- Autoloader: add automattic/jetpack-autoloader and load
vendor/autoload_packages.php; require wordpress/mcp-adapter directly (^0.5).
- ServerRegistrar: make the adapter create_server() call and the
OAuthServerRegistrar class_exists() check injectable so createServer()'s
unhook-before-create ordering and the "mcp-oauth absent" branch are unit
tested; add a smoke-test check that booting REST triggers no
_doing_it_wrong().
- mcp-smoke.sh: assert mcp-adapter's default server route 404s, and that the
subscriber role-gate denial actually carries our/the adapter's denial text
(not just any isError/error).
- Guard tests/Integration/mint-token.php and tec-probe.php with
`defined('WP_CLI') && WP_CLI || exit;`; add .gitattributes export-ignore
for tests/docs-superpowers/.superpowers/phpunit/phpcs config.
- Security: add Server/RequestContext, tracking via
rest_request_before_callbacks whether the current REST dispatch is our
OAuth-protected /mcp/mcp-oauth-server route; AbilityRegistrar's
permission_callback now denies (after the role gate) when abilities are
invoked outside that route. Wired in Plugin::boot().
- Minors: single Plugin::VERSION constant used by ServerRegistrar;
IntegrationRegistry caches its computed abilities list; tec-probe.php
checks wp_insert_post's result and cleans up its probe post in a
try/finally.
composer test: 47/47 green. composer lint: clean. Full mcp-smoke.sh run ends
ALL CHECKS PASSED (plus the expected /.well-known WARN).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
215 lines
7.9 KiB
PHP
215 lines
7.9 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace LIT\MCP\Tests\Unit\Server;
|
||
|
||
use Brain\Monkey\Filters;
|
||
use Brain\Monkey\Functions;
|
||
use LIT\MCP\Abilities\Ability;
|
||
use LIT\MCP\Guides\InstructionsBuilder;
|
||
use LIT\MCP\Integrations\Integration;
|
||
use LIT\MCP\Integrations\IntegrationRegistry;
|
||
use LIT\MCP\Server\ServerRegistrar;
|
||
use LIT\MCP\Tests\Unit\TestCase;
|
||
use Mockery;
|
||
use WPMedia\MCP\OAuth\Transport\ServerRegistrar as OAuthServerRegistrar;
|
||
|
||
final class ServerRegistrarTest extends TestCase
|
||
{
|
||
protected function tearDown(): void
|
||
{
|
||
unset($GLOBALS['wp_filter']);
|
||
parent::tearDown();
|
||
}
|
||
|
||
private function registry(): IntegrationRegistry
|
||
{
|
||
$direct = Mockery::mock(Ability::class);
|
||
$direct->allows('name')->andReturn('lit/guide');
|
||
$direct->allows('isDirect')->andReturn(true);
|
||
$indirect = Mockery::mock(Ability::class);
|
||
$indirect->allows('name')->andReturn('lit/rare-tool');
|
||
$indirect->allows('isDirect')->andReturn(false);
|
||
|
||
$core = Mockery::mock(Integration::class);
|
||
$core->allows('id')->andReturn('core');
|
||
$core->allows('isAvailable')->andReturn(true);
|
||
$core->allows('abilities')->andReturn([$direct, $indirect]);
|
||
|
||
return new IntegrationRegistry($core);
|
||
}
|
||
|
||
private function instructions(): InstructionsBuilder
|
||
{
|
||
// InstructionsBuilder is final (not mockable) and pure – use the real one.
|
||
return new InstructionsBuilder($this->registry());
|
||
}
|
||
|
||
public function testServerUsesOauthRouteDirectToolsPlusMetaToolsAndInstructions(): void
|
||
{
|
||
$args = (new ServerRegistrar($this->registry(), $this->instructions(), static fn () => true))->serverArguments();
|
||
|
||
self::assertSame('mcp-oauth-server', $args['id']);
|
||
self::assertSame('mcp', $args['namespace']);
|
||
self::assertSame('mcp-oauth-server', $args['route']);
|
||
self::assertStringContainsString('Aktive Integrationen: core', $args['description']);
|
||
self::assertSame(
|
||
['lit/guide', 'mcp-adapter/discover-abilities', 'mcp-adapter/get-ability-info', 'mcp-adapter/execute-ability'],
|
||
$args['tools']
|
||
);
|
||
self::assertNotContains('lit/rare-tool', $args['tools']);
|
||
}
|
||
|
||
public function testNoServerWhenOauthIsDisabled(): void
|
||
{
|
||
$registrar = new ServerRegistrar($this->registry(), $this->instructions(), static fn () => false);
|
||
|
||
self::assertNull($registrar->serverArguments());
|
||
}
|
||
|
||
public function testCreateServerOutsideAdapterInitDoesNothing(): void
|
||
{
|
||
Functions\when('doing_action')->justReturn(false);
|
||
$oauthChecked = false;
|
||
$registrar = new ServerRegistrar(
|
||
$this->registry(),
|
||
$this->instructions(),
|
||
static function () use (&$oauthChecked): bool {
|
||
$oauthChecked = true;
|
||
return true;
|
||
}
|
||
);
|
||
|
||
$registrar->createServer();
|
||
|
||
self::assertFalse($oauthChecked, 'createServer must bail out before touching the adapter');
|
||
}
|
||
|
||
public function testRegisterDisablesAdapterDefaultServerAndHooksCreateServer(): void
|
||
{
|
||
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
|
||
|
||
Functions\expect('add_filter')
|
||
->once()
|
||
->with('mcp_adapter_create_default_server', '__return_false');
|
||
Functions\expect('add_action')
|
||
->once()
|
||
->with('mcp_adapter_init', [$registrar, 'createServer'], 5);
|
||
|
||
$registrar->register();
|
||
}
|
||
|
||
public function testDefaultOauthEnabledDelegatesToMcpOauthContext(): void
|
||
{
|
||
// LIT\MCP\Server\ServerRegistrar::__construct() defaults to
|
||
// (new \WPMedia\MCP\OAuth\Context())->is_enabled() – exercise that real
|
||
// Context, only stubbing the filter it reads, to prove we track its notion
|
||
// of "enabled" (including the deprecated rocket_mcp_oauth_server_enabled
|
||
// filter Context::is_enabled() also seeds from) instead of duplicating it.
