WP-LIT-MCP/tests/Unit/Admin/LogTabTest.php

<?php

declare(strict_types=1);

namespace LIT\MCP\Tests\Unit\Admin;

use Brain\Monkey\Functions;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Admin\LogTab;
use LIT\MCP\ChangeLog\ChangeLog;
use LIT\MCP\Integrations\Integration;
use LIT\MCP\Integrations\IntegrationRegistry;
use LIT\MCP\Limits;
use LIT\MCP\Tests\Unit\TestCase;
use Mockery;
use RuntimeException;

final class LogTabTest extends TestCase
{
    protected function tearDown(): void
    {
        unset($_GET['ability'], $_GET['user_id'], $_GET['result'], $_GET['date_from'], $_GET['date_to'], $_GET['tab']);
        parent::tearDown();
    }

    private function tab(ChangeLog $log): LogTab
    {
        return new LogTab($log, new Limits(), $this->registry());
    }

    private function registry(): IntegrationRegistry
    {
        return new IntegrationRegistry(
            $this->integration('media', 'Medien', ['lit/media-upload-from-url' => 'Datei von URL importieren']),
            $this->integration('wordpress', 'WordPress', ['lit/content-update' => 'Inhalt <ändern>'])
        );
    }

    /** @param array<string, string> $abilities name => label */
    private function integration(string $id, string $label, array $abilities): Integration
    {
        $mocks = [];
        foreach ($abilities as $name => $abilityLabel) {
            $ability = Mockery::mock(Ability::class);
            $ability->allows('name')->andReturn($name);
            $ability->allows('label')->andReturn($abilityLabel);
            $mocks[] = $ability;
        }
        $integration = Mockery::mock(Integration::class);
        $integration->allows('id')->andReturn($id);
        $integration->allows('label')->andReturn($label);
        $integration->allows('isAvailable')->andReturn(true);
        $integration->allows('abilities')->andReturn($mocks);

        return $integration;
    }

    public function testFiltersAreReadSanitized(): void
    {
        $tab = $this->tab(Mockery::mock(ChangeLog::class));
        $_GET['ability'] = 'lit/content-update';
        $_GET['user_id'] = '3x';

        self::assertSame(['ability' => 'lit/content-update', 'user_id' => 3], $tab->filters());

        $_GET['ability'] = 'lit/x"><script>';
        self::assertSame('', $tab->filters()['ability']);
    }

    public function testExtraFiltersWhitelistResultAndDateRange(): void
    {
        $tab = $this->tab(Mockery::mock(ChangeLog::class));

        self::assertSame(
            ['result' => '', 'date_from' => '', 'date_to' => ''],
            $tab->extraFilters(),
            'absent GET params sanitize to empty strings'
        );

        $_GET['result'] = 'partial';
        $_GET['date_from'] = '2026-09-01';
        $_GET['date_to'] = '2026-09-25';

        self::assertSame(
            ['result' => 'partial', 'date_from' => '2026-09-01', 'date_to' => '2026-09-25'],
            $tab->extraFilters()
        );
    }

    public function testExtraFiltersRejectUnknownResultAndMalformedDates(): void
    {
        $tab = $this->tab(Mockery::mock(ChangeLog::class));

        $_GET['result'] = 'ok"><script>';
        $_GET['date_from'] = 'not-a-date';
        $_GET['date_to'] = '2026-13-99'; // wrong shape is enough to reject; no calendar validation needed here.

        self::assertSame(['result' => '', 'date_from' => '', 'date_to' => '2026-13-99'], $tab->extraFilters());
    }

    /**
     * "$" without /D also matches before a trailing newline. sanitize_text_field() already drops
     * it in WordPress; the whitelist must hold on its own, so the sanitizer passes it through here.
     */
    public function testFiltersRejectATrailingNewlineEvenWithoutTheSanitizer(): void
    {
        Functions\when('sanitize_text_field')->returnArg();
        $tab = $this->tab(Mockery::mock(ChangeLog::class));
        $_GET['ability'] = "lit/content-update\n";
        $_GET['date_from'] = "2026-09-01\n";
        $_GET['date_to'] = "2026-09-25\n";

        self::assertSame('', $tab->filters()['ability']);
        self::assertSame(['result' => '', 'date_from' => '', 'date_to' => ''], $tab->extraFilters());
    }

