feat: settings page with connection tab, admin notices and site health test

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Admin/AdminNotices.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+/**
+ * Admin notices for administrators (Etappe-0 follow-up d). Uses only cached check
+ * results so no HTTP request runs on ordinary admin page loads.
+ */
+final class AdminNotices
+{
+    public function __construct(private ConnectionStatus $status)
+    {
+    }
+
+    public function register(): void
+    {
+        add_action('admin_notices', [$this, 'render']);
+    }
+
+    /** @return list<string> */
+    public function messages(bool $onOwnPage): array
+    {
+        $messages = [];
+        if (! $this->status->oauthEnabled()) {
+            $messages[] = __(
+                'LIT MCP: Der OAuth-Server ist deaktiviert (Filter wpmedia_mcp_oauth_server_enabled).',
+                'wp-lit-mcp'
+            ) . ' ' . __('Claude kann sich nicht verbinden.', 'wp-lit-mcp');
+        }
+
+        $discovery = $this->status->discovery(false);
+        if (is_array($discovery) && ($discovery['status'] ?? 'good') === 'critical') {
+            $messages[] = __(
+                'LIT MCP: Die OAuth-Discovery-Dokumente unter /.well-known/ sind nicht erreichbar.',
+                'wp-lit-mcp'
+            ) . ' ' . __('Details unter Werkzeuge → Website-Zustand.', 'wp-lit-mcp');
+        }
+
+        if ($onOwnPage && ! $this->status->https()) {
+            $messages[] = __(
+                'LIT MCP: Die Website läuft ohne HTTPS; claude.ai verbindet sich nur mit HTTPS-Websites.',
+                'wp-lit-mcp'
+            );
+        }
+
+        return $messages;
+    }
+
+    public function render(): void
+    {
+        if (! current_user_can('manage_options')) {
+            return;
+        }
+
+        $screen = function_exists('get_current_screen') ? get_current_screen() : null;
+        $onOwnPage = is_object($screen) && $screen->id === 'settings_page_' . SettingsPage::SLUG;
+        foreach ($this->messages($onOwnPage) as $message) {
+            printf('<div class="notice notice-warning"><p>%s</p></div>', esc_html($message));
+        }
+    }
+}

src/Admin/AdminTab.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+/**
+ * One tab of the settings page "Einstellungen → LIT MCP".
+ */
+interface AdminTab
+{
+    public function slug(): string;
+
+    public function label(): string;
+
+    /** Registers Settings API options; runs on admin_init. */
+    public function registerSettings(): void;
+
+    /** Registers admin-post.php handlers; runs when the page is registered. */
+    public function registerActions(): void;
+
+    public function render(): void;
+}

