fix: Task 5 review round 1 - restore point inside the kses window, strict map field types (S37)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/Unit/Integrations/Divi/Pages/DiviFlagsTest.php

@@ -20,11 +20,17 @@ final class DiviFlagsTest extends TestCase
 
             return false;
         });
-        Functions\when('get_post_meta')->justReturn('on');
+        Functions\when('get_post_meta')->alias(
+            static fn (int $id, string $key): string => $key === '_et_pb_show_page_creation' ? 'off' : 'on'
+        );
 
         DiviFlags::set(7);
 
-        self::assertSame(['7:_et_pb_use_divi_5=on', '7:_et_pb_use_builder=on'], $written);
+        // Like Divi's own save (SyncToServerController.php:382-387), incl. the page creation flow flag.
+        self::assertSame(
+            ['7:_et_pb_use_divi_5=on', '7:_et_pb_use_builder=on', '7:_et_pb_show_page_creation=off'],
+            $written
+        );
     }
 
     public function testThrowsWhenAFlagDoesNotReadBack(): void
@@ -38,4 +44,15 @@ final class DiviFlagsTest extends TestCase
         $this->expectExceptionMessage('_et_pb_use_builder');
         DiviFlags::set(7);
     }
+
+    public function testThrowsWhenThePageCreationFlagDoesNotReadBack(): void
+    {
+        Functions\when('update_post_meta')->justReturn(true);
+        Functions\when('get_post_meta')->justReturn('on');
+
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('_et_pb_show_page_creation');
+        DiviFlags::set(7);
+    }
 }
+

tests/Unit/Integrations/Divi/Pages/DiviSaverTest.php

@@ -30,7 +30,11 @@ final class DiviSaverTest extends TestCase
     {
         parent::setUp();
         $this->post = new WP_Post(['ID' => 7, 'post_type' => 'page', 'post_content' => 'ALT']);
-        Functions\when('wp_save_post_revision')->justReturn(811);
+        Functions\when('wp_save_post_revision')->alias(function (): int {
+            $this->calls[] = 'revision';
+
+            return 811;
+        });
         Functions\when('wp_get_post_revisions')->justReturn([811 => new WP_Post(['ID' => 811])]);
         Functions\when('update_post_meta')->alias(function (int $id, string $key, string $value): bool {
             $this->calls[] = "meta:$key=$value";
@@ -73,7 +77,12 @@ final class DiviSaverTest extends TestCase
 
         self::assertSame(['revision_id' => 811, 'warnings' => []], $saved);
         self::assertSame(
-            ['kses off', 'update', 'kses on', 'meta:_et_pb_use_divi_5=on', 'meta:_et_pb_use_builder=on'],
+            // Ruling S37: the restore-point revision is captured inside the same kses-off window –
+            // it copies the stored content, and kses would strip an admin's embeds from it.
+            [
+                'kses off', 'revision', 'update', 'kses on',
+                'meta:_et_pb_use_divi_5=on', 'meta:_et_pb_use_builder=on', 'meta:_et_pb_show_page_creation=off',
+            ],
             $this->calls
         );
     }
@@ -87,6 +96,7 @@ final class DiviSaverTest extends TestCase
         $saved = (new DiviSaver())->save($this->post, 'NEU');
 
         self::assertNotContains('kses off', $this->calls);
+        self::assertSame(['revision'], array_slice($this->calls, 0, 1));
         self::assertSame([DiviSaver::CHANGED_ON_SAVE], $saved['warnings']);
     }
 
@@ -141,7 +151,10 @@ final class DiviSaverTest extends TestCase
             self::assertTrue($e->rolledBack);
             self::assertSame(['NEU', 'ALT'], $written);
             // The kses bypass is restored in finally – after the failed save and after the restore.
-            self::assertSame(['kses off', 'update', 'kses on', 'kses off', 'update', 'kses on'], $this->calls);
+            self::assertSame(
+                ['kses off', 'revision', 'update', 'kses on', 'kses off', 'update', 'kses on'],
+                $this->calls
+            );
         }
     }
 

tests/Unit/Integrations/Divi/Pages/DynamicContentMapTest.php

@@ -187,6 +187,9 @@ final class DynamicContentMapTest extends TestCase
         }
         self::assertNull($map);
         self::assertStringContainsString('filter exploded', (string) file_get_contents($log));
+        // The message only – no stack trace in the log (review M-4).
+        self::assertStringNotContainsString('#0 ', (string) file_get_contents($log));
+        self::assertStringNotContainsString('RuntimeException', (string) file_get_contents($log));
         unlink($log);
 
         // Without Divi (no DynamicContentOptions class, as in these unit tests).

tests/Unit/Integrations/Divi/Pages/WpValueSanitizerTest.php

@@ -46,4 +46,14 @@ final class WpValueSanitizerTest extends TestCase
         self::assertSame('Hallo', $sanitizer->text('<b>Hallo</b>'));
         self::assertSame('url(https://x.test/a b)', $sanitizer->url('  https://x.test/a b '));
     }
+
+    public function testCanReadPostAsksWordPress(): void
+    {
+        Functions\when('current_user_can')->alias(static fn (string $cap, int $id = 0): bool => $cap === 'read_post' && $id === 12);
+        $sanitizer = new WpValueSanitizer();
+
+        self::assertTrue($sanitizer->canReadPost(12));
+        self::assertFalse($sanitizer->canReadPost(13));
+    }
 }
+