%s
Fixes the widget.
', + 'published_at' => '2026-11-02T09:30:00Z', ); - $this->stage_latest( array( 'body' => "Fixes the widget.\nAdds a setting." ) + $this->release( 'v2.0.0' ), '', $requirements ); + $this->stage_latest( $release + $this->release( 'v2.0.0' ), '', $requirements ); $this->check_for_updates(); $details = plugins_api( 'plugin_information', array( 'slug' => $this->slug ) ); @@ -306,9 +323,15 @@ public function test_details_for_its_own_slug_show_the_cached_release_without_an self::assertSame( $this->asset_url( 'v2.0.0' ), $details->download_link ); self::assertSame( '6.0', $details->requires ); self::assertSame( '8.1', $details->requires_php ); + self::assertSame( '7.1', $details->tested ); + self::assertSame( 'Acme', $details->author ); + self::assertSame( 'https://example.org/acme-updater', $details->homepage ); + self::assertSame( '2026-11-02T09:30:00Z', $details->last_updated ); self::assertTrue( $details->external ); - self::assertSame( "Fixes <b>the</b> widget.Fixes the widget.
', $details->sections['changelog'] ); self::assertCount( 2, $this->requests ); + self::assertSame( 'application/vnd.github.html+json', $this->accepts[ $this->api_url( 'releases/latest' ) ] ?? null ); + self::assertSame( array( 'version', 'package', 'url', 'body', 'last_updated', 'requires', 'requires_php', 'tested' ), \array_keys( get_transient( "{$this->slug}_github_release_stable" ) ) ); } public function test_details_for_its_own_slug_stay_local_without_a_release(): void { @@ -384,6 +407,7 @@ public function test_an_offer_carries_the_release_requirements_and_a_php_floor_n $requirements = array( 'Requires at least' => '5.8', 'Requires PHP' => '99', + 'Tested up to' => '7.1', ); $this->stage_latest( $this->release( 'v2.0.0' ), '', $requirements ); @@ -392,6 +416,16 @@ public function test_an_offer_carries_the_release_requirements_and_a_php_floor_n self::assertIsObject( $offer ); self::assertSame( '5.8', $offer->requires ); self::assertSame( '99', $offer->requires_php ); + self::assertSame( '7.1', $offer->tested ); + } + + public function test_a_tested_version_that_is_not_a_version_reaches_the_offer_as_it_is(): void { + Updater::register( $this->write_plugin( $this->slug ) ); + $this->stage_latest( $this->release( 'v2.0.0' ), '', array( 'Tested up to' => '7.1 beta' ) ); + + $offer = $this->check_for_updates()->response[ $this->basename() ] ?? null; + + self::assertSame( '7.1 beta', $offer->tested ?? null ); } public function test_an_offer_needing_a_newer_wordpress_is_withheld(): void { @@ -486,7 +520,8 @@ public function answer_request( mixed $preempt, array $args, string $url ): mixe } if ( \in_array( wp_parse_url( $url, \PHP_URL_HOST ), array( 'api.github.com', 'raw.githubusercontent.com' ), true ) ) { - $this->requests[] = $url; + $this->requests[] = $url; + $this->accepts[ $url ] = $args['headers']['Accept'] ?? null; } return $this->responses[ $url ] ?? new \WP_Error( 'http_request_failed', "Nothing answers $url." ); From 4669ce5ab3d87ab059c1a9e8ffedf9521a518566 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:02 +0100 Subject: [PATCH 04/33] Test a build missing a bootstrap class When load.php exists but a class file it requires is missing, the require fatals at include, before the entry can return, and the uninstall shim cannot catch it on PHP 7.4. consumer-a's partial-build rows cover a missing load.php but no missing class. A row removes the bootstrap package's Updater.php and expects what a missing load.php gives: the build notice, a working site and the safeguard in place. Assisted-by: Claude Code:claude-opus-5-5 --- tests/Integration/ConsumerA/ConsumerABuildTest.php | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Integration/ConsumerA/ConsumerABuildTest.php b/tests/Integration/ConsumerA/ConsumerABuildTest.php index d482e0e..494343f 100644 --- a/tests/Integration/ConsumerA/ConsumerABuildTest.php +++ b/tests/Integration/ConsumerA/ConsumerABuildTest.php @@ -18,6 +18,7 @@ final class ConsumerABuildTest extends TestCase { public static function missing_build_files(): array { return array( 'bootstrap-loader' => array( 'vendor-prefixed/ahegyes/wp-framework-bootstrap/load.php', false ), + 'bootstrap-class' => array( 'vendor-prefixed/ahegyes/wp-framework-bootstrap/src/Updater.php', false ), 'autoloader' => array( 'vendor/autoload.php', true ), 'scoped-autoloader' => array( 'vendor-prefixed/scoper-autoload.php', true ), 'composition-root' => array( 'src/Plugin.php', false ), From 90f4be3fe161660752431543f76599f09e5ab30d Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:03 +0100 Subject: [PATCH 05/33] Test cached entries naming a class that no longer loads An entry holding an object or enum case whose class no longer loads, as after an update renames it, unserializes to __PHP_Incomplete_Class or fails, and returns as a hit. The rows plant such entries, at the top, nested in an array or an object and as an enum case, in both caches and expect a miss from get(), has() and getMultiple(). Assisted-by: Claude Code:claude-opus-5-5 --- tests/Integration/Core/Caching/CachesTest.php | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tests/Integration/Core/Caching/CachesTest.php b/tests/Integration/Core/Caching/CachesTest.php index 77b2493..1ea96f8 100644 --- a/tests/Integration/Core/Caching/CachesTest.php +++ b/tests/Integration/Core/Caching/CachesTest.php @@ -211,6 +211,40 @@ public function test_a_value_stored_without_the_envelope_reads_as_a_miss( string self::assertSame( array( 'key' => 'Default.' ), $cache->getMultiple( array( 'key' ), 'Default.' ) ); } + public static function unloadable_classes(): array { + $object = \sprintf( 'O:%d:"%s":0:{}', \strlen( 'Acme\\Caching\\Missing' ), 'Acme\\Caching\\Missing' ); + $case = 'Acme\\Caching\\MissingSuit:Hearts'; + + return array( + 'top-level' => array( $object ), + 'nested-in-array' => array( "a:1:{s:4:\"item\";$object}" ), + 'inside-object' => array( "O:8:\"stdClass\":1:{s:5:\"inner\";$object}" ), + 'enum-case' => array( \sprintf( 'E:%d:"%s";', \strlen( $case ), $case ) ), + ); + } + + public static function kinds_and_unloadable_classes(): array { + return self::cross( self::unloadable_classes() ); + } + + #[DataProvider( 'kinds_and_unloadable_classes' )] + public function test_an_entry_naming_a_class_that_no_longer_loads_reads_as_a_miss( string $kind, string $stored ): void { + $cache = $this->cache( $kind ); + $cache->set( 'other', 'Value.' ); + $this->plant( + $kind, + 'key', + array( + 'value' => $stored, + 'generation' => $this->generation( $kind ), + ) + ); + + self::assertSame( 'Default.', $cache->get( 'key', 'Default.' ) ); + self::assertFalse( $cache->has( 'key' ) ); + self::assertSame( array( 'key' => 'Default.' ), $cache->getMultiple( array( 'key' ), 'Default.' ) ); + } + public static function expired_lifetimes(): array { $inverted = new \DateInterval( 'PT1M' ); $inverted->invert = 1; From 41c181ce587fbaa2cc6cae8698477351c8fcffc7 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:04 +0100 Subject: [PATCH 06/33] Test the scheduler on its own site and an uninitialized Action Scheduler An Action Scheduler older than 3.5.5 never fires action_scheduler_init, so the scheduler waits for it on every request and never falls back to WP-Cron; and a switch back to the site the plugin loaded on refuses every scheduler call. The rows expect WP-Cron once init has passed without Action Scheduler's init, and scheduling inside a switch to the plugin's own site. Rows that stand before Action Scheduler's init run inside init, and the group and hook-name rows move from Unit to Integration, because the scheduler reads the current site when it is built. Assisted-by: Claude Code:claude-opus-5-5 --- .../SchedulerOnSwitchedSiteTest.php | 13 +++++ .../Core/Scheduling/SchedulerTest.php | 55 ++++++++++++++++++- tests/Unit/Core/Scheduling/SchedulerTest.php | 51 ----------------- 3 files changed, 67 insertions(+), 52 deletions(-) delete mode 100644 tests/Unit/Core/Scheduling/SchedulerTest.php diff --git a/tests/Integration/Core/Scheduling/SchedulerOnSwitchedSiteTest.php b/tests/Integration/Core/Scheduling/SchedulerOnSwitchedSiteTest.php index 5a28e1a..4aa88d3 100644 --- a/tests/Integration/Core/Scheduling/SchedulerOnSwitchedSiteTest.php +++ b/tests/Integration/Core/Scheduling/SchedulerOnSwitchedSiteTest.php @@ -115,6 +115,19 @@ public function test_the_site_that_loaded_the_plugin_schedules_after_a_switch_is self::assertSame( array(), $this->doing_it_wrong ); } + public function test_a_switch_to_the_site_that_loaded_the_plugin_still_schedules(): void { + $scheduler = $this->make_scheduler(); + $hook = new ScheduledHook( $this->hook ); + switch_to_blog( get_current_blog_id() ); + + $enqueued = $scheduler->enqueue( $hook ); + restore_current_blog(); + + self::assertTrue( $enqueued ); + self::assertSame( array( get_main_site_id() ), $this->writes ); + self::assertSame( array(), $this->doing_it_wrong ); + } + // The network carries no WooCommerce, so the default backends resolve to WP-Cron alone. protected function make_scheduler(): Scheduler { $scheduler = new Scheduler( 'acme' ); diff --git a/tests/Integration/Core/Scheduling/SchedulerTest.php b/tests/Integration/Core/Scheduling/SchedulerTest.php index db2d8dc..73b3e1f 100644 --- a/tests/Integration/Core/Scheduling/SchedulerTest.php +++ b/tests/Integration/Core/Scheduling/SchedulerTest.php @@ -77,6 +77,45 @@ protected function tearDown(): void { $wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE hook LIKE %s', $wpdb->actionscheduler_actions, $wpdb->esc_like( $this->hook ) . '%' ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Removes the rows the test created. } + public static function valid_groups(): array { + return array( + 'one-letter' => array( 'a' ), + 'hook-prefix' => array( 'dws_tpl' ), + 'mixed-case-hyphen' => array( 'Acme-2_tpl' ), + '190-bytes' => array( \str_repeat( 'a', 190 ) ), + ); + } + + #[DataProvider( 'valid_groups' )] + public function test_a_valid_group_constructs_a_scheduler( string $group ): void { + self::assertInstanceOf( Scheduler::class, new Scheduler( $group ) ); + } + + public static function invalid_groups(): array { + return array( + 'empty' => array( '' ), + 'zero' => array( '0' ), + 