fix(security): content-create divi follows the Divi group switches (audit M2)

The divi input of lit/content-create is refused with unsupported when
lit/divi-insert is disabled or the Divi group is disabled or read-only
(ExposurePolicy::allows as a cross-group gate, asked at execute time).
content-create without divi keeps working. Adds a registrar test that
read-only write tools are never registered, so execute-ability can't
reach them either.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
2026-09-26 19:16:35 +02:00
co-authored by Claude Opus 5.5
parent 7d0837be6c
commit 5f596b8a17
10 changed files with 169 additions and 6 deletions
@@ -142,4 +142,19 @@ final class DiviContentComposerTest extends TestCase
$this->expectException(RuntimeException::class);
$this->composer()->write(42, 'page', self::sections());
}
public function testWritableFollowsTheGateAndDefaultsToTrue(): void
{
self::assertTrue($this->composer()->writable());
$design = DiviWriterFixture::designReader();
$gated = new DiviContentComposer(
DiviFixtures::schema(true),
DiviWriterFixture::composition($design),
$this->saver,
$design,
static fn (): bool => false
);
self::assertFalse($gated->writable());
}
}