src/Admin/ConnectionStatus.php

@@ -0,0 +1,129 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+use LIT\MCP\Server\ServerRegistrar;
+use WP\MCP\Core\McpAdapter;
+use WPMedia\MCP\OAuth\Auth\Discovery\HealthCheck;
+use WPMedia\MCP\OAuth\Context as OAuthContext;
+
+/**
+ * Connection checks for the settings page, admin notices and Site Health.
+ * Not final so notices and Site Health can be tested with a mock.
+ */
+class ConnectionStatus
+{
+    public const ENDPOINT_TRANSIENT = 'lit_mcp_endpoint_check';
+    private const CACHE_SECONDS = 300;
+
+    /** @var callable(): bool */
+    private $oauthEnabled;
+
+    public function __construct(?callable $oauthEnabled = null)
+    {
+        $this->oauthEnabled = $oauthEnabled ?? static fn (): bool => (new OAuthContext())->is_enabled();
+    }
+
+    public static function serverUrl(): string
+    {
+        return rest_url(ServerRegistrar::NAMESPACE . '/' . ServerRegistrar::ROUTE);
+    }
+
+    public function oauthEnabled(): bool
+    {
+        return ($this->oauthEnabled)();
+    }
+
+    public function adapterLoaded(): bool
+    {
+        return class_exists(McpAdapter::class);
+    }
+
+    public function https(): bool
+    {
+        return str_starts_with((string) home_url(), 'https://');
+    }
+
+    /** @return array<string, mixed>|null mcp-oauth's discovery self check (label, status, …). */
+    public function discovery(bool $allowFetch): ?array
+    {
+        if (! $allowFetch) {
+            $cached = get_transient(HealthCheck::TRANSIENT_KEY);
+
+            return is_array($cached) ? $cached : null;
+        }
+
+        return (new HealthCheck(new OAuthContext()))->run_self_check();
+    }
+
+    /** @return array{ok: bool, message: string}|null */
+    public function endpoint(bool $allowFetch): ?array
+    {
+        $cached = get_transient(self::ENDPOINT_TRANSIENT);
+        if (is_array($cached)) {
+            return $cached;
+        }
+
+        if (! $allowFetch) {
+            return null;
+        }
+
+        $response = wp_remote_post(self::serverUrl(), [
+            'timeout' => 5,
+            'headers' => ['Content-Type' => 'application/json'],
+            'body' => '{"jsonrpc":"2.0","id":1,"method":"ping"}',
+        ]);
+
+        if (is_wp_error($response)) {
+            $result = ['ok' => false, 'message' => 'Endpunkt nicht erreichbar: ' . $response->get_error_message()];
+        } else {
+            $code = (int) wp_remote_retrieve_response_code($response);
+            $challenge = (string) wp_remote_retrieve_header($response, 'www-authenticate');
+            $result = $code === 401 && str_starts_with($challenge, 'Bearer')
+                ? ['ok' => true, 'message' => 'Ohne Token: 401 mit WWW-Authenticate – korrekt.']
+                : ['ok' => false, 'message' => sprintf('Erwartet 401 mit WWW-Authenticate, erhalten HTTP %d.', $code)];
+        }
+
+        set_transient(self::ENDPOINT_TRANSIENT, $result, self::CACHE_SECONDS);
+
+        return $result;
+    }
+
+    /** @return list<array{label: string, ok: ?bool, message: string}> */
+    public function checks(bool $allowFetch): array
+    {
+        $adapter = $this->adapterLoaded();
+        $oauth = $this->oauthEnabled();
+        $https = $this->https();
+        $discovery = $this->discovery($allowFetch);
+        $endpoint = $this->endpoint($allowFetch);
+
+        return [
+            ['label' => 'MCP-Adapter', 'ok' => $adapter, 'message' => $adapter ? 'geladen' : 'fehlt'],
+            [
+                'label' => 'OAuth-Server',
+                'ok' => $oauth,
+                'message' => $oauth ? 'aktiv' : 'deaktiviert (Filter wpmedia_mcp_oauth_server_enabled)',
+            ],
+            [
+                'label' => 'HTTPS',
+                'ok' => $https,
+                'message' => $https ? 'aktiv' : 'Website läuft ohne HTTPS – claude.ai verbindet sich nur über HTTPS',
+            ],
+            [
+                'label' => 'Discovery (/.well-known/)',
+                'ok' => $discovery === null ? null : ($discovery['status'] ?? '') === 'good',
+                'message' => $discovery === null
+                    ? 'noch nicht geprüft'
+                    : wp_strip_all_tags((string) ($discovery['label'] ?? '')),
+            ],
+            [
+                'label' => 'Endpunkt ohne Token',
+                'ok' => $endpoint['ok'] ?? null,
+                'message' => $endpoint['message'] ?? 'noch nicht geprüft',
+            ],
+        ];
+    }
+}

src/Admin/ConnectionTab.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+final class ConnectionTab implements AdminTab
+{
+    public function __construct(private ConnectionStatus $status)
+    {
+    }
+
+    public function slug(): string
+    {
+        return 'verbindung';
+    }
+
+    public function label(): string
+    {
+        return __('Verbindung', 'wp-lit-mcp');
+    }
+
+    public function registerSettings(): void
+    {
+    }
+
+    public function registerActions(): void
+    {
+    }
+
+    public function render(): void
+    {
+        echo '<h2>' . esc_html__('MCP-Server', 'wp-lit-mcp') . '</h2>';
+        printf(
+            '<p><label for="lit-mcp-url">%s</label><br>'
+                . '<input id="lit-mcp-url" type="text" class="large-text code" readonly value="%s"></p>',
+            esc_html__('Server-URL für den Connector', 'wp-lit-mcp'),
+            esc_attr(ConnectionStatus::serverUrl())
+        );
+        echo '<p>' . esc_html__(
+            'In claude.ai unter Einstellungen → Connectors → „Add custom connector“ eintragen;',
+            'wp-lit-mcp'
+        ) . ' ' . esc_html__('Die Anmeldung läuft danach über diese Website.', 'wp-lit-mcp') . '</p>';
+
+        echo '<h2>' . esc_html__('Status', 'wp-lit-mcp') . '</h2><table class="widefat striped"><tbody>';
+        foreach ($this->status->checks(true) as $check) {
+            $state = $check['ok'] === null ? '–' : ($check['ok'] ? '✔' : '✖');
+            printf(
+                '<tr><th scope="row">%s</th><td>%s</td><td>%s</td></tr>',
+                esc_html($check['label']),
+                esc_html($state),
+                esc_html($check['message'])
+            );
+        }
+        echo '</tbody></table>';
+        echo '<p>' . esc_html__('Weitere Prüfungen unter Werkzeuge → Website-Zustand.', 'wp-lit-mcp') . '</p>';
+    }
+}

