fix(security): Pods-Meta nur lesbar, wenn Pods aktiv, aber nicht nutzbar

Ist Pods aktiv, seine API aber nicht nutzbar, melden gesampelte und registrierte Meta-Schlüssel READONLY statt schreibbar. Sonst würden Pods-Felder (auch über Pods' register_meta-Integration) an Pods vorbei geschrieben.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Integrations/WordPress/Schema/RegisteredMetaSource.php

@@ -13,6 +13,11 @@ final class RegisteredMetaSource extends MetaFieldSource
 {
     private const TYPES = ['string', 'boolean', 'integer', 'number', 'array', 'object'];
 
+    /** @param bool $readOnly Report every key as READONLY (Pods is active but cannot be used to write its keys). */
+    public function __construct(private bool $readOnly = false)
+    {
+    }
+
     public function id(): string
     {
         return 'meta';
@@ -26,7 +31,7 @@ final class RegisteredMetaSource extends MetaFieldSource
             $key = (string) $key;
             $args = is_array($args) ? $args : [];
             $type = (string) ($args['type'] ?? 'string');
-            $readonly = is_protected_meta($key, 'post') && empty($args['show_in_rest']);
+            $readonly = $this->readOnly || (is_protected_meta($key, 'post') && empty($args['show_in_rest']));
 
             $fields[] = new FieldDefinition(
                 $key,

src/Integrations/WordPress/Schema/SampledMetaSource.php

@@ -15,7 +15,8 @@ final class SampledMetaSource extends MetaFieldSource
     private const SAMPLE_POSTS = 50;
     private const MAX_KEYS = 200;
 
-    public function __construct(private ?\wpdb $db = null)
+    /** @param bool $readOnly Report the keys as READONLY (Pods is active but cannot be used to write them). */
+    public function __construct(private ?\wpdb $db = null, private bool $readOnly = false)
     {
     }
 
@@ -48,7 +49,13 @@ final class SampledMetaSource extends MetaFieldSource
                 continue;
             }
 
-            $fields[] = new FieldDefinition($key, $key, 'unknown', 'sample', FieldDefinition::UNKNOWN);
+            $fields[] = new FieldDefinition(
+                $key,
+                $key,
+                'unknown',
+                'sample',
+                $this->readOnly ? FieldDefinition::READONLY : FieldDefinition::UNKNOWN
+            );
         }
 
         return $fields;