fix: connections only manageable for users the admin may edit

2026-09-26 05:05:27 +02:00
parent 9634ca740d
commit 8d0979cb73
2 changed files with 27 additions and 1 deletions
@@ -29,6 +29,7 @@ final class ConnectionRepositoryTest extends TestCase
            ],
        ];
        Functions\when('is_multisite')->justReturn(false);
+        Functions\when('current_user_can')->justReturn(true);
        Functions\when('get_userdata')->alias(
            static fn (int $id): object => (object) ['user_login' => 'user' . $id]
        );
@@ -145,4 +146,21 @@ final class ConnectionRepositoryTest extends TestCase
        self::assertArrayHasKey('uuid-5', WP_Application_Passwords::$items[5]);
        self::assertTrue($repository->revoke(3, 'uuid-1'));
    }
+
+    public function testListsAndRevokesOnlyConnectionsOfUsersTheAdminMayEdit(): void
+    {
+        Functions\when('current_user_can')->alias(
+            static fn (string $cap, ...$args): bool => ! ($cap === 'edit_user' && $args === [4])
+        );
+        $db = $this->db([
+            ['3', 'mcp_refresh_jti_uuid-1'],
+            ['4', 'mcp_refresh_jti_uuid-4'],
+        ]);
+        $repository = new ConnectionRepository($db);
+
+        self::assertSame(['uuid-1'], array_column($repository->all(), 'uuid'));
+        self::assertFalse($repository->revoke(4, 'uuid-4'));
+        self::assertArrayHasKey('uuid-4', WP_Application_Passwords::$items[4]);
+        self::assertTrue($repository->revoke(3, 'uuid-1'));
+    }
 }