feat: media upload by URL and base64 with whitelist and size limit
MediaImporter streams URL imports via wp_safe_remote_get with limit_response_size, checks Content-Length, intersects the MIME whitelist with get_allowed_mime_types and validates real content; base64 is size-checked before decoding. Server-side failures are write_failed; a failed alt text deletes the new attachment again (or partial_write). MediaUploads is the shared permission/result helper of both upload abilities. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,157 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace LIT\MCP\Tests\Unit\Integrations\Media;
|
||||
|
||||
use Brain\Monkey\Functions;
|
||||
use LIT\MCP\Abilities\Errors;
|
||||
use LIT\MCP\Abilities\WriteFailed;
|
||||
use LIT\MCP\ChangeLog\ChangeLog;
|
||||
use LIT\MCP\Integrations\Media\MediaImporter;
|
||||
use LIT\MCP\Integrations\Media\MediaPresenter;
|
||||
use LIT\MCP\Integrations\Media\MediaUploadAbility;
|
||||
use LIT\MCP\Integrations\Media\MediaUploadFromUrlAbility;
|
||||
use LIT\MCP\Integrations\Media\MediaUploads;
|
||||
use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
|
||||
use LIT\MCP\Limits;
|
||||
use LIT\MCP\Tests\Unit\TestCase;
|
||||
use Mockery;
|
||||
use RuntimeException;
|
||||
use WP_Post;
|
||||
|
||||
final class MediaUploadAbilitiesTest extends TestCase
|
||||
{
|
||||
private function uploads(?ChangeLog $log = null): MediaUploads
|
||||
{
|
||||
$presenter = Mockery::mock(MediaPresenter::class);
|
||||
$presenter->allows('summary')->andReturn(['id' => 55, 'title' => 'Logo']);
|
||||
$schema = Mockery::mock(ContentSchema::class);
|
||||
$schema->allows('isManaged')->andReturn(true);
|
||||
|
||||
return new MediaUploads($presenter, $log ?? Mockery::mock(ChangeLog::class), $schema);
|
||||
}
|
||||
|
||||
private function savedAttachment(): void
|
||||
{
|
||||
Functions\when('get_post')->justReturn(new WP_Post(['ID' => 55, 'post_type' => 'attachment', 'post_title' => 'Logo']));
|
||||
Functions\when('get_edit_post_link')->justReturn('https://kunde.de/wp-admin/post.php?post=55&action=edit');
|
||||
}
|
||||
|
||||
public function testUploadFromUrlReportsTheNewAttachment(): void
|
||||
{
|
||||
$this->savedAttachment();
|
||||
$importer = Mockery::mock(MediaImporter::class);
|
||||
$importer->expects('fromUrl')->with('https://example.com/logo.png', null, ['alt' => 'Logo'])->andReturn(55);
|
||||
$log = Mockery::mock(ChangeLog::class);
|
||||
$log->expects('record')->with('lit/media-upload-from-url', 'attachment', '55', Mockery::type('string'))->andReturn(3);
|
||||
|
||||
$result = (new MediaUploadFromUrlAbility($importer, $this->uploads($log)))
|
||||
->execute(['url' => 'https://example.com/logo.png', 'alt' => 'Logo']);
|
||||
|
||||
self::assertSame(['id' => 55, 'title' => 'Logo'], $result['attachment']);
|
||||
self::assertSame(['id' => '55', 'type' => 'attachment', 'action' => 'created', 'label' => 'Logo'], $result['changed'][0]);
|
||||
self::assertSame(3, $result['log_id']);
|
||||
self::assertSame('https://kunde.de/wp-admin/post.php?post=55&action=edit', $result['edit_url']);
|
||||
self::assertSame([], $result['warnings']);
|
||||
}
|
||||
|
||||
public function testBase64UploadPassesFilenameDataAndMeta(): void
|
||||
{
|
||||
$this->savedAttachment();
|
||||
$importer = Mockery::mock(MediaImporter::class);
|
||||
$importer->expects('fromBase64')->with('AAAA', 'x.png', ['title' => 'Logo', 'post_id' => 5])->andReturn(55);
|
||||
$log = Mockery::mock(ChangeLog::class);
|
||||
$log->expects('record')->with('lit/media-upload', 'attachment', '55', Mockery::type('string'))->andReturn(4);
|
||||
|
||||
$result = (new MediaUploadAbility($importer, $this->uploads($log), new Limits()))
|
||||
->execute(['filename' => 'x.png', 'data' => 'AAAA', 'title' => 'Logo', 'post_id' => 5]);
|
||||
|
||||
self::assertTrue($result['ok']);
|
||||
self::assertSame(4, $result['log_id']);
|
||||
}
|
||||
|
||||
public function testAFailingChangeLogIsOnlyAWarning(): void
|
||||
{
|
||||
$this->savedAttachment();
|
||||
$importer = Mockery::mock(MediaImporter::class);
|
||||
$importer->allows('fromUrl')->andReturn(55);
|
||||
$log = Mockery::mock(ChangeLog::class);
|
||||
$log->allows('record')->andThrow(new RuntimeException('db down'));
|
||||
// error_log() is a PHP internal and cannot be stubbed; redirect it to a temp file instead.
