Files
Jan-Niclas LoosenandClaude Opus 5.5 234fd1edac fix(security): Pods-Meta nur lesbar, wenn Pods aktiv, aber nicht nutzbar
Ist Pods aktiv, seine API aber nicht nutzbar, melden gesampelte und registrierte Meta-Schlüssel READONLY statt schreibbar. Sonst würden Pods-Felder (auch über Pods' register_meta-Integration) an Pods vorbei geschrieben.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 11:30:05 +01:00

40 lines
1.4 KiB
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Unit\Integrations\WordPress\Schema;
use LIT\MCP\Integrations\WordPress\Schema\FieldDefinition;
use LIT\MCP\Integrations\WordPress\Schema\SampledMetaSource;
use LIT\MCP\Tests\Unit\TestCase;
use Mockery;
final class SampledMetaSourceTest extends TestCase
{
public function testReturnsVisibleKeysOfRecentPostsAsUnknown(): void
{
$db = Mockery::mock(\wpdb::class)->makePartial();
$db->expects('get_col')
->with(Mockery::on(static fn (string $sql): bool => str_contains($sql, "post_type = 'lit_person'")
&& str_contains($sql, 'LIMIT 50')))
->andReturn(['_edit_lock', 'city', 'role']);
$fields = (new SampledMetaSource($db))->fieldsFor('lit_person');
self::assertSame(['city', 'role'], array_map(static fn (FieldDefinition $f): string => $f->key, $fields));
self::assertSame(FieldDefinition::UNKNOWN, $fields[0]->status);
self::assertSame('sample', $fields[0]->source);
self::assertSame('unknown', $fields[0]->type);
}
public function testReadOnlyMakesEveryKeyReadOnly(): void
{
$db = Mockery::mock(\wpdb::class)->makePartial();
$db->expects('get_col')->andReturn(['city']);
$fields = (new SampledMetaSource($db, readOnly: true))->fieldsFor('lit_person');
self::assertSame(FieldDefinition::READONLY, $fields[0]->status);
}
}