fix(security): content-create divi follows the Divi group switches (audit M2)
The divi input of lit/content-create is refused with unsupported when lit/divi-insert is disabled or the Divi group is disabled or read-only (ExposurePolicy::allows as a cross-group gate, asked at execute time). content-create without divi keeps working. Adds a registrar test that read-only write tools are never registered, so execute-ability can't reach them either. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
@@ -142,4 +142,19 @@ final class DiviContentComposerTest extends TestCase
|
||||
$this->expectException(RuntimeException::class);
|
||||
$this->composer()->write(42, 'page', self::sections());
|
||||
}
|
||||
|
||||
public function testWritableFollowsTheGateAndDefaultsToTrue(): void
|
||||
{
|
||||
self::assertTrue($this->composer()->writable());
|
||||
|
||||
$design = DiviWriterFixture::designReader();
|
||||
$gated = new DiviContentComposer(
|
||||
DiviFixtures::schema(true),
|
||||
DiviWriterFixture::composition($design),
|
||||
$this->saver,
|
||||
$design,
|
||||
static fn (): bool => false
|
||||
);
|
||||
self::assertFalse($gated->writable());
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user