Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: content-create with divi returns the Visual Builder edit_url (review I-1)

Browse Source 
DiviPage::builderUrl() is shared by DiviPage::editUrl() and the content
composer, which now returns edit_url; content-create without divi keeps
the wp-admin link. divi-write-smoke checks the builder URL and, new in
section 9, the M1/M2 gates live (raw Divi markup refused; Divi read-only
stops content-create divi and execute-ability lit/divi-insert).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 19:19:04 +02:00
co-authored by Claude Opus 5.5
parent 5f596b8a17
commit 4fe0810049
7 changed files with 74 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Integration/divi-write-smoke.sh
+35
View File
@@ -16,6 +16,7 @@ ADMIN_LOGIN=$(wp user list --role=administrator --field=user_login | head -1)
EDITOR_LOGIN=lit-smoke-editor
FIXTURES=$PLUGIN/tests/Fixtures/divi
ORIGINAL_ROLES=$(wp option get lit_mcp_allowed_roles --format=json 2>/dev/null || echo '["administrator"]')
ORIGINAL_EXPOSURE=$(wp option get lit_mcp_exposure --format=json 2>/dev/null || echo '__none__')
CREATED_POSTS=()
cleanup() {
@@ -36,6 +37,11 @@ foreach (array_filter(explode(" ", (string) getenv("LIT_IDS"))) as $id) {
wp user delete "$EDITOR_LOGIN" --yes >/dev/null 2>&1 || true
wp role delete lit_smoke_editor >/dev/null 2>&1 || true
wp option update lit_mcp_allowed_roles "$ORIGINAL_ROLES" --format=json >/dev/null 2>&1 || true
if [ "$ORIGINAL_EXPOSURE" = "__none__" ]; then
wp option delete lit_mcp_exposure >/dev/null 2>&1 || true
else
wp option update lit_mcp_exposure "$ORIGINAL_EXPOSURE" --format=json >/dev/null 2>&1 || true
fi
}
trap 'rc=$?; cleanup; guard_exit "$rc" || exit $?' EXIT
@@ -221,6 +227,7 @@ NEW_ID=$(echo "$CREATED" | jq -r '.changed[0].id // empty')
[ -n "$NEW_ID" ] || fail "content-create with divi: $CREATED"
CREATED_POSTS+=("$NEW_ID")
echo "$CREATED" | jq -e '.tree_rev != null' >/dev/null || fail "content-create lacks tree_rev: $CREATED"
echo "$CREATED" | jq -e '.edit_url | contains("et_fb=1")' >/dev/null || fail "content-create edit_url is not the builder: $CREATED"
[ "$(wp post meta get "$NEW_ID" _et_pb_use_divi_5)" = "on" ] || fail "Divi flag missing"
[ "$(wp post get "$NEW_ID" --field=post_status)" = "draft" ] || fail "new Divi page is not a draft"
tool lit-page-render-summary "{\"post_id\":$NEW_ID}" | jq -e '.headings[0].text == "Neu hier"' >/dev/null || fail "new page not rendered"
@@ -361,4 +368,32 @@ echo "$AGAIN" | jq -e '.ok == true and (.warnings | any(contains("beim Speichern
|| fail "8b: follow-up write with the new tree_rev: $AGAIN"
pass "Divi save filters, other byte form: normalized with CHANGED_ON_SAVE, tree_rev = stored state, page valid, then stable"
# 9. No way around the Divi pipeline (security audit M1, M2):
# 9a: raw content with Divi block markup is refused on create and update.
RAW=$(tool lit-content-create '{"post_type":"page","title":"LIT Divi Roh","content":"<!-- wp:divi/section --><!-- /wp:divi/section -->"}')
[ "$(error_code "$RAW")" = "validation_failed" ] || fail "9a: raw Divi markup accepted by content-create: $RAW"
PLAIN=$(tool lit-content-create '{"post_type":"page","title":"LIT Divi Klar","content":"<!-- wp:paragraph --><p>x</p><!-- /wp:paragraph -->"}')
PLAIN_ID=$(echo "$PLAIN" | jq -r '.changed[0].id // empty')
[ -n "$PLAIN_ID" ] || fail "9a: plain block markup refused: $PLAIN"
CREATED_POSTS+=("$PLAIN_ID")
PLAIN_REV=$(tool lit-content-get "{\"post_id\":$PLAIN_ID}" | jq -r '.rev')
RAW_UPDATE=$(tool lit-content-update "$(jq -cn --argjson id "$PLAIN_ID" --arg rev "$PLAIN_REV" '{post_id: $id, rev: $rev,
content: "<!--\n wp:divi/text {\"module\":{}} /-->"}')")
[ "$(error_code "$RAW_UPDATE")" = "validation_failed" ] || fail "9a: raw Divi markup accepted by content-update: $RAW_UPDATE"
pass "raw content with Divi markup refused (create and update); other block markup allowed"
# 9b: Divi group "nur lesen" stops content-create divi and lit/divi-insert (also via execute-ability).
wp option update lit_mcp_exposure '{"@readonly:divi":true}' --format=json >/dev/null
connect "$ADMIN_LOGIN"
GATED=$(tool lit-content-create '{"post_type":"page","title":"LIT Divi Gesperrt","divi":[{"type":"section"}]}')
[ "$(error_code "$GATED")" = "unsupported" ] || fail "9b: content-create divi with Divi read-only: $GATED"
UNGATED=$(tool lit-content-create '{"post_type":"page","title":"LIT Divi Ohne"}')
UNGATED_ID=$(echo "$UNGATED" | jq -r '.changed[0].id // empty')
[ -n "$UNGATED_ID" ] || fail "9b: content-create without divi must keep working: $UNGATED"
CREATED_POSTS+=("$UNGATED_ID")
VIA_EXECUTE=$(ability lit/divi-insert "{\"post_id\":$UNGATED_ID,\"tree_rev\":\"x\",\"nodes\":[{\"type\":\"section\"}]}")
echo "$VIA_EXECUTE" | jq -e 'has("__error")' >/dev/null || fail "9b: lit/divi-insert reachable via execute-ability: $VIA_EXECUTE"
echo "$VIA_EXECUTE" | grep -q 'not found' || fail "9b: expected ability not found: $VIA_EXECUTE"
pass "Divi read-only: content-create divi refused, content-create without divi works, divi-insert not executable"
finish