feat: whitelisted WordPress settings tools

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 00:34:26 +02:00
parent a2e9dabb17
commit 9cc9d4f2dc
7 changed files with 782 additions and 0 deletions
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\WordPress\Settings;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Integrations\WordPress\Settings\SettingsWhitelist;
+use LIT\MCP\Tests\Unit\TestCase;
+use WP_Post;
+
+final class SettingsWhitelistTest extends TestCase
+{
+    public function testWhitelistMatchesTheSpecExactly(): void
+    {
+        self::assertSame(
+            [
+                'blogname', 'blogdescription', 'WPLANG', 'timezone_string', 'date_format', 'time_format',
+                'show_on_front', 'page_on_front', 'page_for_posts', 'posts_per_page',
+                'default_comment_status', 'default_ping_status', 'permalink_structure', 'site_icon',
+            ],
+            array_keys(SettingsWhitelist::SETTINGS)
+        );
+        self::assertSame(['admin_email', 'users_can_register', 'default_role', 'siteurl', 'home'], SettingsWhitelist::BLOCKED);
+    }
+
+    public function testBlockedAndUnknownKeysAreRejected(): void
+    {
+        $whitelist = new SettingsWhitelist();
+
+        self::assertStringStartsWith('Gesperrt', (string) $whitelist->validate('admin_email', 'x@y.de', []));
+        self::assertStringStartsWith('Nicht freigegeben', (string) $whitelist->validate('template', 'twentyten', []));
+    }
+
+    public function testStaticFrontPageNeedsAPublishedDistinctPage(): void
+    {
+        Functions\when('get_option')->justReturn(0);
+        Functions\when('get_post')->alias(static fn (int $id) => match ($id) {
+            5 => new WP_Post(['ID' => 5, 'post_type' => 'page', 'post_status' => 'publish']),
+            6 => new WP_Post(['ID' => 6, 'post_type' => 'page', 'post_status' => 'draft']),
+            default => null,
+        });
+        $whitelist = new SettingsWhitelist();
+
+        self::assertNotNull($whitelist->validate('show_on_front', 'page', []));
+        self::assertNull($whitelist->validate('show_on_front', 'page', ['page_on_front' => 5]));
+        self::assertNull($whitelist->validate('page_on_front', 5, []));
+        self::assertNotNull($whitelist->validate('page_on_front', 6, []));
+        self::assertNotNull($whitelist->validate('page_on_front', 5, ['page_for_posts' => 5]));
+        self::assertNull($whitelist->validate('page_for_posts', 0, []));
+    }
+
+    public function testFormatsLanguagesAndRanges(): void
+    {
+        Functions\when('get_available_languages')->justReturn(['de_DE']);
+        Functions\when('wp_attachment_is_image')->alias(static fn (int $id): bool => $id === 33);
+        $whitelist = new SettingsWhitelist();
+
+        self::assertNull($whitelist->validate('WPLANG', 'de_DE', []));
+        self::assertNull($whitelist->validate('WPLANG', 'en_US', []));
+        self::assertStringContainsString('de_DE', (string) $whitelist->validate('WPLANG', 'fr_FR', []));
+        self::assertNull($whitelist->validate('timezone_string', 'Europe/Berlin', []));
+        self::assertNotNull($whitelist->validate('timezone_string', 'Mars/Base', []));
+        self::assertNull($whitelist->validate('permalink_structure', '/%postname%/', []));
+        self::assertNull($whitelist->validate('permalink_structure', '', []));
+        self::assertNotNull($whitelist->validate('permalink_structure', 'postname', []));
+        self::assertNotNull($whitelist->validate('posts_per_page', 0, []));
+        self::assertNotNull($whitelist->validate('default_comment_status', 'maybe', []));
+        self::assertNull($whitelist->validate('site_icon', 33, []));
+        self::assertNotNull($whitelist->validate('site_icon', 34, []));
+        self::assertSame('', $whitelist->normalize('WPLANG', 'en_US'));
+    }
+
+    public function testCurrentNormalizesLanguageAndNumbers(): void
+    {
+        Functions\when('get_option')->alias(static fn (string $key) => ['WPLANG' => '', 'page_on_front' => '5'][$key]);
+        $whitelist = new SettingsWhitelist();
+
+        self::assertSame('en_US', $whitelist->current('WPLANG'));
+        self::assertSame(5, $whitelist->current('page_on_front'));
+    }
+}