feat: Divi save pipeline – tree_rev lock, kses-safe save, revision, flags, cache, ToolResult

DiviSaver/DiviWriter/DiviComposition/DiviChange, WpValueSanitizer (S4), WpMediaResolver, DiviFlags (S11), DynamicContentMap from Divi's live registry (S22), S31 wiring, S35 control strip at apply() entry. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 14:56:47 +02:00
parent ea1fd607b2
commit 7762b76305
20 changed files with 1716 additions and 2 deletions
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Divi\Pages;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Integrations\Divi\Pages\WpValueSanitizer;
+use LIT\MCP\Tests\Unit\TestCase;
+
+final class WpValueSanitizerTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\when('wp_kses_post')->alias(static fn (string $value): string => 'kses(' . $value . ')');
+        Functions\when('esc_url_raw')->alias(static fn (string $value): string => 'url(' . $value . ')');
+    }
+
+    public function testEditorsGetKsesForRichTextAndCode(): void
+    {
+        Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'unfiltered_html');
+        $sanitizer = new WpValueSanitizer();
+
+        self::assertSame('kses(<iframe></iframe>)', $sanitizer->html('<iframe></iframe>'));
+        self::assertSame('kses(<script>x</script>)', $sanitizer->code('<script>x</script>'));
+        self::assertFalse($sanitizer->allowsUnfilteredHtml());
+    }
+
+    public function testAdministratorsKeepRichTextAndCodeUnfiltered(): void
+    {
+        // Ruling S4: html() depends on unfiltered_html like code() – admin embeds survive updates.
+        Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap === 'unfiltered_html');
+        $sanitizer = new WpValueSanitizer();
+
+        self::assertSame('<iframe src="https://x.test"></iframe>', $sanitizer->html('<iframe src="https://x.test"></iframe>'));
+        self::assertSame('<script>x</script>', $sanitizer->code('<script>x</script>'));
+        self::assertTrue($sanitizer->allowsUnfilteredHtml());
+    }
+
+    public function testTextAndUrlDoNotDependOnTheRole(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $sanitizer = new WpValueSanitizer();
+
+        self::assertSame('Hallo', $sanitizer->text('<b>Hallo</b>'));
+        self::assertSame('url(https://x.test/a b)', $sanitizer->url('  https://x.test/a b '));
+    }
+}