From beb8706d43ab5a86cd6179ecf19d4ced6393dba7 Mon Sep 17 00:00:00 2001
From: Jan-Niclas Loosen <janniclas@loosen-it.de>
Date: Sun, 27 Sep 2026 23:18:31 +0200
Subject: [PATCH] test: tb-smoke checks restore_url and the forbidden answer
 without Theme Builder rights

The confirmed live layout change must name the WordPress revision screen
(audit L3); an editor without the Theme Builder gets forbidden from
tb-assign and tb-activate whatever the ID (review M-9).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
---
 tests/Integration/tb-smoke.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/tests/Integration/tb-smoke.sh b/tests/Integration/tb-smoke.sh
index 6660f87..dbea23e 100755
--- a/tests/Integration/tb-smoke.sh
+++ b/tests/Integration/tb-smoke.sh
@@ -303,8 +303,9 @@ DEL=$(tool lit-divi-delete "$(jq -cn --argjson id "$BODY" --arg rev "$(rev_of "$
 [ "$(content_hash "$BODY")" = "$HASH" ] || fail "the delete dry run wrote the layout"
 DONE=$(tool lit-divi-update "$(jq -cn --argjson id "$BODY" --arg rev "$(rev_of "$BODY")" --argjson c "$CHANGE" \
   '{post_id: $id, tree_rev: $rev, confirm: true, changes: $c}')")
-echo "$DONE" | jq -e --argjson t "$TPL" '.ok == true and (.templates | map(.id) | index($t) != null)' >/dev/null \
-  || fail "confirmed layout change: $DONE"
+echo "$DONE" | jq -e --argjson t "$TPL" '.ok == true and (.templates | map(.id) | index($t) != null)
+  and (.restore_url | test("/wp-admin/revision\\.php\\?revision=[0-9]+$"))' >/dev/null \
+  || fail "confirmed layout change (templates, restore_url): $DONE"
 has "$(render_of "$PAGE" preview)" "$MARKER-geändert" || fail "the changed layout is not rendered"
 REASSIGN=$(jq -cn --argjson id "$TPL" --arg rev "$(template_rev "$TPL")" --argjson p "$PAGE" \
   '{template_id: $id, template_rev: $rev, use_on: ["singular:post_type:page:id:\($p)"], exclude_from: []}')
@@ -372,10 +373,11 @@ connect "$EDITOR_LOGIN"
 [ "$(error_code "$(ability lit/tb-list '{}')")" = "forbidden" ] || fail "editor lists the Theme Builder"
 [ "$(error_code "$(ability lit/tb-create-template "$(jq -cn --arg t "$PREFIX Redakteur" '{title: $t}')")")" = "forbidden" ] \
   || fail "editor creates a template"
-[ "$(error_code "$(ability lit/tb-activate "$(jq -cn --argjson id "$TPL" '{template_id: $id, template_rev: "abcdef012345", enabled: true, confirm: true}')")")" = "not_found" ] \
+# Review M-9: without the Theme Builder rights the refusal is forbidden whatever the ID (like tb-list).
+[ "$(error_code "$(ability lit/tb-activate "$(jq -cn --argjson id "$TPL" '{template_id: $id, template_rev: "abcdef012345", enabled: true, confirm: true}')")")" = "forbidden" ] \
   || fail "editor reaches the template"
 [ "$(error_code "$(ability lit/tb-assign "$(jq -cn --argjson id "$TPL" --argjson p "$PAGE" \
-  '{template_id: $id, template_rev: "abcdef012345", use_on: ["singular:post_type:page:id:\($p)"]}')")")" = "not_found" ] \
+  '{template_id: $id, template_rev: "abcdef012345", use_on: ["singular:post_type:page:id:\($p)"]}')")")" = "forbidden" ] \
   || fail "editor reaches the template's conditions"
 [ "$(error_code "$(tool lit-divi-outline "{\"post_id\":$BODY}")")" = "not_found" ] || fail "editor reads a Theme Builder layout"
 [ "$(enabled_of "$TPL")" = "0" ] || fail "editor refusal changed the template"