Files
WP-LIT-MCP/tests/Unit/Server/ServerRegistrarTest.php
T
janniclas.loosenandClaude Opus 5.5 0e3332ad3e fix: close etappe-0 whole-branch review findings
- Autoloader: add automattic/jetpack-autoloader and load
  vendor/autoload_packages.php; require wordpress/mcp-adapter directly (^0.5).
- ServerRegistrar: make the adapter create_server() call and the
  OAuthServerRegistrar class_exists() check injectable so createServer()'s
  unhook-before-create ordering and the "mcp-oauth absent" branch are unit
  tested; add a smoke-test check that booting REST triggers no
  _doing_it_wrong().
- mcp-smoke.sh: assert mcp-adapter's default server route 404s, and that the
  subscriber role-gate denial actually carries our/the adapter's denial text
  (not just any isError/error).
- Guard tests/Integration/mint-token.php and tec-probe.php with
  `defined('WP_CLI') && WP_CLI || exit;`; add .gitattributes export-ignore
  for tests/docs-superpowers/.superpowers/phpunit/phpcs config.
- Security: add Server/RequestContext, tracking via
  rest_request_before_callbacks whether the current REST dispatch is our
  OAuth-protected /mcp/mcp-oauth-server route; AbilityRegistrar's
  permission_callback now denies (after the role gate) when abilities are
  invoked outside that route. Wired in Plugin::boot().
- Minors: single Plugin::VERSION constant used by ServerRegistrar;
  IntegrationRegistry caches its computed abilities list; tec-probe.php
  checks wp_insert_post's result and cleans up its probe post in a
  try/finally.

composer test: 47/47 green. composer lint: clean. Full mcp-smoke.sh run ends
ALL CHECKS PASSED (plus the expected /.well-known WARN).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-25 19:23:09 +02:00

215 lines
7.9 KiB
PHP
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Unit\Server;
use Brain\Monkey\Filters;
use Brain\Monkey\Functions;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Guides\InstructionsBuilder;
use LIT\MCP\Integrations\Integration;
use LIT\MCP\Integrations\IntegrationRegistry;
use LIT\MCP\Server\ServerRegistrar;
use LIT\MCP\Tests\Unit\TestCase;
use Mockery;
use WPMedia\MCP\OAuth\Transport\ServerRegistrar as OAuthServerRegistrar;
final class ServerRegistrarTest extends TestCase
{
protected function tearDown(): void
{
unset($GLOBALS['wp_filter']);
parent::tearDown();
}
private function registry(): IntegrationRegistry
{
$direct = Mockery::mock(Ability::class);
$direct->allows('name')->andReturn('lit/guide');
$direct->allows('isDirect')->andReturn(true);
$indirect = Mockery::mock(Ability::class);
$indirect->allows('name')->andReturn('lit/rare-tool');
$indirect->allows('isDirect')->andReturn(false);
$core = Mockery::mock(Integration::class);
$core->allows('id')->andReturn('core');
$core->allows('isAvailable')->andReturn(true);
$core->allows('abilities')->andReturn([$direct, $indirect]);
return new IntegrationRegistry($core);
}
private function instructions(): InstructionsBuilder
{
// InstructionsBuilder is final (not mockable) and pure – use the real one.
