Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(security): unbekannte Requirement-ID sperrt das Divi-Tool

Browse Source 
Deklariert ein Tool über DeclaresRequirements eine ID, die keine Divi-Fähigkeit ist, wird der Aufruf mit divi_incompatible (423) gesperrt, statt ungesperrt zu laufen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-11-06 11:30:05 +01:00
co-authored by Claude Opus 5.5
parent 234fd1edac
commit 691231f776
4 changed files with 85 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Release/DiviFeatureGateTest.php
+10 -6
View File
@@ -265,14 +265,18 @@ final class DiviFeatureGateTest extends TestCase
);
}
public function testAnUnknownRequirementOfTheCoreIsIgnored(): void
public function testAnUnknownRequirementOfTheCoreLocksTheToolAndIsLogged(): void
{
DiviFeatureFixtures::lock(DiviFeature::PageWrite);
$tool = $this->contentCreate($this->composerNeeding('something-else'));
$log = new FakeChangeLog();
$tool = $this->contentCreate($this->composerNeeding('page-write', 'something-else'));
self::assertNull(
$this->gate(FakeChangeLog::forbidden())->refusal($tool, ['post_type' => 'page', 'divi' => [[]]])
);
$error = $this->gate($log)->refusal($tool, ['post_type' => 'page', 'divi' => [[]]]);
$payload = self::assertToolError($error, 'divi_incompatible');
self::assertSame(['something-else'], $payload['unknown']);
self::assertSame(423, $error->get_error_data()['status'] ?? null);
self::assertSame('lit/content-create', $log->records[0]['ability']);
self::assertSame('refused', $log->records[0]['result']);
}
public function testAnnotateNeverChangesAResult(): void