Add private phone contact field to submissions (show_phone) [#288]

[dgershman]

Closes #288

Investigation finding (the maintainer's ask)

Case (c): the phone field did not exist anywhere. rg -i 'phone|contact_number|contact_phone|phone_number' across includes/, assets/js/src/, tests/, and templates/ returned only "megaphone" icon references. The two existing private contact fields were email and contact_name, so this PR adds phone as a sibling that mirrors the email field's private posture exactly.

What changed

A new private phone contact field on both the event and announcement submission forms.

• Hidden by default; opt-in per form. A new show_phone shortcode attribute (default false) gates the field — mirroring the existing show_flyer precedent (includes/Frontend.php render_event_form/render_announcement_form; consumed as settings.showPhone === 'true' in EventForm.js / AnnouncementForm.js). No field was optionally-visible before; this mechanism generalizes to future fields.
• Optional-required, independent of visibility. Phone becomes required only when an admin adds phone to the existing additional_required_fields attribute (same path as flyer). It is not added to defaultRequiredFields. email stays the hard-required field (it drives notifications) and is untouched.
• Stored privately. register_post_meta('mayo_event', 'phone', …) with the same auth_callback => current_user_can('edit_posts') gate as email (includes/Admin.php), persisted in EventsController::submit_event() (add_post_meta(..., 'phone', sanitize_text_field($params['phone'] ?? ''))) and in the announcement controller. Shown to admins in the event editor's existing "Contact Information (Private)" sidebar panel (EventBlockEditorSidebar.js) and included in the submission/publish notification emails.

"Not displayed publicly" — verified

Phone is never added to EventsController::format_event() (the public event formatter) or to any public template / EventDetails.js — the same exclusion that keeps email/contact_name private today. The only places it surfaces are the auth-gated admin sidebar and the notification emails to organizers. The auth_callback on the registered meta keeps it out of unauthenticated REST.

Required enforcement note

There is no per-field server-side hard rejection for any field in this plugin (none exists for email either) — required-ness is enforced client-side via the missingFields check plus the conditional HTML required attribute, and the REST endpoint cannot know a given form instance's shortcode config. Phone follows that same model: it's marked required in the form when configured, and the endpoint sanitizes-and-stores. This was an explicit product decision by the maintainer (phone as an optional/configurable required field; keep email as the locked one).

Tests

composer test → OK (528 tests, 1185 assertions). New EventsControllerTest cases assert the phone meta is stored when provided and that submission still succeeds when phone is omitted (optional-by-default). npm run build compiles cleanly.

Scope

Covers both the event and announcement submission forms (both are "submissions" sharing the identical private-contact pattern). Shortcode docs (ShortcodesDocs.js), the readme.txt changelog, and the translation POT were updated.

🤖 Generated with Claude Code