feat: Divi read tools accept library entries (library access, E1/E3)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-27 01:02:25 +02:00
parent 2700fd615a
commit 48ecc627aa
13 changed files with 487 additions and 13 deletions
@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Divi\Library;
+
+use LIT\MCP\Integrations\Divi\Library\LibraryAccess;
+use LIT\MCP\Tests\Support\LibraryFixtures;
+use LIT\MCP\Tests\Unit\TestCase;
+use WP_Post;
+
+final class LibraryAccessTest extends TestCase
+{
+    public function testReadsLibraryItemsAndLeavesOtherIdsToPostGuard(): void
+    {
+        $item = LibraryFixtures::item(1055);
+        LibraryFixtures::given([$item, LibraryFixtures::page('')]);
+        $access = LibraryFixtures::access();
+
+        self::assertSame($item, $access->item(1055, false));
+        self::assertNull($access->item(LibraryFixtures::PAGE, false), 'a page is PostGuard\'s business');
+        self::assertNull($access->item(9999, false));
+        self::assertNull($access->item('abc', false));
+        self::assertNull($access->canList());
+    }
+
+    public function testReadingNeedsEditPostsTheDiviLibraryRoleAndEditPost(): void
+    {
+        $item = LibraryFixtures::item(1055);
+
+        LibraryFixtures::given([$item], ['edit_posts']);
+        self::assertToolError(LibraryFixtures::access()->item(1055, false), 'forbidden');
+
+        LibraryFixtures::given([$item]);
+        self::assertToolError(LibraryFixtures::access(['divi_library'])->item(1055, false), 'forbidden');
+
+        LibraryFixtures::given([$item], ['edit_post']);
+        $refusal = LibraryFixtures::access()->item(1055, false);
+        self::assertToolError($refusal, 'forbidden');
+        self::assertStringContainsString('Bibliothekseintrag 1055', $refusal->get_error_message());
+    }
+
+    public function testTrashedItemsCanBeRead(): void
+    {
+        $item = LibraryFixtures::item(1055, ['post_status' => 'trash']);
+        LibraryFixtures::given([$item]);
+
+        self::assertInstanceOf(WP_Post::class, LibraryFixtures::access()->item(1055, false));
+    }
+
+    public function testGlobalFromTheStore(): void
+    {
+        $access = LibraryFixtures::access();
+
+        self::assertTrue($access->isGlobal(LibraryFixtures::item(1058)));
+        self::assertFalse($access->isGlobal(LibraryFixtures::item(1055)));
+    }
+
+    public function testRefusalsNameNeitherTitleNorContent(): void
+    {
+        $item = LibraryFixtures::item(1055, ['post_status' => 'private', 'post_title' => 'Geheimer Entwurf']);
+
+        foreach ([['edit_posts'], ['edit_post']] as $denied) {
+            LibraryFixtures::given([$item], $denied);
+            $refusal = LibraryFixtures::access()->item(1055, false);
+            self::assertToolError($refusal, 'forbidden');
+            self::assertStringNotContainsString('Geheimer Entwurf', $refusal->get_error_message());
+            self::assertStringNotContainsString('Geheimer Entwurf', (string) wp_json_encode($refusal->get_error_data()));
+        }
+    }
+
+    /** Ruling P9: with the group "Divi-Bibliothek" disabled, library IDs read like IDs that do not exist. */
+    public function testAHiddenLibraryAnswersNotFoundLikeAMissingEntry(): void
+    {
+        $item = LibraryFixtures::item(1055, ['post_title' => 'Geheimer Entwurf']);
+        LibraryFixtures::given([$item, LibraryFixtures::page('')], ['edit_post']);
+        $hidden = new LibraryAccess(LibraryFixtures::store(), LibraryFixtures::roles(), null, static fn (): bool => false);
+
+        foreach ([false, true] as $forWrite) {
+            $refusal = $hidden->item(1055, $forWrite);
+            self::assertToolError($refusal, 'not_found');
+            self::assertStringNotContainsString('Geheimer Entwurf', $refusal->get_error_message());
+            self::assertStringNotContainsString('Bibliothek', $refusal->get_error_message());
+        }
+        self::assertNull($hidden->item(LibraryFixtures::PAGE, false), 'pages stay PostGuard\'s business');
+        self::assertNull($hidden->item(9999, false));
+    }
+}