Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

feat: whitelisted WordPress settings tools

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 00:34:26 +02:00
co-authored by Claude Opus 5.5
parent a2e9dabb17
commit 9cc9d4f2dc
7 changed files with 782 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/WordPress/Settings/SettingsWhitelistTest.php
+82
View File
@@ -0,0 +1,82 @@
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Unit\Integrations\WordPress\Settings;
use Brain\Monkey\Functions;
use LIT\MCP\Integrations\WordPress\Settings\SettingsWhitelist;
use LIT\MCP\Tests\Unit\TestCase;
use WP_Post;
final class SettingsWhitelistTest extends TestCase
{
public function testWhitelistMatchesTheSpecExactly(): void
{
self::assertSame(
[
'blogname', 'blogdescription', 'WPLANG', 'timezone_string', 'date_format', 'time_format',
'show_on_front', 'page_on_front', 'page_for_posts', 'posts_per_page',
'default_comment_status', 'default_ping_status', 'permalink_structure', 'site_icon',
],
array_keys(SettingsWhitelist::SETTINGS)
);
self::assertSame(['admin_email', 'users_can_register', 'default_role', 'siteurl', 'home'], SettingsWhitelist::BLOCKED);
}
public function testBlockedAndUnknownKeysAreRejected(): void
{
$whitelist = new SettingsWhitelist();
self::assertStringStartsWith('Gesperrt', (string) $whitelist->validate('admin_email', 'x@y.de', []));
self::assertStringStartsWith('Nicht freigegeben', (string) $whitelist->validate('template', 'twentyten', []));
}
public function testStaticFrontPageNeedsAPublishedDistinctPage(): void
{
Functions\when('get_option')->justReturn(0);
Functions\when('get_post')->alias(static fn (int $id) => match ($id) {
5 => new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_status' => 'publish']),
6 => new WP_Post(['ID' => 6, 'post_type' => 'page', 'post_status' => 'draft']),
default => null,
});
$whitelist = new SettingsWhitelist();
self::assertNotNull($whitelist->validate('show_on_front', 'page', []));
self::assertNull($whitelist->validate('show_on_front', 'page', ['page_on_front' => 5]));
self::assertNull($whitelist->validate('page_on_front', 5, []));
self::assertNotNull($whitelist->validate('page_on_front', 6, []));
self::assertNotNull($whitelist->validate('page_on_front', 5, ['page_for_posts' => 5]));
self::assertNull($whitelist->validate('page_for_posts', 0, []));
}
public function testFormatsLanguagesAndRanges(): void
{
Functions\when('get_available_languages')->justReturn(['de_DE']);
Functions\when('wp_attachment_is_image')->alias(static fn (int $id): bool => $id === 33);
$whitelist = new SettingsWhitelist();
self::assertNull($whitelist->validate('WPLANG', 'de_DE', []));
self::assertNull($whitelist->validate('WPLANG', 'en_US', []));
self::assertStringContainsString('de_DE', (string) $whitelist->validate('WPLANG', 'fr_FR', []));
self::assertNull($whitelist->validate('timezone_string', 'Europe/Berlin', []));
self::assertNotNull($whitelist->validate('timezone_string', 'Mars/Base', []));
self::assertNull($whitelist->validate('permalink_structure', '/%postname%/', []));
self::assertNull($whitelist->validate('permalink_structure', '', []));
self::assertNotNull($whitelist->validate('permalink_structure', 'postname', []));
self::assertNotNull($whitelist->validate('posts_per_page', 0, []));
self::assertNotNull($whitelist->validate('default_comment_status', 'maybe', []));
self::assertNull($whitelist->validate('site_icon', 33, []));
self::assertNotNull($whitelist->validate('site_icon', 34, []));
self::assertSame('', $whitelist->normalize('WPLANG', 'en_US'));
}
public function testCurrentNormalizesLanguageAndNumbers(): void
{
Functions\when('get_option')->alias(static fn (string $key) => ['WPLANG' => '', 'page_on_front' => '5'][$key]);
$whitelist = new SettingsWhitelist();
self::assertSame('en_US', $whitelist->current('WPLANG'));
self::assertSame(5, $whitelist->current('page_on_front'));
}
}
tests/Unit/Integrations/WordPress/Settings/WpSettingsAbilitiesTest.php
+135
View File
@@ -0,0 +1,135 @@
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Unit\Integrations\WordPress\Settings;
use Brain\Monkey\Functions;
use LIT\MCP\ChangeLog\ChangeLog;
use LIT\MCP\Integrations\WordPress\Settings\SettingsWhitelist;
use LIT\MCP\Integrations\WordPress\Settings\WpSettingsGetAbility;
use LIT\MCP\Integrations\WordPress\Settings\WpSettingsUpdateAbility;
use LIT\MCP\Tests\Unit\TestCase;
use Mockery;
final class WpSettingsAbilitiesTest extends TestCase
{
protected function tearDown(): void
{
unset($GLOBALS['wp_rewrite']);
parent::tearDown();
}
public function testGetFiltersByGroup(): void
