Optimize and align validate_object methods across handlers

[obenland]

Also fixes a potential fatal error for Undo activities from brid.gy.

Proposed changes:

• Optimize validate_object methods in Accept, Create, Reject, Undo, and Quote_Request handlers for better performance
• Replace expensive array_diff() + array_keys() operations with direct isset() checks
• Simplify object validation logic from empty() || !is_array() to !isset() || !is_array()
• Remove unnecessary is_wp_error() checks (request parameter is always WP_REST_Request in actual usage)
• Rename $json_params to $activity for improved code readability
• Align validation patterns across all handlers for consistency

Other information:

• Have you written new tests for your changes, if applicable?

All existing tests pass. Removed one obsolete test that was checking for an impossible scenario (WP_Error as request object).

Testing instructions:

• Run npm run env-test to verify all PHP tests pass
• Verify that inbox validation still works correctly by sending various ActivityPub activities to the inbox

Changelog entry

[Copilot]

Pull Request Overview

This PR optimizes and standardizes the validate_object methods across ActivityPub handlers to improve performance and code consistency.

• Replaces inefficient array_diff() + array_keys() operations with direct isset() checks for better performance
• Removes unnecessary is_wp_error() checks since the request parameter is always WP_REST_Request in practice
• Renames $json_params to $activity for improved readability and consistency across handlers

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
includes/handler/class-accept.php	Optimizes validation logic with isset() checks and removes WP_Error handling
includes/handler/class-create.php	Streamlines object validation and removes unnecessary WP_Error check
includes/handler/class-quote-request.php	Simplifies required field validation and removes WP_Error handling
includes/handler/class-reject.php	Optimizes validation with direct isset() checks
includes/handler/class-undo.php	Replaces array operations with isset() and adds object type validation
includes/rest/class-inbox-controller.php	Updates PHPDoc to correctly specify WP_REST_Request type
includes/rest/class-actors-inbox-controller.php	Updates PHPDoc to correctly specify WP_REST_Request type
tests/includes/handler/class-test-quote-request.php	Removes obsolete test for WP_Error scenario that can no longer occur

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[pfefferle]

Can we first merge #2284 and then have your changes afterwards? My PR adds support for URI-Objects at least for Likes and Announces.

[pfefferle]

Remove unnecessary is_wp_error() checks (request parameter is always WP_REST_Request in actual usage)

The signature verification returns a WP_Error

wordpress-activitypub/includes/rest/class-server.php

Line 74 in 41efe96

return new \WP_Error(

does that have no impact on the validate_object verification?

[pfefferle]

Ok, $request is always a WP_REST_Request. Is the signature verification called afterwards? Is there a way to run the signature verification earlier? We would save some time/resources then, because we wouldn't have to trigger the validate_object at all.

[obenland]

We could move it to rest_pre_dispatch but at that point the request has not been matched with a handler yet, so would run for every REST API request. Currently every endpoint that needs signature verification specifies it for itself, which we would lose, too.

FWIW, I don't think it's a big deal, eventually a request has to pass all of these tests anyway.

[pfefferle]

Then let's keep it as is!

[pfefferle]

I think it is fine to merge (when the conflicts are resolved), I will update the validation callback through #2295 then.