fix: library IDs stay hidden without library access (ruling P13)

Outline, node-get, write outlines, the render summary and replace-text's
opaque-node match name no library ID unless the library group is visible
and the user has divi_library; read-only still names them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-09-27 15:00:39 +02:00
co-authored by Claude Opus 5.5
parent 06f13799de
commit c7ce924e5a
19 changed files with 351 additions and 28 deletions
@@ -180,4 +180,32 @@ final class LibraryAccessTest extends TestCase
LibraryFixtures::given([], ['edit_posts']);
self::assertToolError(LibraryFixtures::access()->canInsert(), 'forbidden');
}
/** Ruling P13: library IDs are named only while the library is visible and the user has its right. */
public function testRevealsIdsOnlyWithTheVisibleLibraryAndItsRight(): void
{
LibraryFixtures::given([]);
self::assertTrue(LibraryFixtures::access()->revealsIds());
self::assertFalse(LibraryFixtures::access(['divi_library'])->revealsIds());
$hidden = new LibraryAccess(LibraryFixtures::store(), LibraryFixtures::roles(), null, static fn (): bool => false);
self::assertFalse($hidden->revealsIds());
LibraryFixtures::given([], ['edit_posts']);
self::assertFalse(LibraryFixtures::access()->revealsIds());
}
/** Ruling P13: "nur lesen" (group read-only) still names library IDs – only "deaktiviert" hides them. */
public function testAReadOnlyLibraryStillRevealsIds(): void
{
LibraryFixtures::given([]);
self::assertTrue(LibraryFixtures::access([], false)->revealsIds());
$readOnly = new LibraryAccess(
LibraryFixtures::store(),
LibraryFixtures::roles(),
static fn (): bool => false,
static fn (): bool => true
);
self::assertTrue($readOnly->revealsIds());
}
}