a check when a renewal order is created to cache the user's subscribed lists as user meta. When an access check for the user occurs, if that user meta exists, auto-signup will only occur for lists the user was already subscribed to when the most recent renewal began. The user meta cache is cleared after any access check is completed, so it doesn't persist beyond a single pending check.

This way, auto-signup will only occur after a new subscription is created, a subscription is switched to a different product within the same group/parent, or if the subscription is activated through means other than a renewal (such as an admin action, CLI script, or a subscription status change via manual user action in My Account).

Since the access check queue is only processed once per hour, there's a small chance a reader could unsubscribe from a restricted list after a renewal starts but before their scheduled access check occurs. In this case they'll be added back to the list when the queue is processed. But the chance that an intentional unsubscribe happens in this interim period is pretty low.

Also, caches the premium newsletter gates when processing the queue so we don't perform more post queries than we need to for a large queue of users.

How to test the changes in this Pull Request:

1. In Newsletters > Premium make sure Auto-signup is enabled in Advanced Settings. Set up and activate at least one premium newsletter gate targeting more than one restricted list.
2. As a reader, purchase the required subscription.
3. Trigger the initial auto-signup by running the scheduled queue processing: wp cron event run newspack_premium_newsletters_access_check
4. After the cron job finishes, confirm that the reader is automatically added to the restricted lists.
5. Remove the reader from one of the restricted lists (you can do this directly in the ESP, or by clicking on the unsubscribe link in an email delivered to the reader).
6. As an admin, trigger a renewal for the reader's subscription.
7. After the renewal completes, trigger the cron job to process the queue again.
8. After the cron job finishes, confirm that the reader was NOT automatically re-added to the list they were unsubscribed from at the time the renewal started.
9. As an admin, manually update the reader's subscription to "on hold" status and then back to "active" status.
10. Run the cron job again and confirm that the reader is automatically re-added to all restricted lists.

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully ran tests with your changes locally?

[Copilot]

Pull request overview

This PR refines Premium Newsletters’ auto-signup behavior during subscription renewals by snapshotting the reader’s current newsletter subscriptions at renewal start and using that snapshot to limit which restricted lists can be auto-added during the subsequent access check.

Changes:

• Cache the reader’s subscribed newsletter lists to user meta when a renewal attempt begins.
• Gate auto-signup during access checks so only lists present in that cached snapshot can be re-added, then clear the snapshot meta.
• Add a small in-request cache for premium newsletter gates (get_gates()).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.