src/Admin/SettingsPage.php

@@ -0,0 +1,116 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+/**
+ * Settings page "Einstellungen → LIT MCP" with tabs (spec §8.4). Settings API, no JS framework.
+ */
+final class SettingsPage
+{
+    public const SLUG = 'lit-mcp';
+
+    /** @var array<string, AdminTab> */
+    private array $tabs = [];
+
+    /** @param list<AdminTab> $tabs The first tab is the default. */
+    public function __construct(array $tabs)
+    {
+        foreach ($tabs as $tab) {
+            $this->tabs[$tab->slug()] = $tab;
+        }
+    }
+
+    public function register(): void
+    {
+        add_action('admin_menu', [$this, 'addMenu']);
+        add_action('admin_init', [$this, 'registerSettings']);
+        foreach ($this->tabs as $tab) {
+            $tab->registerActions();
+        }
+    }
+
+    public function addMenu(): void
+    {
+        add_options_page(
+            __('LIT MCP', 'wp-lit-mcp'),
+            __('LIT MCP', 'wp-lit-mcp'),
+            'manage_options',
+            self::SLUG,
+            [$this, 'render']
+        );
+    }
+
+    public function registerSettings(): void
+    {
+        foreach ($this->tabs as $tab) {
+            $tab->registerSettings();
+        }
+    }
+
+    /** @return list<string> */
+    public function tabSlugs(): array
+    {
+        return array_keys($this->tabs);
+    }
+
+    public function currentTab(): string
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only tab switch.
+        $requested = isset($_GET['tab']) ? sanitize_key(wp_unslash((string) $_GET['tab'])) : '';
+
+        return isset($this->tabs[$requested]) ? $requested : (string) array_key_first($this->tabs);
+    }
+
+    /** @param array<string, string> $args */
+    public static function url(string $tab = '', array $args = []): string
+    {
+        $query = array_merge(['page' => self::SLUG], $tab !== '' ? ['tab' => $tab] : [], $args);
+
+        return add_query_arg($query, admin_url('options-general.php'));
+    }
+
+    public function render(): void
+    {
+        if (! current_user_can('manage_options')) {
+            return;
+        }
+
+        $current = $this->currentTab();
+        echo '<div class="wrap"><h1>' . esc_html__('LIT MCP', 'wp-lit-mcp') . '</h1>';
+        $this->renderNotice();
+        echo '<nav class="nav-tab-wrapper">';
+        foreach ($this->tabs as $slug => $tab) {
+            printf(
+                '<a href="%s" class="nav-tab%s">%s</a>',
+                esc_url(self::url($slug)),
+                $slug === $current ? ' nav-tab-active' : '',
+                esc_html($tab->label())
+            );
+        }
+        echo '</nav>';
+        $this->tabs[$current]->render();
+        echo '</div>';
+    }
+
+    private function renderNotice(): void
+    {
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- display only.
+        $key = isset($_GET['lit_mcp_notice']) ? sanitize_key(wp_unslash((string) $_GET['lit_mcp_notice'])) : '';
+        $notice = match ($key) {
+            'revoked' => ['success', __('Verbindung widerrufen.', 'wp-lit-mcp')],
+            'revoke_failed' => ['error', __('Die Verbindung konnte nicht widerrufen werden.', 'wp-lit-mcp')],
+            'cleared' => ['success', __('Protokoll geleert.', 'wp-lit-mcp')],
+            default => null,
+        };
+
+        if ($notice !== null) {
+            printf(
+                '<div class="notice notice-%s is-dismissible"><p>%s</p></div>',
+                esc_attr($notice[0]),
+                esc_html($notice[1])
+            );
+        }
+    }
+}

