janniclas.loosenandClaude Opus 5.5
a2a2da1ae7
Usage search distinguishes certain (ID referenced) and possible (file URL only) usages, hides titles the user cannot read, and keeps queries bounded. MediaGuard checks per-attachment capabilities and refuses trashed media unless the caller opts in. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
50 lines
1.9 KiB
PHP
50 lines
1.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace LIT\MCP\Tests\Unit\Integrations\Media;
|
|
|
|
use Brain\Monkey\Functions;
|
|
use LIT\MCP\Integrations\Media\MediaGuard;
|
|
use LIT\MCP\Tests\Unit\TestCase;
|
|
use WP_Post;
|
|
|
|
final class MediaGuardTest extends TestCase
|
|
{
|
|
public function testInvalidIdIsAValidationError(): void
|
|
{
|
|
self::assertSame('lit_validation_failed', MediaGuard::attachment('abc')->get_error_code());
|
|
self::assertSame('lit_validation_failed', MediaGuard::attachment(0)->get_error_code());
|
|
}
|
|
|
|
public function testMissingOrNonAttachmentIsNotFound(): void
|
|
{
|
|
Functions\when('get_post')->justReturn(null);
|
|
self::assertSame('lit_not_found', MediaGuard::attachment(33)->get_error_code());
|
|
|
|
Functions\when('get_post')->justReturn(new WP_Post(['ID' => 33, 'post_type' => 'page']));
|
|
self::assertSame('lit_not_found', MediaGuard::attachment(33)->get_error_code());
|
|
}
|
|
|
|
public function testChecksTheRequestedCapabilityOnTheAttachment(): void
|
|
{
|
|
$attachment = new WP_Post(['ID' => 33, 'post_type' => 'attachment', 'post_status' => 'inherit']);
|
|
Functions\when('get_post')->justReturn($attachment);
|
|
Functions\expect('current_user_can')->once()->with('delete_post', 33)->andReturn(false);
|
|
|
|
self::assertSame('lit_forbidden', MediaGuard::attachment('33', 'delete_post')->get_error_code());
|
|
}
|
|
|
|
public function testRefusesTrashedAttachmentsUnlessAllowed(): void
|
|
{
|
|
$attachment = new WP_Post(['ID' => 33, 'post_type' => 'attachment', 'post_status' => 'trash']);
|
|
Functions\when('get_post')->justReturn($attachment);
|
|
Functions\when('current_user_can')->justReturn(true);
|
|
|
|
$error = MediaGuard::attachment(33);
|
|
self::assertSame('lit_validation_failed', $error->get_error_code());
|
|
self::assertStringContainsString('Papierkorb', $error->get_error_message());
|
|
self::assertSame($attachment, MediaGuard::attachment(33, 'read_post', true));
|
|
}
|
|
}
|