plugins/woocommerce/src/Internal/FraudProtection/FraudProtectionController.php (1)

163-170: Add missing @since annotation and return type hint.

Per coding guidelines, the @since annotation should be included with the current WooCommerce version. Additionally, for consistency with feature_is_enabled(), consider adding the bool return type hint.

♻️ Suggested improvement

 	/**
 	 * Check if the fraud protection is enabled and should track events for the current user.
 	 *
+	 * `@since` 10.5.0
+	 *
 	 * `@return` bool True if fraud protection should track events for the current user, false otherwise.
 	 */
-	public function should_track() {
+	public function should_track(): bool {
 		return $this->feature_is_enabled() && ! current_user_can( 'manage_woocommerce' );
 	}

plugins/woocommerce/src/Internal/FraudProtection/FraudProtectionDispatcher.php (1)

94-105: Log message could be more accurate.

The debug log message says "feature disabled" but should_track() now returns false for two reasons: (1) feature is disabled, or (2) user is an admin. Consider updating the message for better debugging clarity.

♻️ Suggested improvement

 			// Check if feature is enabled - fail-open if not.
 			if ( ! $this->fraud_protection_controller->should_track() ) {
 				FraudProtectionController::log(
 					'debug',
 					sprintf(
-						'Fraud protection event not dispatched (feature disabled): %s',
+						'Fraud protection event not dispatched (tracking disabled or admin user): %s',
 						$event_type
 					),
 					array( 'event_type' => $event_type )
 				);
 				return;
 			}

plugins/woocommerce/includes/class-wc-ajax.php (1)

380-384: Avoid double container lookups in the tracking block (minor perf/readability).

Cache FraudProtectionController/CheckoutEventTracker locally to avoid multiple wc_get_container()->get(...) calls in the same hot path.

Proposed diff

 		// Track checkout field update for fraud protection.
-		if ( wc_get_container()->get( FraudProtectionController::class )->should_track() ) {
-			wc_get_container()->get( CheckoutEventTracker::class )
-				->track_shortcode_checkout_field_update( isset( $_POST['post_data'] ) ? wp_unslash( $_POST['post_data'] ) : '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-		}
+		$fraud_protection = wc_get_container()->get( FraudProtectionController::class );
+		if ( $fraud_protection->should_track() ) {
+			$checkout_event_tracker = wc_get_container()->get( CheckoutEventTracker::class );
+			$checkout_event_tracker->track_shortcode_checkout_field_update( isset( $_POST['post_data'] ) ? wp_unslash( $_POST['post_data'] ) : '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+		}

plugins/woocommerce/src/StoreApi/Utilities/CartController.php (1)

228-232: LGTM: correct gating for “don’t track admins”; consider caching container resolves.

Proposed diff

 		// Track cart event for fraud protection.
-		if ( $product instanceof \WC_Product && wc_get_container()->get( FraudProtectionController::class )->should_track() ) {
-			wc_get_container()->get( CartEventTracker::class )
-				->track_cart_item_added( $cart_id, $this->get_product_id( $product ), (int) $request_quantity, $this->get_variation_id( $product ) );
-		}
+		if ( $product instanceof \WC_Product ) {
+			$fraud_protection = wc_get_container()->get( FraudProtectionController::class );
+			if ( $fraud_protection->should_track() ) {
+				$cart_event_tracker = wc_get_container()->get( CartEventTracker::class );
+				$cart_event_tracker->track_cart_item_added( $cart_id, $this->get_product_id( $product ), (int) $request_quantity, $this->get_variation_id( $product ) );
+			}
+		}