WP-LIT-MCP/tests/Unit/Integrations/Divi/Library/LibraryAccessTest.php

<?php

declare(strict_types=1);

namespace LIT\MCP\Tests\Unit\Integrations\Divi\Library;

use LIT\MCP\Integrations\Divi\Library\LibraryAccess;
use LIT\MCP\Tests\Support\LibraryFixtures;
use LIT\MCP\Tests\Unit\TestCase;
use WP_Post;

final class LibraryAccessTest extends TestCase
{
    public function testReadsLibraryItemsAndLeavesOtherIdsToPostGuard(): void
    {
        $item = LibraryFixtures::item(1055);
        LibraryFixtures::given([$item, LibraryFixtures::page('')]);
        $access = LibraryFixtures::access();

        self::assertSame($item, $access->item(1055, false));
        self::assertNull($access->item(LibraryFixtures::PAGE, false), 'a page is PostGuard\'s business');
        self::assertNull($access->item(9999, false));
        self::assertNull($access->item('abc', false));
        self::assertNull($access->canList());
    }

    public function testReadingNeedsEditPostsTheDiviLibraryRoleAndEditPost(): void
    {
        $item = LibraryFixtures::item(1055);

        LibraryFixtures::given([$item], ['edit_posts']);
        self::assertToolError(LibraryFixtures::access()->item(1055, false), 'forbidden');

        LibraryFixtures::given([$item]);
        self::assertToolError(LibraryFixtures::access(['divi_library'])->item(1055, false), 'forbidden');

        LibraryFixtures::given([$item], ['edit_post']);
        $refusal = LibraryFixtures::access()->item(1055, false);
        self::assertToolError($refusal, 'forbidden');
        self::assertStringContainsString('Bibliothekseintrag 1055', $refusal->get_error_message());
    }

    public function testTrashedItemsCanBeRead(): void
    {
        $item = LibraryFixtures::item(1055, ['post_status' => 'trash']);
        LibraryFixtures::given([$item]);

        self::assertInstanceOf(WP_Post::class, LibraryFixtures::access()->item(1055, false));
    }

    public function testGlobalFromTheStore(): void
    {
        $access = LibraryFixtures::access();

        self::assertTrue($access->isGlobal(LibraryFixtures::item(1058)));
        self::assertFalse($access->isGlobal(LibraryFixtures::item(1055)));
    }

    public function testRefusalsNameNeitherTitleNorContent(): void
    {
        $item = LibraryFixtures::item(1055, ['post_status' => 'private', 'post_title' => 'Geheimer Entwurf']);

        foreach ([['edit_posts'], ['edit_post']] as $denied) {
            LibraryFixtures::given([$item], $denied);
            $refusal = LibraryFixtures::access()->item(1055, false);
            self::assertToolError($refusal, 'forbidden');
            self::assertStringNotContainsString('Geheimer Entwurf', $refusal->get_error_message());
            self::assertStringNotContainsString('Geheimer Entwurf', (string) wp_json_encode($refusal->get_error_data()));
        }
    }

    /** Ruling P9: with the group "Divi-Bibliothek" disabled, library IDs read like IDs that do not exist. */
    public function testAHiddenLibraryAnswersNotFoundLikeAMissingEntry(): void
    {
        $item = LibraryFixtures::item(1055, ['post_title' => 'Geheimer Entwurf']);
        LibraryFixtures::given([$item, LibraryFixtures::page('')], ['edit_post']);
        $hidden = new LibraryAccess(LibraryFixtures::store(), LibraryFixtures::roles(), null, static fn (): bool => false);

        foreach ([false, true] as $forWrite) {
            $refusal = $hidden->item(1055, $forWrite);
            self::assertToolError($refusal, 'not_found');
            self::assertStringNotContainsString('Geheimer Entwurf', $refusal->get_error_message());
            self::assertStringNotContainsString('Bibliothek', $refusal->get_error_message());
        }
        self::assertNull($hidden->item(LibraryFixtures::PAGE, false), 'pages stay PostGuard\'s business');
        self::assertNull($hidden->item(9999, false));
    }
}