alias(static fn (string $value): string => 'kses(' . $value . ')'); Functions\when('esc_url_raw')->alias(static fn (string $value): string => 'url(' . $value . ')'); } public function testEditorsGetKsesForRichTextAndCode(): void { Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'unfiltered_html'); $sanitizer = new WpValueSanitizer(); self::assertSame('kses()', $sanitizer->html('')); self::assertSame('kses()', $sanitizer->code('')); self::assertFalse($sanitizer->allowsUnfilteredHtml()); } public function testAdministratorsKeepRichTextAndCodeUnfiltered(): void { // Ruling S4: html() depends on unfiltered_html like code() – admin embeds survive updates. Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap === 'unfiltered_html'); $sanitizer = new WpValueSanitizer(); self::assertSame('', $sanitizer->html('')); self::assertSame('', $sanitizer->code('')); self::assertTrue($sanitizer->allowsUnfilteredHtml()); } public function testTextAndUrlDoNotDependOnTheRole(): void { Functions\when('current_user_can')->justReturn(true); $sanitizer = new WpValueSanitizer(); self::assertSame('Hallo', $sanitizer->text('Hallo')); self::assertSame('url(https://x.test/a b)', $sanitizer->url(' https://x.test/a b ')); } }