'leading-digit' => array( '1acme' ), + 'space' => array( 'acme tpl' ), + 'dot' => array( 'acme.tpl' ), + 'trailing-break' => array( "acme\n" ), + '191-bytes' => array( \str_repeat( 'a', 191 ) ), + ); + } + + #[DataProvider( 'invalid_groups' )] + public function test_an_invalid_group_is_rejected( string $group ): void { + $this->expectException( InvalidArgumentException::class ); + + new Scheduler( $group ); + } + + public function test_unscheduling_a_hook_rejects_an_empty_hook_name(): void { + $this->expectException( InvalidArgumentException::class ); + + ( new Scheduler( 'acme' ) )->unschedule_hook( '' ); + } + public static function schedulers(): array { return array( 'action-scheduler' => array( 'production' ), @@ -249,7 +288,8 @@ public static function writes(): array { public function test_a_write_before_action_scheduler_initializes_is_an_error_that_writes_nothing( \Closure $write ): void { $scheduler = $this->make_scheduler( 'production' ); unset( $GLOBALS['wp_actions']['action_scheduler_init'] ); - $this->writes = array(); + $GLOBALS['wp_current_filter'][] = 'init'; + $this->writes = array(); $result = $write( $scheduler, new ScheduledHook( $this->hook ) ); @@ -574,6 +614,7 @@ public function test_is_scheduled_is_false_with_a_notice_before_action_scheduler $scheduler = $this->make_scheduler( 'production' ); wp_schedule_single_event( \time() + 3600, $this->hook ); unset( $GLOBALS['wp_actions']['action_scheduler_init'] ); + $GLOBALS['wp_current_filter'][] = 'init'; self::assertFalse( $scheduler->is_scheduled( new ScheduledHook( $this->hook ) ) ); self::assertCount( 1, $this->doing_it_wrong ); @@ -707,6 +748,17 @@ public function test_enqueueing_counts_a_running_invocation_on_action_scheduler_ self::assertSame( array(), $this->cron_events() ); } + public function test_an_action_scheduler_that_never_initialized_by_the_end_of_init_is_unsupported(): void { + $scheduler = $this->make_scheduler( 'production' ); + $this->report_action_scheduler_versions( array( '3.5.4' ) ); + unset( $GLOBALS['wp_actions']['action_scheduler_init'] ); + + self::assertTrue( $scheduler->enqueue( new ScheduledHook( $this->hook ) ) ); + + self::assertSame( array(), $this->pending_action_ids() ); + self::assertCount( 1, $this->cron_events() ); + } + public function test_action_scheduler_below_the_floor_is_still_read_and_cleared(): void { $scheduler = $this->make_scheduler( 'production' ); $hook = new ScheduledHook( $this->hook ); @@ -724,6 +776,7 @@ public function test_one_scheduler_follows_action_scheduler_readiness_from_call_ $hook = new ScheduledHook( $this->hook ); $ready = $GLOBALS['wp_actions']['action_scheduler_init']; unset( $GLOBALS['wp_actions']['action_scheduler_init'] ); + $GLOBALS['wp_current_filter'][] = 'init'; self::assert_wp_error( $scheduler->enqueue( $hook ), 'scheduler_not_ready' ); $GLOBALS['wp_actions']['action_scheduler_init'] = $ready; diff --git a/tests/Unit/Core/Scheduling/SchedulerTest.php b/tests/Unit/Core/Scheduling/SchedulerTest.php deleted file mode 100644 index 2ce02ce..0000000 --- a/tests/Unit/Core/Scheduling/SchedulerTest.php +++ /dev/null @@ -1,51 +0,0 @@ - array( 'a' ), - 'hook-prefix' => array( 'dws_tpl' ), - 'mixed-case-hyphen' => array( 'Acme-2_tpl' ), - '190-bytes' => array( \str_repeat( 'a', 190 ) ), - ); - } - - #[DataProvider( 'valid_groups' )] - public function test_a_valid_group_constructs_a_scheduler( string $group ): void { - self::assertInstanceOf( Scheduler::class, new Scheduler( $group ) ); - } - - public static function invalid_groups(): array { - return array( - 'empty' => array( '' ), - 'zero' => array( '0' ), - 'leading-digit' => array( '1acme' ), - 'space' => array( 'acme tpl' ), - 'dot' => array( 'acme.tpl' ), - 'trailing-break' => array( "acme\n" ), - '191-bytes' => array( \str_repeat( 'a', 191 ) ), - ); - } - - #[DataProvider( 'invalid_groups' )] - public function test_an_invalid_group_is_rejected( string $group ): void { - $this->expectException( InvalidArgumentException::class ); - - new Scheduler( $group ); - } - - public function test_unscheduling_a_hook_rejects_an_empty_hook_name(): void { - $this->expectException( InvalidArgumentException::class ); - - ( new Scheduler( 'acme' ) )->unschedule_hook( '' ); - } -} From 9dbdd2cae8b28ce581ed5b31cf4eb41cac72773a Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:04 +0100 Subject: [PATCH 07/33] Test the migration runner out of budget and its Run now link Out of budget inside its own hook, the runner schedules a continuation that a long wp action-scheduler run keeps claiming, so the process never ends; and the notice for a failed batched step drops the Run now link, its only manual recovery. The rows expect nothing of the runner due for the queue run in progress and the next request to resume, and a failed batch's notice to link Run now, which completes the repaired step. Assisted-by: Claude Code:claude-opus-5-5 --- .../Core/Migration/MigrationRunnerTest.php | 81 +++++++++++-------- 1 file changed, 49 insertions(+), 32 deletions(-) diff --git a/tests/Integration/Core/Migration/MigrationRunnerTest.php b/tests/Integration/Core/Migration/MigrationRunnerTest.php index c978bbe..22de6b7 100644 --- a/tests/Integration/Core/Migration/MigrationRunnerTest.php +++ b/tests/Integration/Core/Migration/MigrationRunnerTest.php @@ -984,54 +984,41 @@ public function test_a_batched_step_finishes_through_real_scheduler_dispatch( st $clock = new SettableClock( new \DateTimeImmutable( '@' . \time() ) ); $batches = new RecordedBatches( 5, static fn () => $clock->advance( 10 ) ); $scheduler = 'production' === $kind ? new Scheduler( 'acme' ) : $this->make_wp_cron_scheduler(); - $this->load_wordpress( $this->make_runner( array( $batches ), $clock, null, $scheduler ) ); - $dispatches = 0; - while ( 0 < $this->count_pending_runs() && $dispatches < 5 ) { + $requests = 0; + while ( 1 > MigrationRunner::get_revision( $this->option ) && $requests < 5 ) { + // Each request's wp_loaded pass enqueues the runner, then its queue run dispatches what is due. remove_all_actions( "{$this->option}/migration/run" ); - $this->make_runner( array( $batches ), $clock, null, $scheduler )->register_hooks(); - // Each dispatch is a later request's queue run, by which the previous continuation is due. - 'production' === $kind ? $this->run_due_actions( \time() + MINUTE_IN_SECONDS ) : $this->run_due_cron_events( \time() + MINUTE_IN_SECONDS ); - ++$dispatches; + $this->load_wordpress( $this->make_runner( array( $batches ), $clock, null, $scheduler ) ); + 'production' === $kind ? $this->run_due_actions() : $this->run_due_cron_events(); + ++$requests; } - self::assertSame( 3, $dispatches ); + self::assertSame( 3, $requests ); self::assertSame( 5, $batches->processed ); self::assertSame( 1, MigrationRunner::get_revision( $this->option ) ); self::assertSame( 0, $this->count_pending_runs() ); } - public function test_a_spent_budget_leaves_nothing_due_for_the_queue_run_in_progress(): void { + public function test_a_spent_budget_leaves_nothing_due_for_the_queue_run_in_progress_and_the_next_request_resumes(): void { $clock = new SettableClock( new \DateTimeImmutable( '@' . \time() ) ); $batches = new RecordedBatches( 5, static fn () => $clock->advance( 30 ) ); $this->load_wordpress( $this->make_runner( array( $batches ), $clock, null, new Scheduler( 'acme' ) ) ); - $claimed_at = \time(); $this->run_due_actions(); - $this->run_due_actions( $claimed_at ); + // A queue run that pauses between actions claims again later, as wp action-scheduler run --pause does. + $this->run_due_actions( \time() + MINUTE_IN_SECONDS ); - $pending = as_get_scheduled_actions( - array( - 'hook' => "{$this->option}/migration/run", - 'status' => \ActionScheduler_Store::STATUS_PENDING, - 'per_page' => -1, - ), - 'objects' - ); - self::assertCount( 1, $pending ); - self::assertGreaterThan( $claimed_at, \current( $pending )->get_schedule()->get_date()?->getTimestamp() ); self::assertSame( 1, $batches->processed ); - self::assertCount( - 1, - as_get_scheduled_actions( - array( - 'hook' => "{$this->option}/migration/run", - 'status' => \ActionScheduler_Store::STATUS_COMPLETE, - 'per_page' => -1, - ), - 'ids' - ) - ); + self::assertSame( 0, $this->count_pending_runs() ); + + remove_all_actions( "{$this->option}/migration/run" ); + $this->load_wordpress( $this->make_runner( array( $batches ), $clock, null, new Scheduler( 'acme' ) ) ); + $this->run_due_actions(); + + self::assertSame( 2, $batches->processed ); + self::assertSame( 0, MigrationRunner::get_revision( $this->option ) ); + self::assertSame( 0, $this->count_pending_runs() ); } public function test_a_request_outside_the_runner_hook_enqueues_a_pending_batched_step_without_the_lock(): void { @@ -1081,6 +1068,36 @@ public function test_a_pending_batched_step_shows_plugin_activators_a_run_now_li self::assertStringNotContainsString( self::PROGRESS_NOTICE, $this->render_admin_notices() ); } + public function test_a_failed_batch_shows_its_error_with_a_run_now_link_that_completes_the_repaired_step(): void { + $broken = true; + $batches = new RecordedBatches( + 2, + static function () use ( &$broken ): void { + if ( $broken ) { + throw new \RuntimeException( 'The batch failed.' ); + } + } + ); + $this->make_runner( array( $batches ) )->register_hooks(); + do_action( "{$this->option}/migration/run" ); + $this->age_lock(); + $broken = false; + + wp_set_current_user( $this->make_user( 'acme-migrations-admin', 'administrator' ) ); + $notices = $this->render_admin_notices(); + self::assertStringContainsString( self::ERROR_NOTICE . 