src/Admin/SiteHealth.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Admin;
+
+/**
+ * Site Health test for our MCP endpoint (401 + WWW-Authenticate without a token).
+ * The discovery documents are covered by mcp-oauth's own Site Health test.
+ */
+final class SiteHealth
+{
+    public const TEST = 'lit_mcp_endpoint';
+
+    public function __construct(private ConnectionStatus $status)
+    {
+    }
+
+    public function register(): void
+    {
+        add_filter('site_status_tests', [$this, 'addTest']);
+    }
+
+    public function addTest(mixed $tests): mixed
+    {
+        if (! is_array($tests)) {
+            return $tests;
+        }
+
+        $tests['direct'][self::TEST] = [
+            'label' => __('LIT MCP Endpunkt', 'wp-lit-mcp'),
+            'test' => [$this, 'run'],
+        ];
+
+        return $tests;
+    }
+
+    /** @return array<string, mixed> */
+    public function run(): array
+    {
+        $oauth = $this->status->oauthEnabled();
+        $endpoint = $oauth ? $this->status->endpoint(true) : null;
+        $good = $oauth && ($endpoint['ok'] ?? false) === true;
+        $detail = $oauth
+            ? (string) ($endpoint['message'] ?? '')
+            : __('Der OAuth-Server ist deaktiviert (Filter wpmedia_mcp_oauth_server_enabled).', 'wp-lit-mcp');
+
+        return [
+            'label' => $good
+                ? __('Der LIT-MCP-Endpunkt ist erreichbar und verlangt OAuth', 'wp-lit-mcp')
+                : __('Der LIT-MCP-Endpunkt ist nicht nutzbar', 'wp-lit-mcp'),
+            'status' => $good ? 'good' : 'critical',
+            'badge' => ['label' => 'LIT MCP', 'color' => $good ? 'blue' : 'red'],
+            'description' => '<p>' . esc_html($detail) . '</p>',
+            'actions' => sprintf(
+                '<a href="%s">%s</a>',
+                esc_url(SettingsPage::url('verbindung')),
+                esc_html__('Einstellungen → LIT MCP', 'wp-lit-mcp')
+            ),
+            'test' => self::TEST,
+        ];
+    }
+}

src/Plugin.php

@@ -6,6 +6,11 @@ namespace LIT\MCP;
 
 use LIT\MCP\Abilities\AbilityRegistrar;
 use LIT\MCP\Abilities\ExposurePolicy;
+use LIT\MCP\Admin\AdminNotices;
+use LIT\MCP\Admin\ConnectionStatus;
+use LIT\MCP\Admin\ConnectionTab;
+use LIT\MCP\Admin\SettingsPage;
+use LIT\MCP\Admin\SiteHealth;
 use LIT\MCP\ChangeLog\ChangeLog;
 use LIT\MCP\ChangeLog\ChangeLogCleanup;
 use LIT\MCP\ChangeLog\ChangeLogInstaller;
@@ -30,6 +35,7 @@ final class Plugin
     public const VERSION = '0.1.0';
 
     private static string $pluginFile = '';
+    private static ?SettingsPage $settingsPage = null;
 
     public static function boot(string $pluginFile): void
     {
@@ -68,9 +74,24 @@ final class Plugin
             $policy
         ))->register();
 
+        $status = new ConnectionStatus();
+        (new SiteHealth($status))->register();
+        self::$settingsPage = new SettingsPage([
+            new ConnectionTab($status),
+        ]);
+        if (is_admin()) {
+            self::$settingsPage->register();
+            (new AdminNotices($status))->register();
+        }
+
         \WPMedia\MCP\OAuth\Bootstrap::instance();
     }
 
