feat(tags): hide private tags in RSS feeds, settings, and reader data

[wil-gerken]

Follow-up to the original Private Tags feature (#4507), continuing NPPD-780. Private Tags let editors mark a tag as "private" so it's hidden from readers while still working normally behind the scenes. This PR closes the last few spots where private tags could still slip through, and adds the test coverage the feature originally shipped without.

What this does

• Partner RSS feed editor — private tags now show a "(private)" label when editors pick tags for a Custom/Partner RSS feed, so it's clear which ones are hidden from the public. (NPPD-1461)
• RSS feeds — private tags no longer appear in the tag lists of any RSS feed (the main site feed, category and author feeds, and Custom/Partner feeds), closing a spot where private tag names could still leak. (NPPD-1462)
• A new setting — "Remove private tags from RSS feeds" under Settings → Advanced Settings, so publishers can turn that behavior on or off. (NPPD-1463)
• Reader data — private tags are stripped from the behind-the-scenes data Newspack sends to the reader's browser, so a curious visitor can't uncover a private tag by inspecting the page. Always on. (NPPD-1464)
• Tests — full PHPUnit coverage for the whole Private Tags feature. (NPPD-1465)

Everything stays behind the existing NEWSPACK_PRIVATE_TAGS_ENABLED flag.

How to test

1. Turn on the flag: define( 'NEWSPACK_PRIVATE_TAGS_ENABLED', true );
2. Mark a tag private and add it to a post.
3. Check a feed (/feed/ or a partner feed) — the private tag isn't listed. Toggle "Remove private tags from RSS feeds" off → it reappears.
4. In the Partner RSS feed editor, private tags show "(private)" in the tag picker and on saved tags.
5. View a post's page source — the private tag's ID isn't in the reader data.
6. n test-php --group private-tags → green (79 tests).

A couple of notes for reviewers

• There are two separate RSS settings on purpose: "Disable private tag RSS feeds" turns off a private tag's own dedicated feed (a 404), while "Remove private tags from RSS feeds" keeps private tags out of the tag lists in every other feed.
• The feed filter hooks get_the_terms (which runs broadly), but exits immediately on anything that isn't a feed request for a post tag, so it stays off the normal page-load path.
• The reader-data filter is intentionally always-on — there's no setting because a private tag should never reach the browser.

Tickets: NPPD-780 (parent), NPPD-1461–1465.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Follow-up to the original Private Tags feature that closes the remaining surfaces where private tag names/IDs could leak (RSS <category> lists, partner-RSS editor labels, reader-activity client data), introduces a new feed_terms setting and a shared label-appender helper, and adds comprehensive PHPUnit coverage for the whole feature.

Changes:

• Add filter_feed_terms (hooked on get_the_terms, gated by taxonomy + is_feed() + new feed_terms setting) and filter_reader_activity (always-on under the feature flag) in Private_Tags; extract a shared maybe_append_private_label helper used by REST and the Partner RSS editor.
• Wire the new helper into the RSS module's selected-tag chips and AJAX term search, and add the feed_terms key to default settings, the TS AdvancedSettings type, and the Private Tags toggles UI (with refreshed copy).
• Add a Private_Tags_Test_Helper trait and four new test classes covering core behavior, RSS <category> stripping, reader-activity stripping, and Partner-RSS labeling.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
plugins/newspack-plugin/includes/tags/class-private-tags.php	Adds maybe_append_private_label, filter_feed_terms, filter_reader_activity, the feed_terms default, and registers the new hooks.
plugins/newspack-plugin/includes/optional-modules/class-rss.php	Uses the shared helper to label selected tag chips and AJAX search results for post_tag; notes that feed-term filtering happens globally.
plugins/newspack-plugin/src/wizards/newspack/views/settings/advanced-settings/private-tags.tsx	Adds the "Remove private tags from RSS feeds" toggle and updates label copy.
plugins/newspack-plugin/src/wizards/newspack/views/settings/theme-mods.d.ts	Adds feed_terms: boolean to AdvancedSettings.
plugins/newspack-plugin/tests/unit-tests/tags/traits/trait-private-tags-test-helper.php	New shared trait for enabling the flag, resetting static state, and creating private/public tags.
plugins/newspack-plugin/tests/unit-tests/tags/test-private-tags.php	Core Private_Tags behavior matrix (flag, settings, label, cache, archives, classes, GAM, Yoast, REST, admin column, term_name).
plugins/newspack-plugin/tests/unit-tests/tags/test-private-tags-rss.php	Coverage for filter_feed_terms including guards, behavior gating, and an end-to-end the_category_rss integration check.
plugins/newspack-plugin/tests/unit-tests/reader-activity/test-reader-data-private-tags.php	Coverage for filter_reader_activity including always-on behavior and hook registration.
plugins/newspack-plugin/tests/unit-tests/optional-modules/test-rss-private-tags.php	Coverage for Partner-RSS AJAX search labeling and selected-chip rendering.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.