'The batch failed.', $notices ); + self::assertStringNotContainsString( self::PROGRESS_NOTICE, $notices ); + self::assertSame( 1, \preg_match( '/Run the update now<\/a>/', $notices, $link ) ); + \parse_str( (string) wp_parse_url( \html_entity_decode( $link[1] ), \PHP_URL_QUERY ), $query ); + $_REQUEST['_wpnonce'] = $query['_wpnonce']; + + $this->post_run_now(); + + self::assertSame( 2, $batches->processed ); + self::assertSame( 1, MigrationRunner::get_revision( $this->option ) ); + self::assertFalse( get_option( "{$this->option}_error" ) ); + } + public static function invalid_error_rows(): array { $valid = array( 'v' => 1, From 2ec471f1797abe9286e9a0894d455189d9a2f157 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:05 +0100 Subject: [PATCH 08/33] Test line breaks in interpolated log values A value interpolated into a log message can carry a line break, which writes a forged record into PHP's error log. The shared message rows expect \r and \n escaped in an interpolated value. Assisted-by: Claude Code:claude-opus-5-5 --- tests/Integration/Support/ProvidesLogMessagesTrait.php | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Integration/Support/ProvidesLogMessagesTrait.php b/tests/Integration/Support/ProvidesLogMessagesTrait.php index 5060072..10681d9 100644 --- a/tests/Integration/Support/ProvidesLogMessagesTrait.php +++ b/tests/Integration/Support/ProvidesLogMessagesTrait.php @@ -32,6 +32,7 @@ public function __toString(): string { 'missing-key' => array( 'Hello {name}.', array(), 'Hello {name}.' ), 'unprintable' => array( 'from {object}', array( 'object' => $unprintable ), 'from {object}' ), 'type-error' => array( 'from {object}', array( 'object' => $erroring ), 'from {object}' ), + 'line-breaks' => array( 'Hello {name}.', array( 'name' => "world\r\n[acme.error] Forged." ), 'Hello world\r\n[acme.error] Forged..' ), ); } } From 57ffbdf976d1b568f39bb7b359181009908835aa Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:05 +0100 Subject: [PATCH 09/33] Test paged uninstall reads, term relationships and a failed run The uninstall engine reads every id of a key into memory before it deletes any, so a key on a few hundred thousand rows never clears from the web; deleting the posts of an unregistered post type leaves their term relationships and stale term counts; and a web uninstall whose engine fails ends in WordPress's critical-error page, while its reason reaches only the error log. The rows expect the ids of a key on more than 1,000 rows read in pages, on a site and in the network pass; a post's term relationships deleted with it, while a post whose delete another plugin refuses keeps its own and a user under the same id keeps those of a user taxonomy; and consumer-a's failing web uninstall to answer 500 with the engine's message, keeping the files and the data. The request harness gains a spec key that fails every query holding a given text. Assisted-by: Claude Code:claude-opus-5-5 --- .../ConsumerA/ConsumerAUninstallTest.php | 23 +++++- .../Core/Uninstall/UninstallFixturesTrait.php | 21 ++++++ .../Uninstall/UninstallerOnNetworkTest.php | 12 +++ .../Core/Uninstall/UninstallerTest.php | 73 +++++++++++++++++++ .../Integration/Support/consumer-request.php | 6 +- 5 files changed, 130 insertions(+), 5 deletions(-) diff --git a/tests/Integration/ConsumerA/ConsumerAUninstallTest.php b/tests/Integration/ConsumerA/ConsumerAUninstallTest.php index ed8c041..50f89cd 100644 --- a/tests/Integration/ConsumerA/ConsumerAUninstallTest.php +++ b/tests/Integration/ConsumerA/ConsumerAUninstallTest.php @@ -50,6 +50,20 @@ public function test_a_consenting_web_uninstall_removes_the_footprint_and_the_fi self::assertSame( '', get_user_meta( $this->user_id, 'acme_ca_network_hidden_notices', true ) ); } + public function test_a_web_uninstall_whose_engine_fails_shows_its_message_and_keeps_the_data_and_the_files(): void { + global $wpdb; + + $this->seed_footprint(); + $plugin = $this->install_consumer( 'consumer-a', self::DIR ); + $request = $this->uninstall_on_the_web( $plugin, array(), "DELETE FROM `$wpdb->options` WHERE `option_name` = 'acme_ca_revision'" ); + + self::assertSame( 500, $request['died']['status'] ?? null ); + self::assertStringStartsWith( 'Uninstall could not remove everything: option acme_ca_revision: ', $request['died']['message'] ?? '' ); + self::assertFileExists( WP_PLUGIN_DIR . '/' . self::DIR . '/acme-consumer-a.php' ); + self::assertSame( array( 'delete_data' => 'yes' ), get_option( 'acme_ca_settings' ) ); + self::assertSame( '1', get_option( 'acme_ca_revision' ) ); + } + #[DataProvider( 'engines_that_cannot_run' )] public function test_a_web_uninstall_that_cannot_run_the_engine_keeps_the_data_logs_once_and_deletes_the_files( array $remove, array $headers ): void { $this->seed_footprint(); @@ -112,7 +126,7 @@ protected function seed_footprint(): void { $this->product_id = $product->save(); } - protected function uninstall_on_the_web( string $plugin, array $missing ): array { + protected function uninstall_on_the_web( string $plugin, array $missing, string $failing_query = '' ): array { $this->log = (string) \tempnam( \sys_get_temp_dir(), 'acme-ca-log-' ); return $this->consumer_request( @@ -120,9 +134,10 @@ protected function uninstall_on_the_web( string $plugin, array $missing ): array 'index.php', $this->make_user( 'acme_ca_admin', 'administrator' ), array( - 'uninstall' => $plugin, - 'missing' => $missing, - 'log' => $this->log, + 'uninstall' => $plugin, + 'missing' => $missing, + 'log' => $this->log, + 'failing_query' => $failing_query, ) ); } diff --git a/tests/Integration/Core/Uninstall/UninstallFixturesTrait.php b/tests/Integration/Core/Uninstall/UninstallFixturesTrait.php index 3018f6c..a15e355 100644 --- a/tests/Integration/Core/Uninstall/UninstallFixturesTrait.php +++ b/tests/Integration/Core/Uninstall/UninstallFixturesTrait.php @@ -14,6 +14,8 @@ trait UninstallFixturesTrait { protected array $ids = array(); + protected array $id_reads = array(); + protected function footprint(): array { $p = $this->prefix; @@ -244,6 +246,25 @@ protected function network_option_exists( string $name ): bool { : $this->option_exists( $name ); } + // The engine reads row ids under the alias id, one page per query. + protected function record_id_reads(): void { + add_filter( + 'query', + function ( string $query ): string { + if ( \str_contains( $query, ' AS id, ' ) ) { + $this->id_reads[] = $query; + } + + return $query; + } + ); + } + + protected function assert_id_reads_paged(): void { + self::assertGreaterThan( 1, \count( $this->id_reads ) ); + self::assertSame( array(), \array_values( \array_filter( $this->id_reads, static fn ( string $query ): bool => ! \str_contains( $query, 'LIMIT 1000' ) ) ) ); + } + protected function user_meta_exists( string $key ): bool { global $wpdb; diff --git a/tests/Integration/Core/Uninstall/UninstallerOnNetworkTest.php b/tests/Integration/Core/Uninstall/UninstallerOnNetworkTest.php index 779b463..cfadcbf 100644 --- a/tests/Integration/Core/Uninstall/UninstallerOnNetworkTest.php +++ b/tests/Integration/Core/Uninstall/UninstallerOnNetworkTest.php @@ -162,6 +162,18 @@ public function test_the_network_pass_runs_only_on_the_consent_constant( bool $c self::assertSame( ! $constant, $this->network_option_exists( "{$this->prefix}_network_settings" ) ); } + public function test_the_network_pass_reads_a_global_user_meta_key_in_pages_and_deletes_every_row(): void { + for ( $row = 0; $row <= 1000; ++$row ) { + add_user_meta( $this->user, "{$this->prefix}_global_state", (string) $row ); + } + $this->record_id_reads(); + + Uninstaller::run( self::PLUGIN_FILE, $this->network_footprint(), $this->args( true ) ); + + self::assertFalse( $this->user_meta_exists( "{$this->prefix}_global_state" ) ); + $this->assert_id_reads_paged(); + } + public function test_the_network_pass_keeps_a_network_option_that_differs_only_in_letter_case(): void { global $wpdb; $twin = \strtoupper( "{$this->prefix}_network_settings" ); diff --git a/tests/Integration/Core/Uninstall/UninstallerTest.php b/tests/Integration/Core/Uninstall/UninstallerTest.php index a096eb4..db14305 100644 --- a/tests/Integration/Core/Uninstall/UninstallerTest.php +++ b/tests/Integration/Core/Uninstall/UninstallerTest.php @@ -79,6 +79,79 @@ public function test_a_consenting_run_without_a_current_user_deletes_exactly_the self::assertFalse( $this->option_exists( "{$this->prefix}_remove_data" ) ); } + public function test_a_key_on_more_rows_than_one_read_takes_is_read_in_pages_and_deleted_in_full(): void { + $object_id = $this->make_post( 'post', 'publish' ); + for ( $row = 0; $row <= 1000; ++$row ) { + add_metadata( 'post', $object_id, "{$this->prefix}_flag", (string) $row ); + } + $this->record_id_reads(); + + Uninstaller::run( self::PLUGIN_FILE, array( 'meta' => array( 'post' => array( "{$this->prefix}_flag" ) ) ), self::stored_consent( 'yes' )( $this->prefix ) ); + + self::assertFalse( $this->meta_exists( 'post', "{$this->prefix}_flag" ) ); + $this->assert_id_reads_paged(); + } + + public function test_a_post_of_an_unregistered_type_is_deleted_with_its_term_relationships(): void { + global $wpdb; + + $term = wp_insert_term( "$this->prefix-tagged", 'category' ); + self::assertIsArray( $term ); + $this->ids['term'] = (int) $term['term_id']; + $post_id = $this->make_post( "{$this->prefix}_type", 'publish' ); + wp_set_object_terms( $post_id, array( $this->ids['term'] ), 'category' ); + + Uninstaller::run( self::PLUGIN_FILE, array( 'post_types' => array( "{$this->prefix}_type" ) ), self::stored_consent( 'yes' )( $this->prefix ) ); + + self::assertFalse( $this->post_exists( $post_id ) ); + self::assertSame( '0', $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i WHERE object_id = %d', $wpdb->term_relationships, $post_id ) ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Reads past the term cache. + } + + public function test_a_deleted_posts_id_keeps_its_relationships_in_a_taxonomy_of_another_object_type(): void { + global $wpdb; + + $taxonomy = "{$this->prefix}_team"; + register_taxonomy( $taxonomy, 'user' ); + $term = wp_insert_term( "$this->prefix-team", $taxonomy ); + try { + self::assertIsArray( $term ); + $post_id = $this->make_post( "{$this->prefix}_type", 'publish' ); + wp_set_object_terms( $post_id, array( (int) $term['term_id'] ), $taxonomy ); // Stands for the user that shares the post's id. + + Uninstaller::run( self::PLUGIN_FILE, array( 'post_types' => array( "{$this->prefix}_type" ) ), self::stored_consent( 'yes' )( $this->prefix ) ); + + self::assertFalse( $this->post_exists( $post_id ) ); + self::assertSame( '1', $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i WHERE object_id = %d', $wpdb->term_relationships, $post_id ) ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Reads past the term cache. + } finally { + if ( \is_array( $term ) ) { + wp_delete_term( (int) $term['term_id'], $taxonomy ); + } + unregister_taxonomy( $taxonomy ); + } + } + + public function test_a_post_whose_delete_wordpress_refuses_keeps_its_term_relationships(): void { + global $wpdb; + + $term = wp_insert_term( "$this->prefix-tagged", 'category' ); + self::assertIsArray( $term ); + $this->ids['term'] = (int) $term['term_id']; + $post_id = $this->make_post( "{$this->prefix}_type", 'publish' ); + wp_set_object_terms( $post_id, array( $this->ids['term'] ), 'category' ); + add_filter( 'pre_delete_post', '__return_false' ); + + try { + Uninstaller::run( self::PLUGIN_FILE, array( 'post_types' => array( "{$this->prefix}_type" ) ), self::stored_consent( 'yes' )( $this->prefix ) ); + self::fail( 'The refused delete was not reported.' ); + } catch ( RuntimeException ) { + self::assertTrue( $this->post_exists( $post_id ) ); + } finally { + remove_filter( 'pre_delete_post', '__return_false' ); // The fixtures' own deletes must not be refused. + } + + self::assertSame( '1', $wpdb->get_var( $wpdb->prepare( 'SELECT COUNT(*) FROM %i WHERE object_id = %d', $wpdb->term_relationships, $post_id ) ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Reads past the term cache. + } + public function test_the_cleanup_runs_first_while_the_footprint_and_the_consent_row_are_stored(): void { $consent_option = "{$this->prefix}_cache_remove_data"; update_option( $consent_option, 'yes' ); diff --git a/tests/Integration/Support/consumer-request.php b/tests/Integration/Support/consumer-request.php index 7325f7f..0b40224 100644 --- a/tests/Integration/Support/consumer-request.php +++ b/tests/Integration/Support/consumer-request.php @@ -2,7 +2,7 @@ /** * Runs copies of the consumer and persona fixtures in the request: activates them on the site, defines the spec's constants and locale, skips WordPress's update check, and records how each consumer and the core persona booted, once the admin initializes and again after a plugin's activation, what consumer-a and the core persona did, and what WooCommerce logged. * - * The spec may also mint the nonce of an action the request checks, relax consumer-a's export safeguard with a value, expect warnings for files a partial deploy removed, uninstall a copy, or run consumer-a's order-count export with a failing order query. + * The spec may also mint the nonce of an action the request checks, relax consumer-a's export safeguard with a value, expect warnings for files a partial deploy removed, uninstall a copy, fail every query that holds a given text, or run consumer-a's order-count export with a failing order query. * * @package Acme */ @@ -27,6 +27,10 @@ static function ( int $level, string $message, string $file, int $line ) use ( $ ini_set( 'error_log', $spec['log'] ); // phpcs:ignore WordPress.PHP.IniSet.Risky -- Captures the plugin's log lines. } +if ( '' !== ( $spec['failing_query'] ?? '' ) ) { + add_filter( 'query', static fn ( string $query ): string => str_contains( $query, $spec['failing_query'] ) ? 'SELECT * FROM acme_missing_table' : $query ); +} + foreach ( $spec['constants'] ?? array() as $acme_name => $acme_value ) { define( $acme_name, $acme_value ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.VariableConstantNameFound -- Defines what the spec names. } From 11c0718638a6bc60a60711f4be19427fe5e23c07 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:06 +0100 Subject: [PATCH 10/33] Test that the object stores refuse objects MetadataStore and OrderMetaStore accept any value, but the metadata API rewrites an object's public properties as it unslashes them, and an object's class name changes with each plugin's scoping prefix, so it would not read back. The rows expect an object, at the top or nested in an array, to throw before any key is written, in post meta and in both of WooCommerce's order storages. Assisted-by: Claude Code:claude-opus-5-5 --- .../EditScreen/Stores/MetadataStoreTest.php | 29 ++++++++++++++++ .../EditScreen/Stores/OrderMetaStoreTest.php | 34 +++++++++++++++++++ 2 files changed, 63 insertions(+) diff --git a/tests/Integration/Settings/EditScreen/Stores/MetadataStoreTest.php b/tests/Integration/Settings/EditScreen/Stores/MetadataStoreTest.php index 2b6d7e2..95492de 100644 --- a/tests/Integration/Settings/EditScreen/Stores/MetadataStoreTest.php +++ b/tests/Integration/Settings/EditScreen/Stores/MetadataStoreTest.php @@ -3,6 +3,7 @@ namespace DeepWebSolutions\Framework\Tests\Integration\Settings\EditScreen\Stores; use DeepWebSolutions\Framework\Settings\EditScreen\Stores\MetadataStore; +use DeepWebSolutions\Framework\Shared\Exception\InvalidArgumentException; use DeepWebSolutions\Framework\Tests\Integration\Support\CreatesUsersTrait; use DeepWebSolutions\Framework\Tests\Integration\Support\IsolatesStorageTrait; use PHPUnit\Framework\Attributes\After; @@ -77,6 +78,34 @@ public function test_values_are_stored_as_given_backslashes_included( string $me self::assertSame( array( array( 'C:\\dir', 'red' ) ), get_metadata( $meta_type, $object_id, "_{$this->prefix}_list", false ) ); } + public static function unstorable_values(): array { + return array( + 'object' => array( (object) array( 'path' => 'C:\\reports' ) ), + 'nested-object' => array( array( 'red', array( (object) array( 'path' => 'C:\\reports' ) ) ) ), + ); + } + + #[DataProvider( 'unstorable_values' )] + public function test_a_value_holding_anything_but_scalars_null_and_arrays_throws_before_any_key_is_written( mixed $value ): void { + $object_id = $this->make_object( 'post' ); + + try { + ( new MetadataStore( 'post' ) )->update_values( + $object_id, + array( + "_{$this->prefix}_first" => 'Written first.', + "_{$this->prefix}_value" => $value, + ) + ); + self::fail( 'The store wrote a value it cannot keep.' ); + } catch ( InvalidArgumentException $exception ) { + self::assertStringContainsString( "_{$this->prefix}_value", $exception->getMessage() ); + } + + self::assertSame( array(), get_metadata( 'post', $object_id, "_{$this->prefix}_first", false ) ); + self::assertSame( array(), get_metadata( 'post', $object_id, "_{$this->prefix}_value", false ) ); + } + #[DataProvider( 'meta_types' )] public function test_a_stored_empty_value_survives_a_round_trip( string $meta_type ): void { $object_id = $this->make_object( $meta_type ); diff --git a/tests/Integration/WooCommerce/EditScreen/Stores/OrderMetaStoreTest.php b/tests/Integration/WooCommerce/EditScreen/Stores/OrderMetaStoreTest.php index 5a0362d..a7a332d 100644 --- a/tests/Integration/WooCommerce/EditScreen/Stores/OrderMetaStoreTest.php +++ b/tests/Integration/WooCommerce/EditScreen/Stores/OrderMetaStoreTest.php @@ -2,6 +2,7 @@ namespace DeepWebSolutions\Framework\Tests\Integration\WooCommerce\EditScreen\Stores; +use DeepWebSolutions\Framework\Shared\Exception\InvalidArgumentException; use DeepWebSolutions\Framework\Tests\Integration\Support\IsolatesHooksTrait; use DeepWebSolutions\Framework\Tests\Integration\Support\IsolatesStorageTrait; use DeepWebSolutions\Framework\Tests\Integration\WooCommerce\EditScreen\OrderFixturesTrait; @@ -63,6 +64,39 @@ public function test_values_are_stored_as_given_text_backslashes_included( strin self::assertSame( array( array( 'red', 'teal' ) ), $this->order_meta( $order->get_id(), "_{$this->prefix}_list" ) ); } + public static function storages_and_unstorable_values(): array { + $object = (object) array( 'path' => 'C:\\reports' ); + + return array( + 'order-tables-object' => array( 'hpos', $object ), + 'order-tables-nested-object' => array( 'hpos', array( 'red', array( $object ) ) ), + 'posts-table-object' => array( 'posts', $object ), + 'posts-table-nested-object' => array( 'posts', array( 'red', array( $object ) ) ), + ); + } + + #[DataProvider( 'storages_and_unstorable_values' )] + public function test_a_value_holding_anything_but_scalars_null_and_arrays_throws_before_any_key_is_written( string $storage, mixed $value ): void { + $this->use_order_storage( $storage ); + $order = $this->make_order(); + + try { + ( new OrderMetaStore() )->update_values( + $order->get_id(), + array( + "_{$this->prefix}_first" => 'Written first.', + "_{$this->prefix}_value" => $value, + ) + ); + self::fail( 'The store wrote a value it cannot keep.' ); + } catch ( InvalidArgumentException $exception ) { + self::assertStringContainsString( "_{$this->prefix}_value", $exception->getMessage() ); + } + + self::assertSame( array(), $this->order_meta( $order->get_id(), "_{$this->prefix}_first" ) ); + self::assertSame( array(), $this->order_meta( $order->get_id(), "_{$this->prefix}_value" ) ); + } + #[DataProvider( 'order_storages' )] public function test_a_stored_empty_value_survives_a_round_trip( string $storage ): void { $this->use_order_storage( $storage ); From 86273f9b191a8d6e19cf3e4a61cd00d230b21366 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:06 +0100 Subject: [PATCH 11/33] Test nested value objects of different classes Nested equality calls a value object's equals() with an object of any class, while equals() admits only its own class, so a lenient implementation reports two different objects as equal. The rows expect sibling classes with equal values, a lenient object beside another class, an integer beside a numeric string and distinct objects of equal state to compare unequal, and one object held by both to compare equal. Assisted-by: Claude Code:claude-opus-5-5 --- .../ValueObject/AbstractValueObjectTest.php | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/Unit/Shared/ValueObject/AbstractValueObjectTest.php b/tests/Unit/Shared/ValueObject/AbstractValueObjectTest.php index f5696c6..d951399 100644 --- a/tests/Unit/Shared/ValueObject/AbstractValueObjectTest.php +++ b/tests/Unit/Shared/ValueObject/AbstractValueObjectTest.php @@ -49,13 +49,23 @@ public function __construct( final readonly class Euro extends Money {} +final readonly class Dollar extends Money {} + +final class Lenient implements ValueObjectInterface { + #[\Override] + public function equals( ValueObjectInterface $other ): bool { + return true; + } +} + #[CoversClass( AbstractValueObject::class )] final class AbstractValueObjectTest extends TestCase { public static function pairs(): array { - $keyed = array( + $keyed = array( 'a' => 1, 'b' => 2, ); + $shared = new \stdClass(); return array( 'dates-half-a-second-apart' => array( new