+    public static function settingsPage(): ?SettingsPage
+    {
+        return self::$settingsPage;
+    }
+
     public static function pluginDir(): string
     {
         return dirname(self::$pluginFile);

tests/Unit/Admin/AdminNoticesTest.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Admin\AdminNotices;
+use LIT\MCP\Admin\ConnectionStatus;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+
+final class AdminNoticesTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\stubTranslationFunctions();
+    }
+
+    private function status(bool $oauth, ?array $discovery, bool $https): ConnectionStatus
+    {
+        $status = Mockery::mock(ConnectionStatus::class);
+        $status->allows('oauthEnabled')->andReturn($oauth);
+        $status->allows('discovery')->with(false)->andReturn($discovery);
+        $status->allows('https')->andReturn($https);
+
+        return $status;
+    }
+
+    public function testWarnsAboutDisabledOAuthAndBrokenDiscoveryEverywhere(): void
+    {
+        $messages = (new AdminNotices($this->status(false, ['status' => 'critical'], true)))->messages(false);
+
+        self::assertCount(2, $messages);
+        self::assertStringContainsString('OAuth-Server ist deaktiviert', $messages[0]);
+        self::assertStringContainsString('/.well-known/', $messages[1]);
+    }
+
+    public function testHttpsHintOnlyOnTheSettingsPage(): void
+    {
+        $notices = new AdminNotices($this->status(true, null, false));
+
+        self::assertSame([], $notices->messages(false));
+        self::assertCount(1, $notices->messages(true));
+    }
+}

tests/Unit/Admin/ConnectionStatusTest.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Admin\ConnectionStatus;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+
+final class ConnectionStatusTest extends TestCase
+{
+    public function testEndpointCheckExpects401WithBearerChallengeAndCachesIt(): void
+    {
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('rest_url')->justReturn('https://kunde.de/wp-json/mcp/mcp-oauth-server');
+        Functions\expect('wp_remote_post')->once()->with('https://kunde.de/wp-json/mcp/mcp-oauth-server', Mockery::type('array'))
+            ->andReturn(['response' => ['code' => 401]]);
+        Functions\when('wp_remote_retrieve_response_code')->justReturn(401);
+        Functions\when('wp_remote_retrieve_header')->justReturn('Bearer realm="https://kunde.de"');
+        Functions\expect('set_transient')->once()
+            ->with('lit_mcp_endpoint_check', Mockery::on(static fn (array $value): bool => $value['ok'] === true), 300);
+
+        $result = (new ConnectionStatus(static fn (): bool => true))->endpoint(true);
+
+        self::assertTrue($result['ok']);
+    }
+
+    public function testEndpointAnsweringWithoutChallengeIsReported(): void
+    {
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('rest_url')->justReturn('https://kunde.de/wp-json/mcp/mcp-oauth-server');
+        Functions\when('wp_remote_post')->justReturn(['response' => ['code' => 200]]);
+        Functions\when('wp_remote_retrieve_response_code')->justReturn(200);
+        Functions\when('wp_remote_retrieve_header')->justReturn('');
+        Functions\when('set_transient')->justReturn(true);
+
+        $result = (new ConnectionStatus(static fn (): bool => true))->endpoint(true);
+
+        self::assertFalse($result['ok']);
+        self::assertStringContainsString('200', $result['message']);
+    }
+
+    public function testChecksWithoutFetchingUseOnlyCachedResults(): void
+    {
+        Functions\when('get_transient')->justReturn(false);
+        Functions\expect('wp_remote_post')->never();
+        Functions\when('home_url')->justReturn('http://kunde.test');
+
+        $checks = (new ConnectionStatus(static fn (): bool => false))->checks(false);
+
+        $byLabel = array_column($checks, null, 'label');
+        self::assertFalse($byLabel['OAuth-Server']['ok']);
+        self::assertFalse($byLabel['HTTPS']['ok']);
+        self::assertNull($byLabel['Discovery (/.well-known/)']['ok']);
+        self::assertNull($byLabel['Endpunkt ohne Token']['ok']);
+    }
+}

