fix: S40 - short form and attrs on the same path refused for new nodes too

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
2026-09-26 15:17:42 +02:00
co-authored by Claude Opus 5.5
parent 110beb7698
commit 22bb1528db
3 changed files with 95 additions and 14 deletions
@@ -278,6 +278,25 @@ final class DiviWriteAbilitiesTest extends TestCase
self::assertSame([], $this->saved);
}
/** Ruling S40: the S38 overlap rule for new nodes too. */
public function testInsertRefusesShortFormAndAttrsOnTheSamePath(): void
{
$result = $this->insert()->execute([
'post_id' => 7,
'tree_rev' => $this->treeRev(),
'parent' => 's0.r0.c1',
'nodes' => [[
'type' => 'button',
'text' => 'Neu',
'attrs' => ['button.innerContent' => ['desktop' => ['linkUrl' => '/neu']]],
]],
]);
self::assertSame('lit_validation_failed', $result->get_error_code());
self::assertArrayHasKey('nodes[0].attrs.button.innerContent', self::clientError($result)['fields']);
self::assertSame([], $this->saved);
}
/** Ruling S7: builder-only paths are refused for users without unfiltered_html – visible to the client. */
public function testBuilderOnlyPathsAreRefusedForEditors(): void
{