|
||
Filters\expectApplied('wpmedia_mcp_oauth_server_enabled')->once()->andReturn(false);
|
||
|
||
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
|
||
|
||
self::assertNull($registrar->serverArguments());
|
||
}
|
||
|
||
public function testUnhookOAuthDefaultServerRemovesOnlyTheMcpOauthCallback(): void
|
||
{
|
||
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
|
||
$oauthCallback = [$oauthRegistrar, 'register_server'];
|
||
$unrelatedCallback = static function (): void {
|
||
};
|
||
|
||
$hook = new class {
|
||
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
|
||
public array $callbacks = [];
|
||
};
|
||
$hook->callbacks = [
|
||
5 => ['unrelated-id' => ['function' => $unrelatedCallback, 'accepted_args' => 0]],
|
||
10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]],
|
||
];
|
||
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
|
||
|
||
Functions\expect('remove_action')
|
||
->once()
|
||
->with('mcp_adapter_init', $oauthCallback, 10);
|
||
|
||
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
|
||
}
|
||
|
||
public function testUnhookOAuthDefaultServerIsNoOpWhenHookIsMissing(): void
|
||
{
|
||
unset($GLOBALS['wp_filter']['mcp_adapter_init']);
|
||
|
||
Functions\expect('remove_action')->never();
|
||
|
||
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
|
||
}
|
||
|
||
public function testUnhookOAuthDefaultServerIsNoOpWhenOAuthPackageIsAbsent(): void
|
||
{
|
||
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
|
||
$oauthCallback = [$oauthRegistrar, 'register_server'];
|
||
$hook = new class {
|
||
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
|
||
public array $callbacks = [];
|
||
};
|
||
$hook->callbacks = [10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]]];
|
||
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
|
||
|
||
Functions\expect('remove_action')->never();
|
||
|
||
// Simulate wp-media/mcp-oauth not being installed via the injectable
|
||
// classExists probe (class_exists() is a PHP internal and cannot be
|
||
// stubbed directly through Brain\Monkey/Patchwork).
|
||
$registrar = new ServerRegistrar(
|
||
$this->registry(),
|
||
$this->instructions(),
|
||
null,
|
||
null,
|
||
static fn (): bool => false
|
||
);
|
||
|
||
$registrar->unhookOAuthDefaultServer();
|
||
}
|
||
|
||
public function testCreateServerUnhooksOAuthDefaultServerBeforeCreatingAdapterServer(): void
|
||
{
|
||
Functions\when('doing_action')->justReturn(true);
|
||
Functions\when('is_wp_error')->justReturn(false);
|
||
|
||
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
|
||
$oauthCallback = [$oauthRegistrar, 'register_server'];
|
||
$hook = new class {
|
||
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
|
||
public array $callbacks = [];
|
||
};
|
||
$hook->callbacks = [10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]]];
|
||
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
|
||
|
||
/** @var list<string> $order */
|
||
$order = [];
|
||
Functions\expect('remove_action')
|
||
->once()
|
||
->with('mcp_adapter_init', $oauthCallback, 10)
|
||
->andReturnUsing(static function () use (&$order): void {
|
||
$order[] = 'unhook';
|
||
});
|
||
|
||
$registrar = new ServerRegistrar(
|
||
$this->registry(),
|
||
$this->instructions(),
|
||
static fn (): bool => true,
|
||
static function (array $args) use (&$order): bool {
|
||
$order[] = 'create';
|
||
return true;
|
||
}
|
||
);
|
||
|
||
$registrar->createServer();
|
||
|
||
self::assertSame(['unhook', 'create'], $order, 'unhook must run before the adapter creates the server');
|
||
}
|
||
}
|