Add throttled VIP Search query observability

[rinatkhaziev]

Summary

• Surface customer-visible warnings for slow and unbounded VIP Search queries after successful backend search requests.
• Emit a stable machine-readable warning followed by a human-readable explanation with sanitized URL or process source and customer-code origin.
• Deduplicate using the full normalized query-family hash and violation set, with configurable threshold, window, and site budget plus fail-closed persistent-cache throttling.
• Keep runtime values out of family identity while preserving query operators, searched fields, structural options, and ordered sort behavior.

Changelog description

Enterprise Search now emits throttled, customer-visible warnings after successful Elasticsearch requests when a query takes longer than 200 ms or does not contain a limiting condition. Each occurrence produces a stable machine-readable entry and a human-readable explanation containing the originating URL and customer-code location. Similar query families are deduplicated for five minutes, with up to five warning pairs emitted per site during that window.

The defaults can be adjusted with these filters:

add_filter( 'vip_search_slow_query_threshold_ms', static fn(): int => 300 );
add_filter( 'vip_search_query_warning_dedupe_window_s', static fn(): int => 600 );
add_filter( 'vip_search_query_warning_budget', static fn(): int => 10 );

• vip_search_slow_query_threshold_ms: defaults to 200; accepts 1–5000.
• vip_search_query_warning_dedupe_window_s: defaults to 300; accepts 60–3600.
• vip_search_query_warning_budget: defaults to 5; accepts 1–100.

Invalid or out-of-range values fall back to their defaults. Warnings require a persistent object cache so throttling can be enforced safely.

Testing

• CI=1 ./bin/test.sh --filter '/Query_Classifier_Test|Query_Warning_Test|test__vip_search_query_warning/' — 45 tests, 91 assertions
• CI=1 ./bin/test.sh --filter Search_Test — 196 tests, 272 assertions, one existing skip
• npm run test:smoke
• npm run phplint
• PHPCS on all changed PHP files

Notes

Repository-wide npm run phpcs still reports the existing finfo_close() deprecation in files/class-api-client.php and its existing .claude/worktrees copy. Neither file is changed by this PR.

[Copilot]

Pull request overview

Adds query observability to VIP Search by emitting throttled, deduplicated warnings for slow and/or structurally unbounded Elasticsearch _search queries after successful responses, along with a stable machine-readable warning contract and accompanying unit tests.

Changes:

• Introduces Query_Classifier to derive a normalized “query family” structure and determine bounded vs unbounded scope.
• Introduces Query_Warning to throttle/dedupe warnings using persistent object cache and emit both technical + human-readable messages.
• Wires warning emission into Search::filter__ep_do_intercept_request() for successful _search requests and adds PHPUnit coverage for classifier and warning behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/search/includes/classes/test-class-search.php	Adds integration-style tests asserting warnings run only on successful _search requests and never affect the returned response.
tests/search/includes/classes/test-class-query-warning.php	Adds unit tests for message contract, sanitization, dedupe/window/budget behavior, and failure-closed cache behavior.
tests/search/includes/classes/test-class-query-classifier.php	Adds unit tests for scope classification and normalized family structure behavior.
search/search.php	Loads the new classifier + warning classes as part of the Search feature bootstrap.
search/includes/classes/class-search.php	Adds query_warning dependency and emits warnings on successful Elasticsearch _search responses.
search/includes/classes/class-query-warning.php	Implements throttled/deduplicated warning emission with stable IDs, sanitized source/origin detection, and message formatting.
search/includes/classes/class-query-classifier.php	Implements query scope detection and normalization for “query family” identity hashing.

[codecov]

Codecov Report

❌ Patch coverage is 93.69628% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.70%. Comparing base (3485e35) to head (3a3532f).
⚠️ Report is 67 commits behind head on develop.

Files with missing lines	Patch %	Lines
search/includes/classes/class-query-classifier.php	92.18%	10 Missing ⚠️
search/includes/classes/class-query-warning.php	95.26%	10 Missing ⚠️
search/search.php	0.00%	2 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #7114      +/-   ##
=============================================
+ Coverage      36.69%   37.70%   +1.00%     
- Complexity      5302     5469     +167     
=============================================
  Files            300      303       +3     
  Lines          21475    21870     +395     
=============================================
+ Hits            7881     8245     +364     
- Misses         13594    13625      +31     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rebeccahum]

Shoulddd we also truncate the URL to limit log size for requests containing unusually long query args?

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud