Comments email links don't make sense post-untangling

[dsas]

Context and steps to reproduce

A customer has noted that the links in the "new comment awaiting approval" email don't work.

Under Calypso, using the Approve / Bin / Mark as spam links in the email, immediately did just that (and allowed you to interact with the comment).

With untangling, the email links go to Calypso and them immediately redirect to wp-admin's edit comment screen. You can Approve / Bin / Mark as spam, but it's a manual action after following the email links.

Email	Calypso	wp-admin

Reproduction steps

0. Opt yourself into the treatment group of the experiment
1. Create a post/page on a blog you own
2. Set the site to moderate all comments (Settings → Discussion → Comment must be manually approved)
3. As a separate user leave a comment
4. As the original user you will get an email, with the moderation options
5. Click one of the links

Site owner impact

More than 60% of the total website/platform users

Severity

Minor

What other impact(s) does this issue have?

No response

If a workaround is available, please outline it here.

The email links all go to the edit comment screen where you can manually choose a status for the comment and then press update.

Platform

No response

[dsas]

I think the most practical thing to do here might be to change the email links so there's just one "Moderate comment" link. We'd probably have to change that for all users, inside the hold-out or not, because I imagine the email is sent in context of the commentor, and so getting the control/treatment for the email recipients might be tricky.

[github-actions]

OpenAI suggested the following labels for this issue:

• [Feature Group] User Interaction & Engagement: The issue relates to how users engage with comment approval links in emails.
• [Feature] Comments: The problem directly affects the comment management feature, as the email links lead to the comment approval process.

[dsas]

Links:
p7DVsv-m73-p2#comment-52350 / 9346927-zd-a8c

[github-actions]

Support References

This comment is automatically generated. Please do not edit it.

• 9346927-zen
• 9404664-zen

[supernovia]

📌 ACTIONS

• Triaged

Thanks Dean; agreed that changing the email link would be easiest unless there's a way to make the links work with wp-admin.

[mmtr]

getting the control/treatment for the email recipients might be tricky.

It's not trivial, but not very complex since emails are sent from a simple site context, so we could do something like this in the email-overrides.php file:

$forced_assignment = get_user_option( RDV_EXPERIMENT_FORCE_ASSIGN_OPTION, $user->ID );
if ( false !== $forced_assignment ) {
  $should_link_to_wpadmin = 'treatment' === $forced_assignment;
} else {
  $should_link_to_wpadmin = 'treatment' === \ExPlat\get_user_assignment( 'calypso_post_onboarding_holdout_160125', $user );
}

if ( $should_link_to_wpadmin ) {
  html_email_set_template_var( 'approve_link', "https://{$site_slug}/wp-admin/edit-comments.php?comment_status=moderated" );
} else {
  html_email_set_template_var( 'approve_link', "https://wordpress.com/comment/{$site_slug}/{$comment->comment_ID}?action=approve" );
}

The above is based on the wpcom_is_duplicate_views_experiment_enabled function which we cannot re-use here because it only works for get_current_user_id()).

[radtechgh]

9404664-zen

[taipeicoder]

I've created 173555-ghe-Automattic/wpcom basing on @mmtr's approach. There are a couple of areas for discussion that would be good to get y'all's opinions:

As @dsas asked, is it worth to keep the Calypso experience for the control group? Or we can simplify by landing everyone in wp-admin?

I'm not sure the action buttons Approve, Trash, and Mark as spam translates in the context of wp-admin, as they are accompanied by a nonce. That would leave us with two choices:

1. Landing users in /wp-admin/edit-comments.php?comment_status=moderated, to see the list of comments waiting for approval
2. Landing users in /wp-admin/comments?action=editcomment&c=:commentId, to edit the comment

The PR uses approach 2 taking into consideration that the user might have a lot of commented waiting for moderation. Thus, for RDV treatment group users, they would only see one action button: Manage. Is there a better label for this action?

---

Another approach would be to look into the routes:

• https://wordpress.com/comment/:domain/:commentId?action=approve
• https://wordpress.com/comment/:domain/:commentId?action=trash
• https://wordpress.com/comment/:domain/:commentId?action=spam

And see if they can be updated to do the actions first and then redirect to wp-admin. I'm not sure if this is a good approach since it would mean that we are untangled to these routes.

[dsas]

Thus, for RDV treatment group users, they would only see one action button: Manage. Is there a better label for this action?

Maybe "Manage comment" or "Moderate comment" ?

Another approach would be to look into the routes [...] And see if they can be updated to do the actions first and then redirect to wp-admin.

@Automattic/t-rex had the same idea on Tuesday but we too harboured some doubts about it

[rcrdortiz]

Thus, for RDV treatment group users, they would only see one action button: Manage. Is there a better label for this action?

Maybe "Manage comment" or "Moderate comment" ?

Another approach would be to look into the routes [...] And see if they can be updated to do the actions first and then redirect to wp-admin.

@Automattic/t-rex had the same idea on Tuesday but we too harboured some doubts about it

I just wanted to elaborate on what we talked about. We had discussed the possibility of having a Calypso link handle actions like deleting or approving, and then redirecting the user to the corresponding wp-admin page. The core idea is that Calypso already has the necessary context and authentication (since the user is logged in), so it can serve as a convenient proxy to perform these actions before sending the user to wp-admin. If we like this approach, we could run it by the Architecture group to see if it might be worth standardizing as a pattern across WPCom or if there are other approaches we should consider.

[dsas]

The core idea is that Calypso already has the necessary context and authentication (since the user is logged in),

It's not necessarily whether the user is logged-in - we can check that from wp-admin too, it's that CSRF protection works differently - wp-admin uses time-limited nonces and calypso does its own JWT-based magic (see e.g. p7H4VZ-54r-p2).

[dsas]

Given @taipeicoder's PR is 90% done, my inclination would be to finish and merge it, while simultaneously opening a wider discussion into a more convenient ux as @rcrdortiz mentions.

[taipeicoder]

Given @taipeicoder's PR is 90% done, my inclination would be to finish and merge it, while simultaneously opening a wider discussion into a more convenient ux as @rcrdortiz mentions.

Sounds good, I think the PR is mostly there so feel free to commandeer and merge if it's missing some minor improvements.

[taipeicoder]

Closing via merging 173555-ghe-Automattic/wpcom.