# Requirements Review - 2026-04-23

## Scope
- Reviewed files under `requirements/` against current implementation in `feca_mailshots_plugin/`.

## Findings

### 1) High: Packaging script requirement not implemented
- Requirement:
  - `requirements/environment.md` states `scripts/` must contain a packaging script that creates an uploadable WordPress plugin package.
  - Reference: `/home/adrians/persistent/nosnap/development/mailshots-plugin/requirements/environment.md:62`
- Current implementation:
  - `scripts/` currently contains:
    - `cleanup_testing_artefacts.sh`
    - `deploy_remote.sh`
    - `mysql_tunnel.sh`
    - `run_fixture_server.sh`
    - `sql/`
  - No packaging script is present.
- Gap:
  - Requirement is unmet.

### 2) High: Data source REST capability split requirement not implemented
- Requirement:
  - Data source API auth/capabilities require:
    - create/update/delete => management capability (e.g. `manage_mailshots`)
    - read/preview/validate => read capability (e.g. `read_mailshots`)
  - References:
    - `/home/adrians/persistent/nosnap/development/mailshots-plugin/requirements/mailshot_data_source.md:427`
    - `/home/adrians/persistent/nosnap/development/mailshots-plugin/requirements/mailshot_data_source.md:428`
- Current implementation:
  - `DataSourcesAdminPage` defines one capability only:
    - `private const CAPABILITY = 'edit_pages';`
    - `/home/adrians/persistent/nosnap/development/mailshots-plugin/feca_mailshots_plugin/src/Admin/DataSourcesAdminPage.php:13`
  - Both REST permission callbacks use the same capability:
    - `restCanRead()` -> `currentUserCan(self::CAPABILITY)`
      - `/home/adrians/persistent/nosnap/development/mailshots-plugin/feca_mailshots_plugin/src/Admin/DataSourcesAdminPage.php:584`
    - `restCanManage()` -> `currentUserCan(self::CAPABILITY)`
      - `/home/adrians/persistent/nosnap/development/mailshots-plugin/feca_mailshots_plugin/src/Admin/DataSourcesAdminPage.php:589`
- Gap:
  - Requirement for separate read/manage capability model is unmet.

## Notes
- This review focused on direct, verifiable requirement-to-code mismatches.
- Files reviewed include:
  - `requirements/environment.md`
  - `requirements/mailshot_data_source.md`
  - `requirements/third_party_software.md`
  - `feca_mailshots_plugin/src/Admin/DataSourcesAdminPage.php`