JavaScript API and Events

The plugin’s public JavaScript is located in public/js/buddypress-status-public.js. It is enqueued only on BuddyPress pages (activity directory, members directory, groups, and user profiles) and depends on jQuery.

---

Localized Object: bpsts_ajax_object

When the script is enqueued, WordPress passes a global object called bpsts_ajax_object via wp_localize_script. It is available as window.bpsts_ajax_object.

window.bpsts_ajax_object = {
    ajax_url:        '/wp-admin/admin-ajax.php',  // admin-ajax.php URL
    ajax_nonce:      '...',                        // wp_create_nonce('bpsts_ajax_security')
    char_left_txt:   'characters left',            // Translatable
    cnf_del_txt:     'Are you sure you want to delete this status?',  // Translatable
    add_status_text: 'Add a status',               // Translatable
    current_user_id: 1,                            // Logged-in user ID
    active_template: 'twentytwentythree',          // BP theme package ID (_bp_theme_package_id option)
    buddyboss:       false                         // Boolean — true when BuddyBoss is active
};

All AJAX calls use ajax_url and ajax_nonce from this object. Do not hardcode the admin-ajax URL or generate your own nonce for calls to the plugin’s endpoints.

---

AJAX Actions

Five AJAX actions are registered. All require wp_ajax_* (i.e., the user must be logged in). No wp_ajax_nopriv_* equivalents exist — guests cannot interact with statuses.

All calls use POST and must include ajax_nonce equal to bpsts_ajax_object.ajax_nonce. The nonce verifies against the action 'bpsts_ajax_security'.

bpsts_add_status

Saves a new status entry to bpsts_saved_status user meta.

POST fields:

Field	Required	Notes
action	Yes	'bpsts_add_status'
bpsts_status	Yes	Status text. Max BPSTS_STATUS_MAX_LENGTH (140) chars.
user_id	Yes	Must match the logged-in user’s ID.
setcurrent	No	Any truthy value marks this status as the current/active one.
ajax_nonce	Yes	From bpsts_ajax_object.ajax_nonce.

Response: On success, the handler echoes an HTML <tr> containing the new status row (via buddypress_status_render_user_status_row()) and calls wp_die(). The JS prepends this row to .bpsts-statuses-table. If setcurrent is truthy, the page reloads after insertion.

On error, wp_send_json_error() is called with a descriptive message string.

Rate limit: 10 add-status actions per 60 seconds per user.

---

bpsts_update_status

Replaces the text of an existing saved status.

POST fields:

Field	Required	Notes
action	Yes	'bpsts_update_status'
bpsts_status	Yes	New status text.
user_id	Yes	Must match logged-in user.
status_id	Yes	The status-{timestamp} key to update.
ajax_nonce	Yes

Response: No body — the handler calls wp_die() with no output. The JS performs its own DOM update by setting .bpsts-status-div text to the new value and then reloading the page. Not rate-limited.

---

bpsts_delete_status

Removes a status entry from bpsts_saved_status. If the deleted status was the active one, bpsts_current_status is also cleared.

POST fields:

Field	Required	Notes
action	Yes	'bpsts_delete_status'
user_id	Yes	Must match logged-in user.
status_id	Yes	The status-{timestamp} key to delete.
ajax_nonce	Yes

Response: No body content — the JS removes the row from the DOM directly after a successful call. Rate-limited under status_actions (20/60s).

---

bpsts_current_status

Sets a saved status as the active/current status.

POST fields:

Field	Required	Notes
action	Yes	'bpsts_current_status'
user_id	Yes	Must match logged-in user.
status_id	Yes	The status-{timestamp} key to activate.
ajax_nonce	Yes

Response: No body — the JS triggers a page reload after the call to reflect the active status in the profile header. Not rate-limited.

---

bpsts_update_icon_status

Saves the user’s selected emoji to bpsts_user_icon user meta.

POST fields:

Field	Required	Notes
action	Yes	'bpsts_update_icon_status'
userid	Yes	Must match logged-in user.
unicode	Yes	Emoji slug (e.g. 'slightly-smiling-face').
name	Yes	Display name (e.g. 'Happy').
category	Yes	One of the nine allowed categories (see Database Schema).
ajax_nonce	Yes

Response: Calls wp_die() with no output on success. wp_send_json_error() on validation failure (invalid category, user mismatch, or feature disabled).

---

DOM Selectors and Behavior

The JavaScript attaches delegated event listeners to document, so dynamically inserted elements work without re-initialization.

Selector	Trigger	Effect
.bpsts-add	click	Submits bpsts_add_status AJAX call
.bpsts-del-status	click	Submits bpsts_delete_status AJAX call
.bpsts-current-status (link)	click	Submits bpsts_current_status AJAX call
.bpsts-edit-status	click	Reveals inline edit field for the row
.bpsts-update	click	Submits bpsts_update_status AJAX call
.bpsts-emoji-trigger	click	Opens the emoji picker popup
.bpsts-emoji-picker-close	click	Closes the emoji picker
.bpsts-emoji-item	click	Inserts emoji into the status textarea
.bpsts-emoji-search	keyup	Filters the emoji grid
.bpsts-suggestion	click	Fills the textarea with a global-status suggestion
.bpstatus-icon	click	Opens the icon/emoji selection dialog
.bp-status-feeling-list-item	click	Selects a mood emoji
.bp-status-feeling-activities-list-item	click	Selects a feeling activity
.bp-status-list-submit-button	click	Submits the feeling/activity selection

Character Counter

#bpsts-charleft is updated on every keyup event on #bpsts-status. The displayed count uses bpsts_ajax_object.char_left_txt as the unit label. No hard block is applied in JavaScript — the length check is enforced server-side.

If the textarea is empty on submit, the class bpsts-empty-status is added to #bpsts-status and #bpsts-error-message is shown.

---

Activity Stream Integration

When the plugin is active, a status form widget is injected into the BuddyPress activity post form via the bp_activity_post_form_options hook (or equivalent Youzify hooks). The JS listens for keyup on #bp-status-feeling and #bp-status-feeling-activities to filter feeling items as the user types.

On bp_ajax_request (fired by BuddyPress after an AJAX activity post), the script re-runs initialization logic so the status form works correctly after activity stream AJAX reloads.

---

Security Notes

• The nonce action is 'bpsts_ajax_security'. The nonce is created fresh on each page load and passed to JS — do not cache pages that include it without proper nonce refresh.
• All AJAX handlers call check_ajax_referer( 'bpsts_ajax_security', 'ajax_nonce' ) before any data processing.
• User ID ownership is checked server-side: get_current_user_id() != $user_id returns a JSON error. Passing another user’s ID from JavaScript is rejected.