Box( new \DateTimeImmutable( '2026-01-01 12:00:00.000000 UTC' ) ), new Box( new \DateTimeImmutable( '2026-01-01 12:00:00.500000 UTC' ) ), false ), @@ -72,6 +82,11 @@ public static function pairs(): array { 'differing-private-property' => array( new Sealed( 1, 2 ), new Sealed( 1, 9 ), false ), 'differing-private-parent-property' => array( new Euro( 1 ), new Euro( 2 ), false ), 'different-classes-with-equal-values' => array( new Weight( 5 ), new Length( 5 ), false ), + 'sibling-classes-with-equal-values' => array( new Euro( 1 ), new Dollar( 1 ), false ), + 'nested-lenient-and-another-class' => array( new Box( new Lenient() ), new Box( new Weight( 5 ) ), false ), + 'integer-and-numeric-string' => array( new Box( 1 ), new Box( '1' ), false ), + 'distinct-objects-of-equal-state' => array( new Box( new \stdClass() ), new Box( new \stdClass() ), false ), + 'one-object-in-both' => array( new Box( $shared ), new Box( $shared ), true ), ); } From bed7ae88684cf2cb888dddeb82bcabbf05480360 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:07 +0100 Subject: [PATCH 12/33] Test typed less-than signs, checked checkboxes and the rejection A lone '<' typed into a text or textarea field comes back as a visible '<' after the save, because the sanitizer encodes it and every output escapes it again; a checkbox renders checked only for 'yes', while its sanitizer and convention 8's typed read also treat true and '1' as on; and the rejection sentence does not say that the other changes were saved (X ruling 334). The rows expect '<' kept and a typed '<' read as text, a checkbox checked for true and '1', and the new sentence on every host. The product panel's entity row stores a value without '<', which a save now turns back into '<'. Assisted-by: Claude Code:claude-opus-5-5 --- tests/Integration/Personas/SettingsPersonaTest.php | 2 +- .../Settings/AdminPage/OptionsPageTest.php | 10 +++++----- .../Settings/EditScreen/Hosts/PostMetaBoxTest.php | 8 ++++---- .../Settings/EditScreen/Hosts/TermFormTest.php | 2 +- .../Settings/EditScreen/Hosts/UserProfileTest.php | 6 +++--- .../Settings/EditScreen/ObjectFormTest.php | 4 ++-- .../Settings/FormsGetRejectionMessageTest.php | 4 ++-- .../Integration/Settings/FormsRenderControlTest.php | 12 ++++++++++++ .../Integration/Settings/FormsSanitizeValueTest.php | 3 +++ .../EditScreen/Hosts/OrderMetaBoxTest.php | 6 +++--- .../WooCommerce/ProductData/ProductDataTabTest.php | 12 ++++++------ .../Integration/WooCommerce/Setting/SettingsTest.php | 8 ++++---- 12 files changed, 46 insertions(+), 31 deletions(-) diff --git a/tests/Integration/Personas/SettingsPersonaTest.php b/tests/Integration/Personas/SettingsPersonaTest.php index f634f42..7ad0aa8 100644 --- a/tests/Integration/Personas/SettingsPersonaTest.php +++ b/tests/Integration/Personas/SettingsPersonaTest.php @@ -36,7 +36,7 @@ public function test_a_rejected_limit_keeps_the_stored_one_and_its_message_shows self::assertIsString( $saved['location'] ); $page = $this->consumer_request( 'GET', \explode( '/wp-admin/', $saved['location'], 2 )[1], $saved['user'], $saved['spec'] ); - self::assertStringContainsString( 'Limit was not saved, so it keeps its previous value. Enter a whole number of at least 1.', $page['body'] ); + self::assertStringContainsString( 'Limit was not saved and keeps its previous value. The other changes were saved. Enter a whole number of at least 1.', $page['body'] ); } // Posts the settings tab as the browser submits it after the user typed the limit. diff --git a/tests/Integration/Settings/AdminPage/OptionsPageTest.php b/tests/Integration/Settings/AdminPage/OptionsPageTest.php index ad923ed..60fcd2a 100644 --- a/tests/Integration/Settings/AdminPage/OptionsPageTest.php +++ b/tests/Integration/Settings/AdminPage/OptionsPageTest.php @@ -146,7 +146,7 @@ public function test_a_rejected_field_keeps_its_value_and_its_message_shows_once $saved = $this->save( $spec, $this->admin, $data ); self::assertSame( array( 'name' => 'old' ), get_option( $this->option ) ); - self::assertSame( array( 'Name was not saved, so it keeps its previous value. Use at most four characters.' ), self::notices( $this->follow( $spec, $this->admin, $saved )['body'] ) ); + self::assertSame( array( 'Name was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), self::notices( $this->follow( $spec, $this->admin, $saved )['body'] ) ); } #[DataProvider( 'parents' )] @@ -168,7 +168,7 @@ public function test_a_rejection_without_a_message_says_that_the_value_is_not_va $saved = $this->save( $spec, $this->admin, $data ); self::assertSame( array( 'name' => 'old' ), get_option( $this->option ) ); - self::assertSame( array( 'Name was not saved because its value is not valid, so it keeps its previous value.' ), self::notices( $this->follow( $spec, $this->admin, $saved )['body'] ) ); + self::assertSame( array( 'Name was not saved because its value is not valid, and keeps its previous value. The other changes were saved.' ), self::notices( $this->follow( $spec, $this->admin, $saved )['body'] ) ); } public function test_a_built_in_rejection_carries_what_to_enter(): void { @@ -179,7 +179,7 @@ public function test_a_built_in_rejection_carries_what_to_enter(): void { $saved = $this->save( $spec, $this->admin, $data ); self::assertSame( array( 'email' => 'ops@example.com' ), get_option( $this->option ) ); - self::assertSame( array( 'Email was not saved, so it keeps its previous value. Enter a valid email address, such as name@example.com.' ), self::notices( $this->follow( $spec, $this->admin, $saved )['body'] ) ); + self::assertSame( array( 'Email was not saved and keeps its previous value. The other changes were saved. Enter a valid email address, such as name@example.com.' ), self::notices( $this->follow( $spec, $this->admin, $saved )['body'] ) ); } public function test_titles_and_messages_print_as_text_and_an_untitled_field_is_labelled_and_named_by_its_id(): void { @@ -208,8 +208,8 @@ public function test_titles_and_messages_print_as_text_and_an_untitled_field_is_ self::assertNull( self::document( $form )->querySelector( 'form em' ) ); self::assertSame( array( - 'Email was not saved, so it keeps its previous value. Enter a valid email address, such as name@example.com.', - 'site was not saved, so it keeps its previous value. Enter a valid URL, such as https://example.com.', + 'Email was not saved and keeps its previous value. The other changes were saved. Enter a valid email address, such as name@example.com.', + 'site was not saved and keeps its previous value. The other changes were saved. Enter a valid URL, such as https://example.com.', ), self::notices( $page ) ); diff --git a/tests/Integration/Settings/EditScreen/Hosts/PostMetaBoxTest.php b/tests/Integration/Settings/EditScreen/Hosts/PostMetaBoxTest.php index c7eb084..535a3cc 100644 --- a/tests/Integration/Settings/EditScreen/Hosts/PostMetaBoxTest.php +++ b/tests/Integration/Settings/EditScreen/Hosts/PostMetaBoxTest.php @@ -64,8 +64,8 @@ public static function group_fields(): array { public static function silent_and_worded_rejections(): array { return array( - 'worded' => array( 'acme:reject', "Customer's note \\o/ was not saved, so it keeps its previous value. Use at most four characters." ), - 'silent' => array( 'acme:reject-silently', "Customer's note \\o/ was not saved because its value is not valid, so it keeps its previous value." ), + 'worded' => array( 'acme:reject', "Customer's note \\o/ was not saved and keeps its previous value. The other changes were saved. Use at most four characters." ), + 'silent' => array( 'acme:reject-silently', "Customer's note \\o/ was not saved because its value is not valid, and keeps its previous value. The other changes were saved." ), ); } @@ -426,7 +426,7 @@ public function test_a_membership_rejection_names_the_field_and_what_to_enter(): $saved = $this->save( $spec, $post_id, array(), array( $this->id => array( "_{$this->prefix}_color" => 'black' ) ) ); self::assertSame( array( 'red' ), $this->meta( $post_id, 'color' ) ); - self::assertSame( array( 'Color was not saved, so it keeps its previous value. Choose one of the available options.' ), self::rejections( $this->follow( $spec, $saved )['body'] ) ); + self::assertSame( array( 'Color was not saved and keeps its previous value. The other changes were saved. Choose one of the available options.' ), self::rejections( $this->follow( $spec, $saved )['body'] ) ); } public function test_a_new_post_renders_defaults_and_saves_them_on_publish(): void { @@ -682,7 +682,7 @@ public function test_a_rejection_in_the_block_editor_reaches_the_editor_after_th self::assertSame( array( 'kept' ), $this->meta( $post_id, 'note' ) ); self::assertNotNull( self::document( $redirected['body'] )->querySelector( 'form.metabox-base-form' ) ); - self::assertSame( array( 'Note was not saved, so it keeps its previous value. Use at most four characters.' ), \array_column( $delivered, 'content' ) ); + self::assertSame( array( 'Note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), \array_column( $delivered, 'content' ) ); self::assertSame( array(), self::rejections( $list['body'] ) ); } diff --git a/tests/Integration/Settings/EditScreen/Hosts/TermFormTest.php b/tests/Integration/Settings/EditScreen/Hosts/TermFormTest.php index 207f372..9322e36 100644 --- a/tests/Integration/Settings/EditScreen/Hosts/TermFormTest.php +++ b/tests/Integration/Settings/EditScreen/Hosts/TermFormTest.php @@ -114,7 +114,7 @@ public function test_update_saves_the_accepted_fields_and_shows_a_rejection_afte self::assertSame( array( 'O\'Brien C:\\dir' ), $this->meta( $term_id, 'name' ) ); self::assertSame( array( 'kept' ), $this->meta( $term_id, 'note' ) ); - self::assertSame( array( 'Note was not saved, so it keeps its previous value. Use at most four characters.' ), self::rejections( $next['body'] ) ); + self::assertSame( array( 'Note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), self::rejections( $next['body'] ) ); self::assertSame( array(), self::rejections( $after['body'] ) ); } diff --git a/tests/Integration/Settings/EditScreen/Hosts/UserProfileTest.php b/tests/Integration/Settings/EditScreen/Hosts/UserProfileTest.php index 7322f7a..942b43e 100644 --- a/tests/Integration/Settings/EditScreen/Hosts/UserProfileTest.php +++ b/tests/Integration/Settings/EditScreen/Hosts/UserProfileTest.php @@ -131,7 +131,7 @@ public function test_both_screens_save_the_accepted_fields_and_show_a_rejection_ self::assertSame( array( 'O\'Brien C:\\dir' ), $this->meta( $user_id, 'name' ) ); self::assertSame( array( array( 'red', 'teal' ) ), $this->meta( $user_id, 'color' ) ); self::assertSame( array( 'kept' ), $this->meta( $user_id, 'note' ) ); - self::assertSame( array( 'Note was not saved, so it keeps its previous value. Use at most four characters.' ), self::rejections( $next['body'] ) ); + self::assertSame( array( 'Note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), self::rejections( $next['body'] ) ); self::assertSame( array(), self::rejections( $after['body'] ) ); } @@ -150,7 +150,7 @@ public function test_a_rejection_on_a_multisite_profile_shows_after_the_redirect } self::assertStringStartsWith( \explode( '/', $path )[0] . '/profile.php', \explode( '/wp-admin/', (string) $saved['location'], 2 )[1] ); - self::assertSame( array( 'Note was not saved, so it keeps its previous value. Use at most four characters.' ), self::rejections( $next['body'] ) ); + self::assertSame( array( 'Note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), self::rejections( $next['body'] ) ); } public function test_a_core_profile_error_shows_the_forms_rejection_in_the_same_response(): void { @@ -168,7 +168,7 @@ public function test_a_core_profile_error_shows_the_forms_rejection_in_the_same_ self::assertNull( $saved['location'] ); self::assertNotNull( self::document( $saved['body'] )->querySelector( 'div.error' ) ); - self::assertSame( array( 'Note was not saved, so it keeps its previous value. Use at most four characters.' ), self::rejections( $saved['body'] ) ); + self::assertSame( array( 'Note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), self::rejections( $saved['body'] ) ); self::assertSame( array( 'saved anyway' ), $this->meta( $this->subscriber, 'name' ) ); } diff --git a/tests/Integration/Settings/EditScreen/ObjectFormTest.php b/tests/Integration/Settings/EditScreen/ObjectFormTest.php index f8355c1..f9c914f 100644 --- a/tests/Integration/Settings/EditScreen/ObjectFormTest.php +++ b/tests/Integration/Settings/EditScreen/ObjectFormTest.php @@ -164,7 +164,7 @@ public function test_each_rejection_becomes_a_one_shot_error_notice_for_the_user $stored = $notices->get_notices( NoticeScope::User, $this->author_id ); self::assertCount( 1, $stored ); - self::assertSame( 'Note & more was not saved, so it keeps its previous value. Use at most four characters.', $stored[0]->message ); + self::assertSame( 'Note & more was not saved and keeps its previous value. The other changes were saved. Use at most four characters.', $stored[0]->message ); self::assertSame( NoticeType::Error, $stored[0]->type ); self::assertFalse( $stored[0]->persistent ); self::assertSame( 'Saved.', get_post_meta( $this->post_id, "_{$this->prefix}_name", true ) ); @@ -182,7 +182,7 @@ public function test_a_second_rejection_of_a_field_replaces_the_first(): void { $stored = $notices->get_notices( NoticeScope::User, $this->author_id ); self::assertCount( 1, $stored ); self::assertSame( 'rejection-' . \md5( "{$this->prefix}_details|_{$this->prefix}_note" ), $stored[0]->id ); - self::assertSame( 'Renamed note was not saved, so it keeps its previous value. Use at most four characters.', $stored[0]->message ); + self::assertSame( 'Renamed note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.', $stored[0]->message ); } public function test_a_rejection_whose_notice_cannot_be_stored_is_logged_and_keeps_the_accepted_values(): void { diff --git a/tests/Integration/Settings/FormsGetRejectionMessageTest.php b/tests/Integration/Settings/FormsGetRejectionMessageTest.php index 63ac4e4..bc640bd 100644 --- a/tests/Integration/Settings/FormsGetRejectionMessageTest.php +++ b/tests/Integration/Settings/FormsGetRejectionMessageTest.php @@ -9,10 +9,10 @@ #[CoversClass( Forms::class )] final class FormsGetRejectionMessageTest extends TestCase { public function test_a_worded_rejection_names_the_field_and_what_to_enter_as_plain_text(): void { - self::assertSame( "Customer's note was not saved, so it keeps its previous value. Use at most four characters.", Forms::get_rejection_message( "Customer's note", new \WP_Error( 'acme_rejected', 'Use at most four characters.' ) ) ); + self::assertSame( "Customer's note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.", Forms::get_rejection_message( "Customer's note", new \WP_Error( 'acme_rejected', 'Use at most four characters.' ) ) ); } public function test_a_silent_rejection_names_the_field_alone(): void { - self::assertSame( 'Note was not saved because its value is not valid, so it keeps its previous value.', Forms::get_rejection_message( 'Note', new \WP_Error( 'acme_rejected' ) ) ); + self::assertSame( 'Note was not saved because its value is not valid, and keeps its previous value. The other changes were saved.', Forms::get_rejection_message( 'Note', new \WP_Error( 'acme_rejected' ) ) ); } } diff --git a/tests/Integration/Settings/FormsRenderControlTest.php b/tests/Integration/Settings/FormsRenderControlTest.php index 2436a55..ff33554 100644 --- a/tests/Integration/Settings/FormsRenderControlTest.php +++ b/tests/Integration/Settings/FormsRenderControlTest.php @@ -144,6 +144,18 @@ public function test_a_checkbox_posts_a_hidden_no_before_its_yes(): void { self::assertFalse( self::render( 'checkbox', array(), 'no' )->getElementById( 'acme.key' )->hasAttribute( 'checked' ) ); } + public static function checked_values(): array { + return array( + 'true' => array( true ), + 'one' => array( '1' ), + ); + } + + #[DataProvider( 'checked_values' )] + public function test_a_checkbox_renders_checked_for_every_value_its_sanitizer_reads_as_yes( mixed $value ): void { + self::assertTrue( self::render( 'checkbox', array(), $value )->getElementById( 'acme.key' )->hasAttribute( 'checked' ) ); + } + public function test_a_checkbox_with_a_desc_is_named_by_its_title_and_labeled_by_its_desc(): void { $document = self::render( 'checkbox', diff --git a/tests/Integration/Settings/FormsSanitizeValueTest.php b/tests/Integration/Settings/FormsSanitizeValueTest.php index 5c055fc..289a48e 100644 --- a/tests/Integration/Settings/FormsSanitizeValueTest.php +++ b/tests/Integration/Settings/FormsSanitizeValueTest.php @@ -28,7 +28,10 @@ public static function accepted(): array { return array( 'text-strips-tags-and-trims' => array( 'text', ' Hi there ', 'Hi there' ), 'text-stringifies-an-int' => array( 'text', 5, '5' ), + 'text-keeps-a-lone-less-than' => array( 'text', 'a < b', 'a < b' ), + 'text-reads-a-typed-entity-as-text' => array( 'text', 'a < b', 'a < b' ), 'textarea-keeps-newlines' => array( 'textarea', "One\ntwo", "One\ntwo" ), + 'textarea-keeps-a-lone-less-than' => array( 'textarea', "1 < 2\nOne", "1 < 2\nOne" ), 'email-is-trimmed' => array( 'email', ' ops@example.com ', 'ops@example.com' ), 'email-cleared' => array( 'email', '', '' ), 'url-is-kept' => array( 'url', 'https://example.com/a?b=c', 'https://example.com/a?b=c' ), diff --git a/tests/Integration/WooCommerce/EditScreen/Hosts/OrderMetaBoxTest.php b/tests/Integration/WooCommerce/EditScreen/Hosts/OrderMetaBoxTest.php index 731151a..c729b7b 100644 --- a/tests/Integration/WooCommerce/EditScreen/Hosts/OrderMetaBoxTest.php +++ b/tests/Integration/WooCommerce/EditScreen/Hosts/OrderMetaBoxTest.php @@ -58,8 +58,8 @@ public static function group_fields(): array { public static function silent_and_worded_rejections(): array { return array( - 'worded' => array( 'acme:reject', "Customer's note \\o/ was not saved, so it keeps its previous value. Use at most four characters." ), - 'silent' => array( 'acme:reject-silently', "Customer's note \\o/ was not saved because its value is not valid, so it keeps its previous value." ), + 'worded' => array( 'acme:reject', "Customer's note \\o/ was not saved and keeps its previous value. The other changes were saved. Use at most four characters." ), + 'silent' => array( 'acme:reject-silently', "Customer's note \\o/ was not saved because its value is not valid, and keeps its previous value. The other changes were saved." ), ); } @@ -404,7 +404,7 @@ public function test_on_the_posts_table_a_rejection_shows_after_the_redirect(): $saved = $this->posts_save( $spec, $order->get_id(), array( $this->control_name( 'note' ) => 'too long' ) ); self::assertSame( array( 'kept' ), $this->meta( $order->get_id(), 'note' ) ); - self::assertSame( array( 'Note was not saved, so it keeps its previous value. Use at most four characters.' ), self::rejections( $this->follow( $spec, $saved )['body'] ) ); + self::assertSame( array( 'Note was not saved and keeps its previous value. The other changes were saved. Use at most four characters.' ), self::rejections( $this->follow( $spec, $saved )['body'] ) ); } protected function spec( array $fields, array $form = array(), array $extra = array() ): array { diff --git a/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php b/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php index 109fb7c..706025e 100644 --- a/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php +++ b/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php @@ -49,8 +49,8 @@ public static function disabled_checkboxes(): array { public static function silent_and_worded_rejections(): array { return array( - 'worded' => array( 'acme:reject', "Customer's note was not saved, so it keeps its previous value. Use at most four characters." ), - 'silent' => array( 'acme:reject-silently', "Customer's note was not saved because its value is not valid, so it keeps its previous value." ), + 'worded' => array( 'acme:reject', "Customer's note was not saved and keeps its previous value. The other changes were saved. Use at most four characters." ), + 'silent' => array( 'acme:reject-silently', "Customer's note was not saved because its value is not valid, and keeps its previous value. The other changes were saved." ), ); } @@ -481,7 +481,7 @@ public function test_a_field_whose_name_differs_from_its_id_saves_under_its_name } public function test_text_holding_html_entities_survives_an_unchanged_save(): void { - $stored = 'Use <b>bold</b> & more'; + $stored = 'Use "bold" > plain & more'; $product = $this->make_product( array( "_{$this->prefix}_name" => $stored ) ); $spec = $this->spec( array( $this->group( array( $this->field( 'text', 'name' ) ) ) ) ); @@ -535,7 +535,7 @@ public function test_a_rejected_choice_keeps_the_stored_value_and_says_what_to_c $this->save( $spec, $product->get_id(), array(), array( "_{$this->prefix}_color" => 'purple' ) ); self::assertSame( array( 'red' ), $this->meta( $product, 'color' ) ); - self::assertSame( array( 'Color was not saved, so it keeps its previous value. Choose one of the available options.' ), $this->errors( $spec, $product ) ); + self::assertSame( array( 'Color was not saved and keeps its previous value. The other changes were saved. Choose one of the available options.' ), $this->errors( $spec, $product ) ); } #[DataProvider( 'silent_and_worded_rejections' )] @@ -632,7 +632,7 @@ public function test_a_checkboxes_group_rejects_an_unknown_choice(): void { $this->save( $spec, $product->get_id(), array(), array( "_{$this->prefix}_colors" => array( 'purple' ) ) ); self::assertSame( array( array( 'blue' ) ), $this->meta( $product, 'colors' ) ); - self::assertSame( array( 'Colors was not saved, so it keeps its previous value. Choose one of the available options.' ), $this->errors( $spec, $product ) ); + self::assertSame( array( 'Colors was not saved and keeps its previous value. The other changes were saved. Choose one of the available options.' ), $this->errors( $spec, $product ) ); } public function test_a_custom_type_field_stores_its_validates_return_value_under_its_key(): void { @@ -652,7 +652,7 @@ public function test_a_custom_type_field_without_validate_is_rejected(): void { $this->save( $spec, $product->get_id(), array( "_{$this->prefix}_widget" => 'v' ) ); self::assertSame( array( 'old' ), $this->meta( $product, 'widget' ) ); - self::assertSame( array( 'Widget was not saved, so it keeps its previous value. This field cannot be saved because nothing validates its value.' ), $this->errors( $spec, $product ) ); + self::assertSame( array( 'Widget was not saved and keeps its previous value. The other changes were saved. This field cannot be saved because nothing validates its value.' ), $this->errors( $spec, $product ) ); } public function test_an_unsupported_product_never_saves_the_tabs_fields(): void { diff --git a/tests/Integration/WooCommerce/Setting/SettingsTest.php b/tests/Integration/WooCommerce/Setting/SettingsTest.php index 025a0ec..dcecd41 100644 --- a/tests/Integration/WooCommerce/Setting/SettingsTest.php +++ b/tests/Integration/WooCommerce/Setting/SettingsTest.php @@ -59,8 +59,8 @@ protected function tearDown(): void { public static function silent_and_worded_rejections(): array { return array( - 'worded' => array( 'acme:reject', "Customer's note was not saved, so it keeps its previous value. Use at most four characters." ), - 'silent' => array( 'acme:reject-silently', "Customer's note was not saved because its value is not valid, so it keeps its previous value." ), + 'worded' => array( 'acme:reject', "Customer's note was not saved and keeps its previous value. The other changes were saved. Use at most four characters." ), + 'silent' => array( 'acme:reject-silently', "Customer's note was not saved because its value is not valid, and keeps its previous value. The other changes were saved." ), ); } @@ -454,7 +454,7 @@ public function test_a_custom_type_field_without_validate_is_rejected(): void { $saved = self::document( $this->save( $spec, '', array( "{$this->prefix}_widget" => 'w' ) )['body'] ); self::assertSame( 'old', get_option( "{$this->prefix}_widget" ) ); - self::assertSame( array( 'Widget was not saved, so it keeps its previous value. This field cannot be saved because nothing validates its value.' ), self::texts( $saved, '#message.error' ) ); + self::assertSame( array( 'Widget was not saved and keeps its previous value. The other changes were saved. This field cannot be saved because nothing validates its value.' ), self::texts( $saved, '#message.error' ) ); } public function test_a_custom_type_field_the_helper_does_not_own_is_not_printed(): void { @@ -503,7 +503,7 @@ public function test_a_checkboxes_group_rejects_an_unknown_choice(): void { $saved = self::document( $this->save( $spec, '', array(), array( "{$this->prefix}_colors" => array( 'pink' ) ) )['body'] ); self::assertSame( array( 'red' ), get_option( "{$this->prefix}_colors" ) ); - self::assertSame( array( 'Colors was not saved, so it keeps its previous value. Choose one of the available options.' ), self::texts( $saved, '#message.error' ) ); + self::assertSame( array( 'Colors was not saved and keeps its previous value. The other changes were saved. Choose one of the available options.' ), self::texts( $saved, '#message.error' ) ); } protected function tab_spec( array $sections ): array { From d4f01de209437e9d0aae86647b58ae8b4cb42c61 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:07 +0100 Subject: [PATCH 13/33] Test product radios and the ids WooCommerce rewrites Product-panel radios render through woocommerce_wp_radio(), which ignores disabled, so a disabled radio drops the user's change and a disabled stored choice is rejected on every save; and WooCommerce passes tab and section ids through sanitize_title(), so a rewritten id leaves the fields unclaimed and their validate bypassed. The rows expect a disabled radio and a disabled choice rendered disabled and kept, and an id that sanitize_title() rewrites rejected as a tab id, a section key and a section id. The panel's textarea, radio, email and url fields also render and keep entities and quotes. Assisted-by: Claude Code:claude-opus-5-5 --- .../ProductData/ProductDataTabTest.php | 91 +++++++++++++++++++ .../WooCommerce/Setting/SettingsTest.php | 27 ++++++ 2 files changed, 118 insertions(+) diff --git a/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php b/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php index 706025e..87f6f7e 100644 --- a/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php +++ b/tests/Integration/WooCommerce/ProductData/ProductDataTabTest.php @@ -310,6 +310,61 @@ public function test_a_disabled_checkbox_renders_disabled_without_its_hidden_inp self::assertNull( $screen->querySelector( "input[type=hidden][name=\"_{$this->prefix}_flag\"]" ) ); } + public function test_a_disabled_radio_renders_every_choice_disabled_and_keeps_its_value(): void { + $product = $this->make_product( array( "_{$this->prefix}_color" => 'blue' ) ); + $spec = $this->spec( + array( + $this->group( + array( + $this->field( + 'radio', + 'color', + array( + 'options' => self::COLORS, + 'custom_attributes' => array( 'disabled' => 'disabled' ), + ) + ), + ) + ), + ) + ); + + $screen = self::document( $this->edit_screen( $spec, $product->get_id() )['body'] ); + $inputs = \iterator_to_array( $screen->querySelectorAll( "fieldset.form-field input[type=radio][name=\"_{$this->prefix}_color\"]" ) ); + $this->save( $spec, $product->get_id(), array( "_{$this->prefix}_color" => 'red' ) ); + + self::assertCount( \count( self::COLORS ), $inputs ); + self::assertSame( array( true, true, true ), \array_map( static fn ( \Dom\Element $input ): bool => $input->hasAttribute( 'disabled' ), $inputs ) ); + self::assertSame( array( 'blue' ), $this->meta( $product, 'color' ) ); + } + + public function test_a_stored_choice_that_is_disabled_renders_disabled_and_saves_without_a_rejection(): void { + $product = $this->make_product( array( "_{$this->prefix}_color" => 'blue' ) ); + $spec = $this->spec( + array( + $this->group( + array( + $this->field( + 'radio', + 'color', + array( + 'options' => self::COLORS, + 'disabled' => array( 'blue' ), + ) + ), + ) + ), + ) + ); + + $screen = self::document( $this->edit_screen( $spec, $product->get_id() )['body'] ); + $this->save( $spec, $product->get_id() ); + + self::assertTrue( $screen->querySelector( "fieldset.form-field input[type=radio][name=\"_{$this->prefix}_color\"][value=\"blue\"]" )?->hasAttribute( 'disabled' ) ); + self::assertSame( array( 'blue' ), $this->meta( $product, 'color' ) ); + self::assertSame( array(), $this->errors( $spec, $product ) ); + } + public function test_an_unlabelled_field_is_labelled_by_its_id(): void { $product = $this->make_product(); $field = $this->field( 'text', 'name' ); @@ -492,6 +547,42 @@ public function test_text_holding_html_entities_survives_an_unchanged_save(): vo self::assertSame( array( $stored ), $this->meta( $product, 'name' ) ); } + // An email address cannot hold a semicolon, so its value carries the ampersand and the quote that its markup escapes. + public static function values_holding_entities_and_quotes(): array { + return array( + 'textarea' => array( 'textarea', 'Use "bold" & more', array() ), + 'radio' => array( + 'radio', + 'Tom & "Jerry"', + array( + 'options' => array( + 'plain' => 'Plain', + 'Tom & "Jerry"' => 'Both', + ), + ), + ), + 'email' => array( 'email', "o'neil&co@example.com", array() ), + 'url' => array( 'url', "https://example.com/?q='x'&page=2", array() ), + ); + } + + #[DataProvider( 'values_holding_entities_and_quotes' )] + public function test_a_value_holding_entities_and_quotes_renders_and_survives_an_unchanged_save( string $type, string $stored, array $keys ): void { + $product = $this->make_product( array( "_{$this->prefix}_value" => $stored ) ); + $spec = $this->spec( array( $this->group( array( $this->field( $type, 'value', $keys ) ) ) ) ); + + $screen = self::document( $this->edit_screen( $spec, $product->get_id() )['body'] ); + $this->save( $spec, $product->get_id() ); + + $shown = match ( $type ) { + 'textarea' => $this->control( $screen, 'value' )->textContent, // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase -- A DOM property. + 'radio' => $screen->querySelector( "input[type=radio][name=\"_{$this->prefix}_value\"][checked]" )?