feat: role gate with lit_mcp_use capability

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-25 15:18:46 +02:00
parent a8c8cee7e5
commit aee7efe0a8
3 changed files with 168 additions and 0 deletions
@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit;
+
+use Brain\Monkey\Filters;
+use Brain\Monkey\Functions;
+use LIT\MCP\Access;
+use WP_User;
+
+final class AccessTest extends TestCase
+{
+    public function testDefaultsToAdministratorOnly(): void
+    {
+        Functions\expect('get_option')
+            ->once()
+            ->with(Access::OPTION, ['administrator'])
+            ->andReturn(['administrator']);
+
+        self::assertSame(['administrator'], (new Access())->allowedRoles());
+    }
+
+    public function testRoleListIsFilterable(): void
+    {
+        Functions\when('get_option')->justReturn(['administrator']);
+        Filters\expectApplied('lit_mcp_allowed_roles')
+            ->once()
+            ->andReturn(['administrator', 'editor']);
+
+        self::assertSame(['administrator', 'editor'], (new Access())->allowedRoles());
+    }
+
+    public function testGrantsCapabilityToAllowedRole(): void
+    {
+        Functions\when('get_option')->justReturn(['editor']);
+
+        $caps = (new Access())->grantCapability(
+            [],
+            [Access::CAPABILITY],
+            [],
+            new WP_User(5, ['editor'])
+        );
+
+        self::assertTrue($caps[Access::CAPABILITY]);
+    }
+
+    public function testDoesNotGrantCapabilityToOtherRoles(): void
+    {
+        Functions\when('get_option')->justReturn(['administrator']);
+
+        $caps = (new Access())->grantCapability(
+            [],
+            [Access::CAPABILITY],
+            [],
+            new WP_User(7, ['subscriber'])
+        );
+
+        self::assertArrayNotHasKey(Access::CAPABILITY, $caps);
+    }
+
+    public function testCorruptOptionFallsBackToAdministrator(): void
+    {
+        Functions\when('get_option')->justReturn('not-an-array');
+
+        self::assertSame(['administrator'], (new Access())->allowedRoles());
+    }
+
+    public function testRegisterRoutesAdapterMetaToolCapabilitiesToOwnCapability(): void
+    {
+        // Brain Monkey records add_filter() but never runs callbacks, so we
+        // capture each registered callback and invoke it ourselves.
+        foreach (['discover_abilities', 'get_ability_info', 'execute_ability'] as $tool) {
+            Filters\expectAdded("mcp_adapter_{$tool}_capability")
+                ->once()
+                ->whenHappen(static function (callable $callback): void {
+                    self::assertSame(Access::CAPABILITY, $callback('read'));
+                });
+        }
+
+        $access = new Access();
+        $access->register();
+
+        self::assertNotFalse(has_filter('user_has_cap', [$access, 'grantCapability']));
+    }
+}