|
||||
$file = (string) tempnam(sys_get_temp_dir(), 'lit-log');
|
||||
$previous = ini_set('error_log', $file);
|
||||
try {
|
||||
$result = (new MediaUploadFromUrlAbility($importer, $this->uploads($log)))
|
||||
->execute(['url' => 'https://example.com/logo.png']);
|
||||
self::assertStringContainsString('db down', (string) file_get_contents($file));
|
||||
} finally {
|
||||
ini_set('error_log', (string) $previous);
|
||||
unlink($file);
|
||||
}
|
||||
|
||||
self::assertTrue($result['ok']);
|
||||
self::assertNull($result['log_id']);
|
||||
self::assertStringContainsString('Medium 55 ist gespeichert', $result['warnings'][0]);
|
||||
}
|
||||
|
||||
public function testImporterErrorsArePassedThrough(): void
|
||||
{
|
||||
$importer = Mockery::mock(MediaImporter::class);
|
||||
$importer->allows('fromBase64')->andReturn(Errors::invalidInput('zu groß'));
|
||||
|
||||
$result = (new MediaUploadAbility($importer, $this->uploads(), new Limits()))
|
||||
->execute(['filename' => 'x.png', 'data' => 'AAAA']);
|
||||
|
||||
self::assertSame('lit_validation_failed', $result->get_error_code());
|
||||
}
|
||||
|
||||
public function testAPartialUploadIsLoggedAsPartialAndRethrown(): void
|
||||
{
|
||||
$failure = new WriteFailed('Alt-Text fehlt.', false, 55);
|
||||
$importer = Mockery::mock(MediaImporter::class);
|
||||
$importer->allows('fromUrl')->andThrow($failure);
|
||||
$log = Mockery::mock(ChangeLog::class);
|
||||
$log->expects('recordPartial')->with('lit/media-upload-from-url', 'attachment', '55', Mockery::type('string'));
|
||||
|
||||
$this->expectExceptionObject($failure);
|
||||
(new MediaUploadFromUrlAbility($importer, $this->uploads($log)))->execute(['url' => 'https://example.com/a.png']);
|
||||
}
|
||||
|
||||
public function testPermissionNeedsUploadRightsAndEditRightsOnTheParent(): void
|
||||
{
|
||||
Functions\when('current_user_can')->alias(static fn (string $cap, int $id = 0): bool => $cap === 'upload_files');
|
||||
Functions\when('get_post')->justReturn(new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_status' => 'publish']));
|
||||
$ability = new MediaUploadFromUrlAbility(Mockery::mock(MediaImporter::class), $this->uploads());
|
||||
|
||||
self::assertTrue($ability->permission(['url' => 'https://example.com/a.png']));
|
||||
self::assertSame('lit_forbidden', $ability->permission(['url' => 'https://example.com/a.png', 'post_id' => 5])->get_error_code());
|
||||
}
|
||||
|
||||
public function testPermissionRefusesUsersWithoutUploadRights(): void
|
||||
{
|
||||
Functions\when('current_user_can')->justReturn(false);
|
||||
$ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
|
||||
|
||||
self::assertSame('lit_forbidden', $ability->permission(['filename' => 'a.png', 'data' => 'AAAA'])->get_error_code());
|
||||
}
|
||||
|
||||
public function testUploadsForAParentThatDoesNotExistAreRefused(): void
|
||||
{
|
||||
Functions\when('current_user_can')->justReturn(true);
|
||||
Functions\when('get_post')->justReturn(null);
|
||||
$ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
|
||||
|
||||
self::assertSame('lit_not_found', $ability->permission(['filename' => 'a.png', 'data' => 'AAAA', 'post_id' => 9])->get_error_code());
|
||||
}
|
||||
|
||||
public function testDescriptionNamesTheConfiguredLimit(): void
|
||||
{
|
||||
Functions\when('get_option')->justReturn(['upload_mb' => 8]);
|
||||
$ability = new MediaUploadAbility(Mockery::mock(MediaImporter::class), $this->uploads(), new Limits());
|
||||
|
||||
self::assertStringContainsString('8 MB', $ability->description());
|
||||
self::assertFalse($ability->isDirect());
|
||||
self::assertTrue((new MediaUploadFromUrlAbility(Mockery::mock(MediaImporter::class), $this->uploads()))->isDirect());
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user