Files
WP-LIT-MCP/src/Dependencies.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

43 lines
997 B
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP;
defined('ABSPATH') || exit;
/**
* Checks that the libraries WP-LIT-MCP builds on are loadable.
*/
final class Dependencies
{
private const REQUIRED = [
'wordpress/mcp-adapter' => 'WP\\MCP\\Core\\McpAdapter',
'wp-media/mcp-oauth' => 'WPMedia\\MCP\\OAuth\\Bootstrap',
'WordPress Abilities API' => 'WP_Ability',
];
/** @var callable(string): bool */
private $classExists;
public function __construct(?callable $classExists = null)
{
$this->classExists = $classExists ?? static fn (string $class): bool => class_exists($class);
}
/**
* @return list<string> Human-readable names of missing components.
*/
public function missing(): array
{
$missing = [];
foreach (self::REQUIRED as $name => $class) {
if (! ($this->classExists)($class)) {
$missing[] = $name;
}
}
return $missing;
}
}