tests/Unit/Admin/SettingsPageTest.php

@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Admin\AdminTab;
+use LIT\MCP\Admin\SettingsPage;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+
+final class SettingsPageTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\stubEscapeFunctions();
+        Functions\stubTranslationFunctions();
+        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://kunde.de/wp-admin/' . $path);
+        Functions\when('add_query_arg')->alias(static fn (array $args, string $url): string => $url . '?' . http_build_query($args));
+        Functions\when('sanitize_key')->alias(static fn (string $key): string => strtolower((string) preg_replace('/[^a-z0-9_\-]/i', '', $key)));
+    }
+
+    protected function tearDown(): void
+    {
+        unset($_GET['tab'], $_GET['lit_mcp_notice']);
+        parent::tearDown();
+    }
+
+    private function tab(string $slug, string $label): AdminTab
+    {
+        $tab = Mockery::mock(AdminTab::class);
+        $tab->allows('slug')->andReturn($slug);
+        $tab->allows('label')->andReturn($label);
+        $tab->allows('registerActions');
+        $tab->allows('render')->andReturnUsing(static function () use ($slug): void {
+            echo '<p>Inhalt ' . $slug . '</p>';
+        });
+
+        return $tab;
+    }
+
+    public function testRendersTabsAndTheRequestedTab(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $_GET['tab'] = 'zugriff';
+        $page = new SettingsPage([$this->tab('verbindung', 'Verbindung'), $this->tab('zugriff', 'Zugriff')]);
+
+        ob_start();
+        $page->render();
+        $html = (string) ob_get_clean();
+
+        self::assertStringContainsString('Inhalt zugriff', $html);
+        self::assertStringNotContainsString('Inhalt verbindung', $html);
+        self::assertMatchesRegularExpression('/tab=zugriff" class="nav-tab nav-tab-active"/', $html);
+        self::assertSame(['verbindung', 'zugriff'], $page->tabSlugs());
+    }
+
+    public function testUnknownTabFallsBackToTheFirstAndNoticesAreShown(): void
+    {
+        Functions\when('current_user_can')->justReturn(true);
+        $_GET['tab'] = '../../evil';
+        $_GET['lit_mcp_notice'] = 'revoked';
+        $page = new SettingsPage([$this->tab('verbindung', 'Verbindung')]);
+
+        ob_start();
+        $page->render();
+        $html = (string) ob_get_clean();
+
+        self::assertSame('verbindung', $page->currentTab());
+        self::assertStringContainsString('Inhalt verbindung', $html);
+        self::assertStringContainsString('notice-success', $html);
+    }
+
+    public function testNothingIsRenderedWithoutManageOptions(): void
+    {
+        Functions\when('current_user_can')->justReturn(false);
+
+        ob_start();
+        (new SettingsPage([$this->tab('verbindung', 'Verbindung')]))->render();
+
+        self::assertSame('', ob_get_clean());
+    }
+
+    public function testRegisterHooksMenuSettingsAndTabActions(): void
+    {
+        $tab = Mockery::mock(AdminTab::class);
+        $tab->allows('slug')->andReturn('verbindung');
+        $tab->expects('registerActions')->once();
+        $page = new SettingsPage([$tab]);
+        Functions\expect('add_action')->once()->with('admin_menu', [$page, 'addMenu']);
+        Functions\expect('add_action')->once()->with('admin_init', [$page, 'registerSettings']);
+
+        $page->register();
+    }
+}

tests/Unit/Admin/SiteHealthTest.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Admin;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Admin\ConnectionStatus;
+use LIT\MCP\Admin\SiteHealth;
+use LIT\MCP\Tests\Unit\TestCase;
+use Mockery;
+
+final class SiteHealthTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\stubEscapeFunctions();
+        Functions\stubTranslationFunctions();
+        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://kunde.de/wp-admin/' . $path);
+        Functions\when('add_query_arg')->alias(static fn (array $args, string $url): string => $url . '?' . http_build_query($args));
+    }
+
+    public function testAddsADirectTest(): void
+    {
+        $health = new SiteHealth(Mockery::mock(ConnectionStatus::class));
+
+        $tests = $health->addTest(['direct' => []]);
+
+        self::assertSame([$health, 'run'], $tests['direct']['lit_mcp_endpoint']['test']);
+    }
+
+    public function testGoodWhenOAuthIsOnAndTheEndpointChallenges(): void
+    {
+        $status = Mockery::mock(ConnectionStatus::class);
+        $status->allows('oauthEnabled')->andReturn(true);
+        $status->allows('endpoint')->with(true)->andReturn(['ok' => true, 'message' => '401 mit WWW-Authenticate']);
+
+        $result = (new SiteHealth($status))->run();
+
+        self::assertSame('good', $result['status']);
+        self::assertSame('lit_mcp_endpoint', $result['test']);
+    }
+
+    public function testCriticalWhenOAuthIsDisabled(): void
+    {
+        $status = Mockery::mock(ConnectionStatus::class);
+        $status->allows('oauthEnabled')->andReturn(false);
+
+        $result = (new SiteHealth($status))->run();
+
+        self::assertSame('critical', $result['status']);
+        self::assertStringContainsString('deaktiviert', $result['description']);
+    }
+}