return new InstructionsBuilder($this->registry());
}
public function testServerUsesOauthRouteDirectToolsPlusMetaToolsAndInstructions(): void
{
$args = (new ServerRegistrar($this->registry(), $this->instructions(), static fn () => true))->serverArguments();
self::assertSame('mcp-oauth-server', $args['id']);
self::assertSame('mcp', $args['namespace']);
self::assertSame('mcp-oauth-server', $args['route']);
self::assertStringContainsString('Aktive Integrationen: core', $args['description']);
self::assertSame(
['lit/guide', 'mcp-adapter/discover-abilities', 'mcp-adapter/get-ability-info', 'mcp-adapter/execute-ability'],
$args['tools']
);
self::assertNotContains('lit/rare-tool', $args['tools']);
}
public function testNoServerWhenOauthIsDisabled(): void
{
$registrar = new ServerRegistrar($this->registry(), $this->instructions(), static fn () => false);
self::assertNull($registrar->serverArguments());
}
public function testCreateServerOutsideAdapterInitDoesNothing(): void
{
Functions\when('doing_action')->justReturn(false);
$oauthChecked = false;
$registrar = new ServerRegistrar(
$this->registry(),
$this->instructions(),
static function () use (&$oauthChecked): bool {
$oauthChecked = true;
return true;
}
);
$registrar->createServer();
self::assertFalse($oauthChecked, 'createServer must bail out before touching the adapter');
}
public function testRegisterDisablesAdapterDefaultServerAndHooksCreateServer(): void
{
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
Functions\expect('add_filter')
->once()
->with('mcp_adapter_create_default_server', '__return_false');
Functions\expect('add_action')
->once()
->with('mcp_adapter_init', [$registrar, 'createServer'], 5);
$registrar->register();
}
public function testDefaultOauthEnabledDelegatesToMcpOauthContext(): void
{
// LIT\MCP\Server\ServerRegistrar::__construct() defaults to
// (new \WPMedia\MCP\OAuth\Context())->is_enabled() – exercise that real
// Context, only stubbing the filter it reads, to prove we track its notion
// of "enabled" (including the deprecated rocket_mcp_oauth_server_enabled
// filter Context::is_enabled() also seeds from) instead of duplicating it.
Filters\expectApplied('wpmedia_mcp_oauth_server_enabled')->once()->andReturn(false);
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
self::assertNull($registrar->serverArguments());
}
public function testUnhookOAuthDefaultServerRemovesOnlyTheMcpOauthCallback(): void
{
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
$oauthCallback = [$oauthRegistrar, 'register_server'];
$unrelatedCallback = static function (): void {
};
$hook = new class {
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
public array $callbacks = [];
};
$hook->callbacks = [
5 => ['unrelated-id' => ['function' => $unrelatedCallback, 'accepted_args' => 0]],
10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]],
];
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
Functions\expect('remove_action')
->once()
->with('mcp_adapter_init', $oauthCallback, 10);
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
}
public function testUnhookOAuthDefaultServerIsNoOpWhenHookIsMissing(): void
{
unset($GLOBALS['wp_filter']['mcp_adapter_init']);
Functions\expect('remove_action')->never();
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
}
public function testUnhookOAuthDefaultServerIsNoOpWhenOAuthPackageIsAbsent(): void
{
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
$oauthCallback = [$oauthRegistrar, 'register_server'];
$hook = new class {
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
public array $callbacks = [];
};
$hook->callbacks = [10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]]];
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
Functions\expect('remove_action')->never();
// Simulate wp-media/mcp-oauth not being installed via the injectable
// classExists probe (class_exists() is a PHP internal and cannot be
// stubbed directly through Brain\Monkey/Patchwork).
$registrar = new ServerRegistrar(
$this->registry(),
$this->instructions(),
null,
null,
static fn (): bool => false
);
$registrar->unhookOAuthDefaultServer();
}
public function testCreateServerUnhooksOAuthDefaultServerBeforeCreatingAdapterServer(): void
{
Functions\when('doing_action')->justReturn(true);
Functions\when('is_wp_error')->justReturn(false);
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
$oauthCallback = [$oauthRegistrar, 'register_server'];
$hook = new class {
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
public array $callbacks = [];
};
$hook->callbacks = [10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]]];
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
/** @var list<string> $order */
$order = [];
Functions\expect('remove_action')
->once()
->with('mcp_adapter_init', $oauthCallback, 10)
->andReturnUsing(static function () use (&$order): void {
$order[] = 'unhook';
});
$registrar = new ServerRegistrar(
$this->registry(),
$this->instructions(),
static fn (): bool => true,
static function (array $args) use (&$order): bool {
$order[] = 'create';
return true;
}
);
$registrar->createServer();
self::assertSame(['unhook', 'create'], $order, 'unhook must run before the adapter creates the server');
}
}