{
Functions\when('get_option')->justReturn('Kunde');
$result = (new WpSettingsGetAbility(new SettingsWhitelist()))->execute(['group' => 'discussion']);
self::assertSame(['default_comment_status', 'default_ping_status'], array_column($result['settings'], 'key'));
self::assertSame('discussion', $result['settings'][0]['group']);
}
public function testUpdateIsAllOrNothing(): void
{
Functions\expect('update_option')->never();
$result = (new WpSettingsUpdateAbility(new SettingsWhitelist(), Mockery::mock(ChangeLog::class)))
->execute(['settings' => ['blogname' => 'Neu', 'admin_email' => 'x@y.de']]);
self::assertSame('lit_validation_failed', $result->get_error_code());
self::assertArrayHasKey('admin_email', $result->get_error_data()['fields']);
}
public function testUpdatesOnlyChangedValuesAndFlushesPermalinks(): void
{
Functions\when('get_option')->alias(static fn (string $key) => [
'blogname' => 'Alt',
'blogdescription' => 'Gleich',
'permalink_structure' => '',
][$key]);
Functions\expect('update_option')->once()->with('blogname', 'Neu');
$rewrite = Mockery::mock();
$rewrite->expects('set_permalink_structure')->with('/%postname%/');
$GLOBALS['wp_rewrite'] = $rewrite;
Functions\expect('flush_rewrite_rules')->once();
$log = Mockery::mock(ChangeLog::class);
$log->expects('record')->with('lit/wp-settings-update', 'option', 'blogname,permalink_structure', Mockery::type('string'))->andReturn(30);
$result = (new WpSettingsUpdateAbility(new SettingsWhitelist(), $log))->execute(['settings' => [
'blogname' => 'Neu',
'blogdescription' => 'Gleich',
'permalink_structure' => '/%postname%/',
]]);
self::assertSame(['blogname', 'permalink_structure'], array_column($result['changed'], 'id'));
self::assertSame(['blogname' => 'Alt', 'blogdescription' => 'Gleich', 'permalink_structure' => ''], $result['previous']);
self::assertSame(30, $result['log_id']);
}
public function testRestoresPreviousValuesWhenAWriteFailsPartway(): void
{
Functions\when('get_option')->alias(static fn (string $key) => [
'blogname' => 'Alt',
'blogdescription' => 'Vorher',
][$key]);
Functions\expect('update_option')->once()->with('blogname', 'Neu')->andReturn(true);
Functions\expect('update_option')->once()->with('blogdescription', 'Auch neu')->andReturn(false);
Functions\expect('update_option')->once()->with('blogname', 'Alt')->andReturn(true);
$log = Mockery::mock(ChangeLog::class);
$log->shouldNotReceive('record');
$file = (string) tempnam(sys_get_temp_dir(), 'lit-mcp-log');
$previous = ini_set('error_log', $file);
try {
$result = (new WpSettingsUpdateAbility(new SettingsWhitelist(), $log))->execute(['settings' => [
'blogname' => 'Neu',
'blogdescription' => 'Auch neu',
]]);
} finally {
ini_set('error_log', (string) $previous);
unlink($file);
}
self::assertSame('lit_write_failed', $result->get_error_code());
}
public function testReportsPartialWriteWhenRestoringAlsoFails(): void
{
Functions\when('get_option')->alias(static fn (string $key) => [
'blogname' => 'Alt',
'blogdescription' => 'Vorher',
][$key]);
Functions\expect('update_option')->once()->with('blogname', 'Neu')->andReturn(true);
Functions\expect('update_option')->once()->with('blogdescription', 'Auch neu')->andReturn(false);
Functions\expect('update_option')->once()->with('blogname', 'Alt')->andReturn(false);
$log = Mockery::mock(ChangeLog::class);
$log->shouldNotReceive('record');
$file = (string) tempnam(sys_get_temp_dir(), 'lit-mcp-log');
$previous = ini_set('error_log', $file);
try {
$result = (new WpSettingsUpdateAbility(new SettingsWhitelist(), $log))->execute(['settings' => [
'blogname' => 'Neu',
'blogdescription' => 'Auch neu',
]]);
} finally {
ini_set('error_log', (string) $previous);
unlink($file);
}
self::assertSame('lit_partial_write', $result->get_error_code());
self::assertStringContainsString('blogname', $result->get_error_message());
}
public function testSettingsToolsNeedManageOptions(): void
{
Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'manage_options');
self::assertSame('lit_forbidden', (new WpSettingsGetAbility(new SettingsWhitelist()))->permission([])->get_error_code());
self::assertSame(
'lit_forbidden',
(new WpSettingsUpdateAbility(new SettingsWhitelist(), Mockery::mock(ChangeLog::class)))->permission([])->get_error_code()
);
}
}
tests/Unit/Integrations/WordPress/WordPressIntegrationTest.php
+2
View File
@@ -33,6 +33,8 @@ final class WordPressIntegrationTest extends TestCase
'lit/menu-create',
'lit/menu-set-items',
'lit/menu-assign-location',
'lit/wp-settings-get',
'lit/wp-settings-update',
];
public function testProvidesTheWordPressAbilitiesInOrder(): void