diff --git a/src/Integrations/Pods/PodsFieldSource.php b/src/Integrations/Pods/PodsFieldSource.php index 24a346d..b612cfa 100644 --- a/src/Integrations/Pods/PodsFieldSource.php +++ b/src/Integrations/Pods/PodsFieldSource.php @@ -50,11 +50,12 @@ final class PodsFieldSource implements FieldSource $this->loadPod = $loadPod ?? static fn (string $name): mixed => pods_api()->load_pod(['name' => $name]); $this->podFor = $podFor ?? static fn (string $name, int $id): mixed => pods($name, $id); $this->permitted = $permitted ?? static function (object $field): ?bool { - if (! function_exists('pods_has_permissions') || ! pods_has_permissions($field)) { - return null; + // Fail closed: without the Pods permission API no field counts as permitted. + if (! function_exists('pods_has_permissions') || ! function_exists('pods_permission')) { + return false; } - return function_exists('pods_permission') && (bool) pods_permission($field); + return pods_has_permissions($field) ? (bool) pods_permission($field) : null; }; } diff --git a/tests/Unit/Integrations/Pods/PodsFieldSourceTest.php b/tests/Unit/Integrations/Pods/PodsFieldSourceTest.php index e78c181..e078094 100644 --- a/tests/Unit/Integrations/Pods/PodsFieldSourceTest.php +++ b/tests/Unit/Integrations/Pods/PodsFieldSourceTest.php @@ -32,7 +32,7 @@ final class PodsFieldSourceTest extends TestCase private function source(?object $pod): PodsFieldSource { - return new PodsFieldSource(static fn (string $name) => $pod ?? false); + return new PodsFieldSource(static fn (string $name) => $pod ?? false, null, static fn (object $field): ?bool => null); } /** @return array> */ @@ -79,6 +79,19 @@ final class PodsFieldSourceTest extends TestCase self::assertSame(FieldDefinition::UNKNOWN, $fields['mystery']['status']); } + /** Fail-closed: without the Pods permission functions (not loaded in the unit run) no field counts as permitted. */ + public function testFieldIsHiddenWhenThePodsPermissionFunctionsAreMissing(): void + { + self::assertFalse(function_exists('pods_has_permissions')); + $pod = Mockery::mock(); + $pod->allows('get_type')->andReturn('post_type'); + $pod->allows('get_fields')->andReturn(['role' => $this->field('role', 'text')]); + + $fields = (new PodsFieldSource(static fn (string $name) => $pod))->fieldsFor('lit_person'); + + self::assertSame(FieldDefinition::HIDDEN, $fields[0]->status); + } + public function testParsesCustomSimpleChoices(): void { self::assertSame(