    public function testClearNeedsNonceAndRights(): void
    {
        Functions\stubTranslationFunctions();
        Functions\when('current_user_can')->justReturn(true);
        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://kunde.de/wp-admin/' . $path);
        Functions\when('add_query_arg')->alias(static fn (array $args, string $url): string => $url . '?' . http_build_query($args));
        Functions\expect('check_admin_referer')->once()->with('lit_mcp_clear_log');
        Functions\expect('wp_safe_redirect')->once()->with(Mockery::on(
            static fn (string $url): bool => str_contains($url, 'tab=protokoll') && str_contains($url, 'lit_mcp_notice=cleared')
        ));
        $log = Mockery::mock(ChangeLog::class);
        $log->expects('clear')->once();
        $terminated = false;

        (new LogTab($log, new Limits(), $this->registry(), static function () use (&$terminated): void {
            $terminated = true;
        }))->handleClear();

        self::assertTrue($terminated);
    }

    public function testClearRequiresManageOptions(): void
    {
        Functions\stubTranslationFunctions();
        Functions\expect('current_user_can')->once()->with('manage_options')->andReturn(false);
        Functions\expect('wp_die')->once()->andThrow(new RuntimeException('died'));
        Functions\expect('check_admin_referer')->never();
        $log = Mockery::mock(ChangeLog::class);
        $log->expects('clear')->never();

        $this->expectException(RuntimeException::class);
        $this->tab($log)->handleClear();
    }
    public function testRegistersTheClearActionAndTheScreenOptions(): void
    {
        $tab = $this->tab(Mockery::mock(ChangeLog::class));
        Functions\expect('add_action')->once()->with('admin_post_lit_mcp_clear_log', [$tab, 'handleClear']);
        Functions\expect('add_action')->once()->with('load-settings_page_lit-mcp', [$tab, 'loadScreen']);
        Functions\expect('add_filter')->once()->with('set_screen_option_lit_mcp_log_per_page', [$tab, 'savePerPage'], 10, 3);

        $tab->registerActions();
    }

    public function testLoadScreenAddsThePerPageScreenOptionOnlyOnThisTab(): void
    {
        Functions\stubTranslationFunctions();
        Functions\when('sanitize_key')->returnArg();
        $tab = $this->tab(Mockery::mock(ChangeLog::class));

        Functions\expect('add_screen_option')->never();
        $_GET['tab'] = 'tools';
        $tab->loadScreen();

        Functions\expect('add_screen_option')->once()->with('per_page', [
            'label' => 'Einträge pro Seite',
            'default' => 20,
            'option' => 'lit_mcp_log_per_page',
        ]);
        $_GET['tab'] = 'protokoll';
        $tab->loadScreen();
    }

    public function testSavePerPageKeepsOnlyItsOwnOption(): void
    {
        $tab = $this->tab(Mockery::mock(ChangeLog::class));

        self::assertSame(40, $tab->savePerPage(false, 'lit_mcp_log_per_page', '40'));
        self::assertFalse($tab->savePerPage(false, 'other_per_page', '40'));
    }

    public function testRenderShowsTheFiltersAboveTheTableOutsideTheTableNav(): void
    {
        $html = $this->render(['lit/content-update', 'lit/media-upload-from-url', 'lit/x"><script>']);

        self::assertStringContainsString('name="result"', $html);
        self::assertStringNotContainsString('<script>', $html);
        // Core hides ".tablenav .actions" on phones; the filters live in their own block before the table.
        self::assertStringContainsString('<div class="lit-mcp-log-filters">', $html);
        self::assertStringNotContainsString('alignleft actions', $html);
        self::assertStringNotContainsString('lit_mcp_clear_log', $html, 'nothing to clear in an empty log');

