feat: change log tab with filters, revision links and clear button

ChangeLog gains query()/abilities()/clear() (filters: ability, user, result, date range - all optional and additive). LogTab/LogListTable render the "Protokoll" admin tab: WP_List_Table with pagination, links to the post/attachment/nav_menu edit screen by object_type, a revision link shown only when the user may edit the revision's parent post, and a nonce+manage_options-gated "Protokoll leeren" with a JS confirmation and highlighted 'partial' rows. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 04:12:13 +02:00
parent 9104989c43
commit 522f5bbd19
9 changed files with 940 additions and 0 deletions
@@ -0,0 +1,155 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Admin\LogTab;
+use LIT\MCP\ChangeLog\ChangeLog;
+use LIT\MCP\Limits;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+use RuntimeException;
+
+final class LogTabTest extends TestCase
+{
+    protected function tearDown(): void
+    {
+        unset($_GET['ability'], $_GET['user_id'], $_GET['result'], $_GET['date_from'], $_GET['date_to']);
+        parent::tearDown();
+    }
+
+    public function testFiltersAreReadSanitized(): void
+    {
+        $tab = new LogTab(Mockery::mock(ChangeLog::class), new Limits());
+        $_GET['ability'] = 'lit/content-update';
+        $_GET['user_id'] = '3x';
+
+        self::assertSame(['ability' => 'lit/content-update', 'user_id' => 3], $tab->filters());
+
+        $_GET['ability'] = 'lit/x"><script>';
+        self::assertSame('', $tab->filters()['ability']);
+    }
+
+    public function testExtraFiltersWhitelistResultAndDateRange(): void
+    {
+        $tab = new LogTab(Mockery::mock(ChangeLog::class), new Limits());
+
+        self::assertSame(
+            ['result' => '', 'date_from' => '', 'date_to' => ''],
+            $tab->extraFilters(),
+            'absent GET params sanitize to empty strings'
+        );
+
+        $_GET['result'] = 'partial';
+        $_GET['date_from'] = '2026-09-01';
+        $_GET['date_to'] = '2026-09-25';
+
+        self::assertSame(
+            ['result' => 'partial', 'date_from' => '2026-09-01', 'date_to' => '2026-09-25'],
+            $tab->extraFilters()
+        );
+    }
+
+    public function testExtraFiltersRejectUnknownResultAndMalformedDates(): void
+    {
+        $tab = new LogTab(Mockery::mock(ChangeLog::class), new Limits());
+
+        $_GET['result'] = 'ok"><script>';
+        $_GET['date_from'] = 'not-a-date';
+        $_GET['date_to'] = '2026-13-99'; // wrong shape is enough to reject; no calendar validation needed here.
+
+        self::assertSame(['result' => '', 'date_from' => '', 'date_to' => '2026-13-99'], $tab->extraFilters());
+    }
+
+    public function testClearNeedsNonceAndRights(): void
+    {
+        Functions\stubTranslationFunctions();
+        Functions\when('current_user_can')->justReturn(true);
+        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://kunde.de/wp-admin/' . $path);
+        Functions\when('add_query_arg')->alias(static fn (array $args, string $url): string => $url . '?' . http_build_query($args));
+        Functions\expect('check_admin_referer')->once()->with('lit_mcp_clear_log');
+        Functions\expect('wp_safe_redirect')->once()->with(Mockery::on(
+            static fn (string $url): bool => str_contains($url, 'tab=protokoll') && str_contains($url, 'lit_mcp_notice=cleared')
+        ));
+        $log = Mockery::mock(ChangeLog::class);
+        $log->expects('clear')->once();
+        $terminated = false;
+
+        (new LogTab($log, new Limits(), static function () use (&$terminated): void {
+            $terminated = true;
+        }))->handleClear();
+
+        self::assertTrue($terminated);
+    }
+
+    public function testClearRequiresManageOptions(): void
+    {
+        Functions\stubTranslationFunctions();
+        Functions\expect('current_user_can')->once()->with('manage_options')->andReturn(false);
+        Functions\expect('wp_die')->once()->andThrow(new RuntimeException('died'));
+        Functions\expect('check_admin_referer')->never();
+        $log = Mockery::mock(ChangeLog::class);
+        $log->expects('clear')->never();
+
+        $this->expectException(RuntimeException::class);
+        (new LogTab($log, new Limits()))->handleClear();
+    }
+
+    public function testRegistersTheClearAction(): void
+    {
+        $tab = new LogTab(Mockery::mock(ChangeLog::class), new Limits());
+        Functions\expect('add_action')->once()->with('admin_post_lit_mcp_clear_log', [$tab, 'handleClear']);
+
+        $tab->registerActions();
+    }
+
+    public function testRenderShowsFiltersAndAConfirmProtectedClearButton(): void
+    {
+        Functions\stubEscapeFunctions();
+        Functions\stubTranslationFunctions();
+        Functions\when('selected')->alias(static fn ($a, $b = true, $echo = true): string => $a === $b ? ' selected="selected"' : '');
+        Functions\when('checked')->justReturn('');
+        Functions\when('settings_fields')->justReturn(null);
+        Functions\when('submit_button')->alias(static function (
+            string $text = '',
+            string $type = 'primary',
+            string $name = 'submit',
+            bool $wrap = true,
+            $other = ''
+        ): void {
+            $attrs = is_array($other) ? implode(' ', array_map(
+                static fn ($k, $v): string => sprintf('%s="%s"', $k, $v),
+                array_keys($other),
+                $other
+            )) : (string) $other;
+            printf('<button type="submit" name="%s" %s>%s</button>', esc_attr($name), $attrs, esc_html($text));
+        });
+        Functions\when('wp_nonce_field')->alias(static function (string $action): void {
+            echo '<input type="hidden" name="_wpnonce" value="nonce-' . $action . '">';
+        });
+        Functions\when('wp_dropdown_users')->alias(static function (array $args): void {
+            echo '<select name="' . $args['name'] . '"><option>Alle</option></select>';
+        });
+        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://kunde.de/wp-admin/' . $path);
+        Functions\when('get_option')->justReturn([]);
+
+        $log = Mockery::mock(ChangeLog::class);
+        $log->allows('abilities')->andReturn(['lit/content-update', 'lit/x"><script>']);
+        $log->allows('query')->andReturn(['rows' => [], 'total' => 0]);
+
+        ob_start();
+        (new LogTab($log, new Limits()))->render();
+        $html = (string) ob_get_clean();
+
+        self::assertStringContainsString('name="result"', $html);
+        self::assertStringContainsString('name="date_from"', $html);
+        self::assertStringContainsString('name="date_to"', $html);
+        self::assertStringContainsString('lit/content-update', $html);
+        self::assertStringNotContainsString('<script>', $html);
+        self::assertStringContainsString('lit_mcp_clear_log', $html);
+        self::assertStringContainsString('confirm(', $html);
+        self::assertStringContainsString('nonce-lit_mcp_clear_log', $html);
+    }
+}