Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: restrict content-query by cap before pagination, filter hidden fields

Browse Source 
Review fix round 1: content-query now excludes posts/statuses the user
cannot edit before querying (author restriction without edit_others_posts,
status filtering by edit_private_posts/edit_published_posts) instead of
only dropping them after fetching, and rejects unknown field/taxonomy
filters. content-types' not-found hint only lists editable types.
PostPresenter skips Pods password fields and readonly protected meta.
Query input gains search/terms length limits.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-25 22:48:05 +02:00
co-authored by Claude Opus 5.5
parent d68e9b1f04
commit 0890e6f165
7 changed files with 268 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/WordPress/Content/PostPresenterTest.php
+22
View File
@@ -90,6 +90,28 @@ final class PostPresenterTest extends TestCase
self::assertStringContainsString('lit-divi-outline', $full['hints'][0]);
self::assertInstanceOf(stdClass::class, $full['terms']);
self::assertInstanceOf(stdClass::class, $full['fields']);
self::assertSame(Rev::of('<!-- wp:divi/section /-->'), $full['rev']);
}
public function testPasswordAndProtectedReadonlyMetaFieldsAreOmitted(): void
{
$this->stubLinks();
Functions\when('get_post_meta')->justReturn('');
Functions\when('get_post_thumbnail_id')->justReturn(0);
$password = new FieldDefinition('secret', 'Secret', 'password', 'pods', 'writable');
$protected = new FieldDefinition('_internal', 'Internal', 'string', 'meta', 'readonly');
$visible = new FieldDefinition('role', 'Funktion', 'string', 'pods', 'writable');
$source = Mockery::mock(FieldSource::class);
$source->expects('read')->once()->with(5, $visible)->andReturn('Leitung');
$schema = Mockery::mock(ContentSchema::class);
$schema->allows('taxonomies')->andReturn([]);
$schema->allows('fields')->andReturn(['secret' => $password, '_internal' => $protected, 'role' => $visible]);
$schema->allows('sourceOf')->andReturn($source);
$post = new WP_Post(['ID' => 5, 'post_type' => 'lit_person']);
$full = (new PostPresenter($schema))->full($post);
self::assertSame(['role' => 'Leitung'], $full['fields']);
}
public function testDiviIsAlsoDetectedFromBlockMarkup(): void