AJAX endpoints

All read-only. Both authed (wp_ajax_*) and guest (wp_ajax_nopriv_*) variants registered. No nonces required.

Endpoints

Action	Params	Response
dankcave_quickview	product_id (GET)	{ html } — QuickView modal contents
dankcave_search_suggest	q (GET, min 2 chars)	{ html, total } — search results
dankcave_recently_viewed	ids (CSV, GET)	{ html } — product-card grid
dankcave_wishlist_cards	ids (CSV, GET)	{ html } — wishlist product-card grid
dankcave_compare_thumbs	ids (CSV, GET)	{ html } — compare tray thumbs
dankcave_compare_table	ids (CSV, GET)	{ html } — compare modal table
dankcave_cart_crosssells	(uses session cart)	{ html, count } — cross-sell rail

URL structure

All endpoints hit wp-admin/admin-ajax.php?action={action}&....

The client is expected to pick up the URL from window.dcAjax.url, which the theme localizes:

window.dcAjax = { url: 'https://dankcave.com/wp-admin/admin-ajax.php', nonce: '...' };

Sample invocations

Search suggest:

curl 'https://dankcave.com/wp-admin/admin-ajax.php?action=dankcave_search_suggest&q=dab'

Recently viewed:

curl 'https://dankcave.com/wp-admin/admin-ajax.php?action=dankcave_recently_viewed&ids=16111,16440,16946'

Cart cross-sells (relies on session cookie for cart context):

curl -b cookies.txt 'https://dankcave.com/wp-admin/admin-ajax.php?action=dankcave_cart_crosssells'

Response format

All return JSON:

{
  "success": true,
  "data": {
    "html": "<article class=\"product-card\">...</article>"
  }
}

On failure:

{ "success": false, "data": { "message": "Product not found" } }

Consuming from client JS

fetch(window.dcAjax.url + '?action=dankcave_search_suggest&q=' + encodeURIComponent(query))
  .then(r => r.json())
  .then(j => {
    if (!j.success) throw new Error('search failed');
    resultsEl.innerHTML = j.data.html;
  });

Extending — adding a new endpoint

1. Register in inc/woocommerce.php (or wherever the endpoint fits):

   add_action( 'wp_ajax_dankcave_my_endpoint',        'dankcave_ajax_my_endpoint' );
   add_action( 'wp_ajax_nopriv_dankcave_my_endpoint', 'dankcave_ajax_my_endpoint' );
   function dankcave_ajax_my_endpoint() {
       $query = isset( $_GET['q'] ) ? sanitize_text_field( wp_unslash( $_GET['q'] ) ) : '';
       // ... work ...
       wp_send_json_success( array( 'html' => '...', 'meta' => 42 ) );
   }

2. Escape output — every dynamic value should pass through esc_html(), esc_attr(), esc_url().

3. Add a nonce if the endpoint mutates state:

   check_ajax_referer( 'dankcave-my-nonce', '_nonce' );

   And on the client:

   fetch(url + '&_nonce=' + window.dcAjax.nonce)

4. Test with curl before wiring up JS.