        // One intro line; the retention days link to the Limits tab.
        self::assertMatchesRegularExpression('#<p class="description">[^<]*<a href="[^"]*tab=limits">90 Tagen</a>#', $html);
        // Selects keep screen-reader labels; the dates have short visible ones.
        foreach (['ability', 'user-id', 'result'] as $field) {
            self::assertStringContainsString('<label class="screen-reader-text" for="lit-mcp-filter-' . $field . '">', $html);
        }
        self::assertStringContainsString('<label for="lit-mcp-filter-date-from">von</label>', $html);
        self::assertStringContainsString('<label for="lit-mcp-filter-date-to">bis</label>', $html);
        self::assertStringContainsString('<option value="ok">erfolgreich</option>', $html);
        self::assertStringContainsString('<option value="partial">teilweise</option>', $html);
        self::assertStringNotContainsString('Filter zurücksetzen', $html, 'no reset without an active filter');
    }

    public function testClearButtonAppearsOnlyWithEntriesAndNamesTheirCount(): void
    {
        $two = $this->render([], 2);

        self::assertStringContainsString('<div class="lit-mcp-clear-log">', $two);
        self::assertStringContainsString('lit_mcp_clear_log', $two);
        self::assertStringContainsString('data-lit-mcp-confirm="Das gesamte Protokoll unwiderruflich löschen?"', $two);
        self::assertStringContainsString('nonce-lit_mcp_clear_log', $two);
        self::assertStringContainsString('>Protokoll leeren (2 Einträge)</button>', $two);
        self::assertStringContainsString('>Protokoll leeren (1 Eintrag)</button>', $this->render([], 1));

        // The count is the whole log, not the filtered page (query() above answers with no rows).
        $_GET['result'] = 'refused';
        self::assertStringContainsString('>Protokoll leeren (2 Einträge)</button>', $this->render([], 2));
    }

    public function testToolFilterShowsHumanLabelsGroupedByIntegration(): void
    {
        $_GET['ability'] = 'lit/content-update';

        $html = $this->render(['lit/content-update', 'lit/gone', 'lit/media-upload-from-url']);

        self::assertStringContainsString(
            '<optgroup label="Medien"><option value="lit/media-upload-from-url">Datei von URL importieren</option></optgroup>'
                . '<optgroup label="WordPress"><option value="lit/content-update" selected="selected">Inhalt &lt;ändern&gt;</option></optgroup>'
                . '<optgroup label="Weitere"><option value="lit/gone">lit/gone</option></optgroup>',
            $html
        );
    }

    public function testAnActiveFilterOffersTheReset(): void
    {
        $_GET['date_from'] = '2026-09-01';

        $html = $this->render([]);

        self::assertStringContainsString(
            '<a class="lit-mcp-reset" href="https://kunde.de/wp-admin/options-general.php?page=lit-mcp&tab=protokoll">Filter zurücksetzen</a>',
            $html
        );
    }

    /** @param list<string> $abilities abilities found in the log */
    private function render(array $abilities, int $total = 0): string
    {
        Functions\stubEscapeFunctions();
        Functions\stubTranslationFunctions();
        Functions\when('selected')->alias(static fn ($a, $b = true, $echo = true): string => $a === $b ? ' selected="selected"' : '');
        Functions\when('submit_button')->alias(static function (
            string $text = '',
            string $type = 'primary',
            string $name = 'submit',
            bool $wrap = true,
            $other = ''
        ): void {
            $attrs = is_array($other) ? implode(' ', array_map(
                static fn ($k, $v): string => sprintf('%s="%s"', $k, $v),
                array_keys($other),
                $other
            )) : (string) $other;
            printf('<button type="submit" name="%s" %s>%s</button>', esc_attr($name), $attrs, esc_html($text));
        });
        Functions\when('wp_nonce_field')->alias(static function (string $action): void {
            echo '<input type="hidden" name="_wpnonce" value="nonce-' . $action . '">';
        });
        Functions\when('wp_dropdown_users')->alias(static function (array $args): void {
            echo '<select name="' . $args['name'] . '" id="' . $args['id'] . '"><option>Alle</option></select>';
        });
        Functions\when('admin_url')->alias(static fn (string $path = ''): string => 'https://kunde.de/wp-admin/' . $path);
        Functions\when('get_option')->justReturn([]);
        Functions\when('get_user_option')->justReturn(false);
        Functions\when('add_query_arg')->alias(static fn (array $args, string $url): string => $url . '?' . http_build_query($args));

        $log = Mockery::mock(ChangeLog::class);
        $log->allows('abilities')->andReturn($abilities);
        $log->allows('query')->andReturn(['rows' => [], 'total' => 0]);
        $log->allows('count')->andReturn($total);

        ob_start();
        $this->tab($log)->render();

        return (string) ob_get_clean();
    }
}