feat: media usage finder and media-get tool

Usage search distinguishes certain (ID referenced) and possible (file URL only) usages, hides titles the user cannot read, and keeps queries bounded. MediaGuard checks per-attachment capabilities and refuses trashed media unless the caller opts in. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 01:54:55 +02:00
parent 51e8846e1f
commit a2a2da1ae7
14 changed files with 1182 additions and 3 deletions
@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Integrations\Media;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Integrations\Media\MediaGuard;
+use LIT\MCP\Tests\Unit\TestCase;
+use WP_Post;
+
+final class MediaGuardTest extends TestCase
+{
+    public function testInvalidIdIsAValidationError(): void
+    {
+        self::assertSame('lit_validation_failed', MediaGuard::attachment('abc')->get_error_code());
+        self::assertSame('lit_validation_failed', MediaGuard::attachment(0)->get_error_code());
+    }
+
+    public function testMissingOrNonAttachmentIsNotFound(): void
+    {
+        Functions\when('get_post')->justReturn(null);
+        self::assertSame('lit_not_found', MediaGuard::attachment(33)->get_error_code());
+
+        Functions\when('get_post')->justReturn(new WP_Post(['ID' => 33, 'post_type' => 'page']));
+        self::assertSame('lit_not_found', MediaGuard::attachment(33)->get_error_code());
+    }
+
+    public function testChecksTheRequestedCapabilityOnTheAttachment(): void
+    {
+        $attachment = new WP_Post(['ID' => 33, 'post_type' => 'attachment', 'post_status' => 'inherit']);
+        Functions\when('get_post')->justReturn($attachment);
+        Functions\expect('current_user_can')->once()->with('delete_post', 33)->andReturn(false);
+
+        self::assertSame('lit_forbidden', MediaGuard::attachment('33', 'delete_post')->get_error_code());
+    }
+
+    public function testRefusesTrashedAttachmentsUnlessAllowed(): void
+    {
+        $attachment = new WP_Post(['ID' => 33, 'post_type' => 'attachment', 'post_status' => 'trash']);
+        Functions\when('get_post')->justReturn($attachment);
+        Functions\when('current_user_can')->justReturn(true);
+
+        $error = MediaGuard::attachment(33);
+        self::assertSame('lit_validation_failed', $error->get_error_code());
+        self::assertStringContainsString('Papierkorb', $error->get_error_message());
+        self::assertSame($attachment, MediaGuard::attachment(33, 'read_post', true));
+    }
+}