[NO_TASK] Require network authority to change the network license key

[dpanta94]

Require network authority to change the network license key on multisite. Any site administrator could send network=true to POST or DELETE /liquidweb/harbor/v1/license and replace or remove the key every subsite uses; those requests now also need manage_network_options. Also bumps Harbor to 2.0.2.

Ticket: none — found in a whole-codebase review. Needs a ticket or a NO_TASK decision.

Reproduce (multisite)

1. Log in as a subsite administrator (not a super admin).
2. POST /wp-json/liquidweb/harbor/v1/license with a valid key and network=true.
3. Before: 200, and the network key changes for every site. Now: 403, and the key is unchanged. DELETE with network=true behaves the same.

Site-level key changes and single-site installs are unchanged.

Proof and coverage

Covered by the new tests/muwpunit/API/REST/V1/License_ControllerTest.php. Against the old controller it fails (200/204 where 403 is expected); with the fix it passes 4/4. muwpunit 17/17 passes. wpunit 935/938 passes; the 3 Feature_ResourceTest failures also fail on main in this slic stack. PHPStan, phpcs and the PHP 7.4 check are clean. Not yet QA'd in a browser.

Changelog entry is in changelog/; changelog.txt is left for release prep.

AI usage: Drafted with Claude Opus 5.5. I reviewed and tested every change — this is my work and I am accountable for it.

Summary by CodeRabbit

• Bug Fixes
  • Network-wide license keys can now be stored or deleted only by callers with network-level management permissions. Site administrators who attempt these changes receive a 403 response; site-level license key changes remain available to administrators.
• Documentation
  • Updated the license API documentation to clarify the permissions required for network-wide key changes and the response for unauthorized requests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 3a0605fd-b0ef-4501-bfd0-7ee08e59767a

📥 Commits

Reviewing files that changed from the base of the PR and between 6fcc5ca and 2ee2463.

📒 Files selected for processing (5)

• changelog/fix-network-license-key-permission.yaml
• docs/api/rest/license.md
• src/Harbor/API/REST/V1/License_Controller.php
• src/Harbor/Harbor.php
• tests/muwpunit/API/REST/V1/License_ControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

The license-key POST and DELETE routes now check network-level permissions on multisite. Tests cover site and network key requests by site administrators and super administrators. The API documentation, changelog, and version reflect the change.

Changes: Network license-key permissions

Layer / File(s)	Summary
Network key write permissions src/Harbor/API/REST/V1/License_Controller.php, tests/muwpunit/API/REST/V1/License_ControllerTest.php, docs/api/rest/license.md, changelog/fix-network-license-key-permission.yaml, src/Harbor/Harbor.php	The POST and DELETE routes require manage_options. On multisite requests with network=true, the routes also require manage_network_options. Tests cover site administrator denials for network-key writes and deletes, site-key storage, and super administrator network-key writes and deletes. The API documentation and changelog describe the permission requirement. The version changes to 2.0.2.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 2ee24

The permission change appears ready to merge after normal checks; no actionable merge-blocking risk is established by the supplied evidence.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: requiring network authority to modify the network license key.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 3 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}