Pronamic Pay Icons

WordPress icon collection for Pronamic Pay payment assets.

This standalone plugin registers the stable pronamic-pay icon collection with the public Icon API introduced in WordPress 7.1. The collection uses the payment method SVG files from pronamic/wp-pay-logos as its canonical source.

Requirements

• WordPress 7.1 or newer.
• PHP 8.1 or newer.
• Composer 2.

On older WordPress versions the plugin stays inactive because the public Icon API functions are not available.

Installation

Install dependencies and place the complete directory in wp-content/plugins:

composer install --no-dev --classmap-authoritative

Then activate Pronamic Pay Icons in WordPress.

For Composer-managed WordPress installations:

composer require pronamic/pronamic-pay-wp-icons

Composer-managed WordPress installations normally load the project autoloader before plugins. Standalone plugin builds must retain this plugin's vendor directory.

Usage

1. Open the block editor.
2. Insert the Core Icon block.
3. Open the icon picker and select the Pronamic Pay collection.
4. Search for and select a payment method.

Names are stable and namespaced, for example pronamic-pay/ideal, pronamic-pay/bancontact, and pronamic-pay/other-iban. Payment method slugs remain unchanged; assets from upstream's dist/other directory use an other- prefix to prevent collisions. Icons can also be rendered in PHP with the WordPress wp_get_icon() function:

echo wp_get_icon( 'pronamic-pay/ideal' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped

The SVG returned by wp_get_icon() is sanitized by WordPress. It is safe to print directly and should not be escaped again.

Asset policy

WordPress 7.1 sanitizes Icon API SVGs to svg, path, and polygon elements with a small fill-oriented attribute allowlist. In particular, it removes stroke, style, groups, gradients, masks, and basic shapes. Passing the upstream files through unchanged can therefore remove colors and geometry.

The tracked files in assets/icons and src/IconCatalog.php are generated build artifacts, not manually maintained copies. The build discovers one canonical 640×360 SVG for every icon directory in both dist/methods and dist/other in the Composer-installed pronamic/wp-pay-logos package. It does not derive slugs from filename prefixes. Ambiguous variants are selected by explicit, reviewed overrides; unknown ambiguity, invalid paths, duplicate slugs, missing directories, and unreadable or invalid SVGs stop the update with an error.

The converter resolves SVG styles, transforms, masks, shapes, and gradients, and outlines strokes while respecting stroke width, cap, join, and miter limit. Gradients are represented by color-preserving fill bands. It then compares rendered source and output pixels and fails on excessive visual drift. Generated files contain only WordPress-compatible fill geometry.

At runtime, files are canonicalized inside assets/icons, parsed with external entities disabled, and validated against the WordPress 7.1 allowlist before their sanitized content is registered. Missing, unreadable, oversized, or unexpected SVG markup is skipped.

The initial scope is intentionally limited: it does not fork the Icon block, add Premium-only integration, or filter icons based on active payment methods.

Development

composer install
bin/update-icons
composer update-icons
composer lint
composer phpcs
composer test
composer check
wpenv start

Use the following workflow in a fresh development checkout:

composer install
bin/update-icons
npm test

To update the upstream icon library and regenerate all derived output, always run:

composer update pronamic/wp-pay-logos --with-dependencies
bin/update-icons
npm test
composer test

bin/update-icons verifies that the Composer-installed source directory exists, installs the locked Node.js build dependencies with npm ci, normalizes every discovered SVG, and deterministically rewrites assets/icons and src/IconCatalog.php. composer update-icons and the backwards-compatible composer build-icons alias run the same command. Commit the updated composer.lock, generated catalog, and generated SVGs together. Production installs do not require Node.js or pronamic/wp-pay-logos.

The wp-env lifecycle installs the Composer dependencies immediately after the environment starts, before browser or API checks load the plugin. This is required because the plugin's autoloaded classes are provided through Composer.

The test suite verifies method and other discovery (including filenames without a method prefix), slug and label generation, duplicate and invalid input errors, stroke-based and existing fill-only sources, color retention, the strict runtime sanitizer, and all catalog entries. CI regenerates output and runs linting, phpcs, Node tests, and PHPUnit on supported PHP versions.

License

GPL-2.0-or-later.