->getAttribute( 'value' ), + default => $this->control( $screen, 'value' )->getAttribute( 'value' ), + }; + self::assertSame( $stored, $shown ); + self::assertSame( array( $stored ), $this->meta( $product, 'value' ) ); + } + public function test_a_field_without_validate_is_sanitized_by_its_type(): void { $product = $this->make_product(); $spec = $this->spec( array( $this->group( array( $this->field( 'text', 'name' ) ) ) ) ); diff --git a/tests/Integration/WooCommerce/Setting/SettingsTest.php b/tests/Integration/WooCommerce/Setting/SettingsTest.php index dcecd41..6e62e77 100644 --- a/tests/Integration/WooCommerce/Setting/SettingsTest.php +++ b/tests/Integration/WooCommerce/Setting/SettingsTest.php @@ -78,6 +78,33 @@ public function test_an_invalid_section_id_is_rejected( string $id ): void { new SettingsSection( $id, $this->registered_section( 'products' ), $this->fields_definition() ); } + public static function ids_woocommerce_rewrites(): array { + return array( + 'double-hyphen' => array( 'acme--settings' ), + 'trailing-hyphen' => array( 'acme-settings-' ), + ); + } + + #[DataProvider( 'ids_woocommerce_rewrites' )] + public function test_an_id_woocommerce_would_rewrite_is_rejected_as_a_tab_id_a_section_key_and_a_section_id( string $id ): void { + $builds = array( + 'tab-id' => fn (): SettingsTab => new SettingsTab( $id, $this->tab( array() ), $this->fields_definition() ), + 'section-key' => fn (): SettingsTab => new SettingsTab( $this->prefix, $this->tab( array( $id => 'Acme' ) ), $this->fields_definition() ), + 'section-id' => fn (): SettingsSection => new SettingsSection( $id, $this->registered_section( 'products' ), $this->fields_definition() ), + ); + + $rejected = array(); + foreach ( $builds as $kind => $build ) { + try { + $build(); + } catch ( InvalidArgumentException ) { + $rejected[] = $kind; + } + } + + self::assertSame( \array_keys( $builds ), $rejected ); + } + #[DataProvider( 'v1_helper_ids' )] public function test_every_v1_key_is_a_valid_tab_and_section_id( string $id ): void { self::assertSame( $id, ( new SettingsTab( $id, $this->tab( array() ), $this->fields_definition() ) )->get_id() ); From 9331e0b1fd8934a1975148b5da8787cc6e8948c1 Mon Sep 17 00:00:00 2001 From: Tony Hegyes <36231502+ahegyes@users.noreply.github.com> Date: Mon, 9 Nov 2026 18:21:08 +0100 Subject: [PATCH 14/33] Offer only lowercase-labelled releases and describe them in full The prerelease pattern's /i flag admitted labels that version_compare() misorders; the stable channel trusted GitHub's prerelease flag, which is set by hand; the details modal escaped the release's Markdown and left out the author, homepage, release date and tested-up-to version; the cached record kept an unused tag; and a refused plugin outside the plugins directory made core warn on every admin screen (X ruling 167, and X ruling 294's A762). The pattern takes only lowercase dev, alpha, beta and rc, and the stable channel skips any tag holding '-'. The release request asks for GitHub's HTML media type, and the details carry its body_html, which core's kses filters, with the plugin's Author and Plugin URI, the release date and the entry's Tested up to header, which the offer carries too. The cached record drops its tag, and a refused plugin's notice returns before core reads headers from a file it cannot find. Assisted-by: Claude Code:claude-opus-5-5 --- packages/bootstrap/README.md | 2 +- packages/bootstrap/src/Requirements.php | 11 ++++-- packages/bootstrap/src/Updater.php | 50 ++++++++++++++++--------- 3 files changed, 41 insertions(+), 22 deletions(-) diff --git a/packages/bootstrap/README.md b/packages/bootstrap/README.md index 6de0d06..13fa9b0 100644 --- a/packages/bootstrap/README.md +++ b/packages/bootstrap/README.md @@ -79,7 +79,7 @@ if ( ! Requirements::check_floors( __FILE__ ) ) { require_once __DIR__ . '/functions.php'; ``` -The updater offers the plugin's GitHub releases through WordPress's own update screens while the plugin's `Update URI` header points at its github.com repository. It installs the release asset named after the plugin's text domain, such as `acme-persona-bootstrap.zip`, and the `dws_github_updater/config/{text-domain}` filter changes the repository, the asset or the channel, or turns updates off. It offers only tags such as `v2.1.0` or `v2.1.0-rc.1`, whose optional suffix is `-dev`, `-alpha`, `-beta` or `-rc` in any letter case, optionally numbered, because PHP's `version_compare()` ranks other suffixes above their release. +The updater offers the plugin's GitHub releases through WordPress's own update screens while the plugin's `Update URI` header points at its github.com repository. It installs the release asset named after the plugin's text domain, such as `acme-persona-bootstrap.zip`, and the `dws_github_updater/config/{text-domain}` filter changes the repository, the asset or the channel, or turns updates off. It offers only tags such as `v2.1.0` or `v2.1.0-rc.1`, whose optional suffix is `-dev`, `-alpha`, `-beta` or `-rc` in lowercase, optionally numbered, because PHP's `version_compare()` ranks other suffixes above their release. ## Contract and versioning diff --git a/packages/bootstrap/src/Requirements.php b/packages/bootstrap/src/Requirements.php index 302c7b6..3797a96 100644 --- a/packages/bootstrap/src/Requirements.php +++ b/packages/bootstrap/src/Requirements.php @@ -47,13 +47,18 @@ public static function check_floors( string $plugin_file ): bool { return true; } + $basename = plugin_basename( $plugin_file ); add_action( 'all_admin_notices', - static function () use ( $plugin_file ): void { + static function () use ( $basename ): void { + if ( ! \is_file( WP_PLUGIN_DIR . "/$basename" ) ) { + return; // Core reads the headers from the plugins directory, so it has no message for a plugin loaded from elsewhere. + } + // Core translates the plugin's headers while it builds the message, so the message waits until the notice renders. - $requirements = validate_plugin_requirements( plugin_basename( $plugin_file ) ); + $requirements = validate_plugin_requirements( $basename ); if ( ! is_wp_error( $requirements ) ) { - return; // Core reads the headers from the plugins directory, so a plugin loaded from elsewhere reads as compatible. + return; } self::print_admin_notice( $requirements ); diff --git a/packages/bootstrap/src/Updater.php b/packages/bootstrap/src/Updater.php index 167de0b..cae81f5 100644 --- a/packages/bootstrap/src/Updater.php +++ b/packages/bootstrap/src/Updater.php @@ -59,6 +59,7 @@ static function ( $update, $plugin_data, $file ) use ( $plugin_file, $basename ) 'package' => $release['package'], 'requires' => $release['requires'], 'requires_php' => $release['requires_php'], + 'tested' => $release['tested'], ); }, 10, @@ -82,6 +83,8 @@ static function ( $result, $action, $args ) use ( $plugin_file ) { 'name' => $config['name'], 'slug' => $config['slug'], 'version' => $config['version'], + 'author' => $config['author'], + 'homepage' => $config['homepage'], 'sections' => array(), // WordPress's details screen reads the sections without a guard. ); @@ -92,7 +95,9 @@ static function ( $result, $action, $args ) use ( $plugin_file ) { 'download_link' => $release['package'], 'requires' => $release['requires'], 'requires_php' => $release['requires_php'], - 'sections' => array( 'changelog' => \nl2br( esc_html( $release['body'] ) ) ), + 'tested' => $release['tested'], + 'last_updated' => $release['last_updated'], + 'sections' => array( 'changelog' => $release['body'] ), // GitHub renders the notes as HTML, which WordPress's details screen passes through kses. ) + $information; } @@ -115,7 +120,7 @@ static function ( $result, $action, $args ) use ( $plugin_file ) { * * @param string $plugin_file The path to the plugin's entry file. * - * @return array{repository: string, asset: string, channel: 'stable'|'prerelease', slug: string, name: string, version: string, file: string}|null + * @return array{repository: string, asset: string, channel: 'stable'|'prerelease', slug: string, name: string, version: string, author: string, homepage: string, file: string}|null */ protected static function get_updater_config( string $plugin_file ): ?array { if ( ! \function_exists( 'get_plugin_data' ) ) { @@ -164,6 +169,8 @@ protected static function get_updater_config( string $plugin_file ): ?array { 'slug' => $slug, 'name' => $headers['Name'], 'version' => $headers['Version'], + 'author' => $headers['Author'], + 'homepage' => $headers['PluginURI'], 'file' => \basename( $plugin_file ), ); } @@ -176,9 +183,9 @@ protected static function get_updater_config( string $plugin_file ): ?array { * @since 2.0.0 * @version 2.0.0 * - * @param array{repository: string, asset: string, channel: 'stable'|'prerelease', slug: string, name: string, version: string, file: string} $config The plugin's updater configuration. + * @param array{repository: string, asset: string, channel: 'stable'|'prerelease', slug: string, name: string, version: string, author: string, homepage: string, file: string} $config The plugin's updater configuration. * - * @return array{version: string, tag: string, package: string, url: string, body: string, requires: string, requires_php: string}|null + * @return array{version: string, package: string, url: string, body: string, last_updated: string, requires: string, requires_php: string, tested: string}|null */ protected static function get_release( array $config ): ?array { $transient = "{$config['slug']}_github_release_{$config['channel']}"; @@ -192,7 +199,7 @@ protected static function get_release( array $config ): ?array { return $release; } - $body = self::get_response_body( "https://api.github.com/repos/{$config['repository']}/" . ( 'prerelease' === $config['channel'] ? 'releases?per_page=10' : 'releases/latest' ) ); + $body = self::get_response_body( "https://api.github.com/repos/{$config['repository']}/" . ( 'prerelease' === $config['channel'] ? 'releases?per_page=10' : 'releases/latest' ), array( 'Accept' => 'application/vnd.github.html+json' ) ); $releases = null === $body ? null : \json_decode( $body, true ); $newest = array(); @@ -204,7 +211,11 @@ protected static function get_release( array $config ): ?array { } $candidate_version = \ltrim( $candidate['tag_name'], 'v' ); - if ( 1 !== \preg_match( '/^\d+(?:\.\d+)*(?:-(?:dev|alpha|beta|rc)(?:\.?\d+)?)?$/i', $candidate_version ) ) { // PHP's version_compare() orders only these labels below their release, and ranks others, such as 'pre' or 'patch', above it. + if ( 1 !== \preg_match( '/^\d+(?:\.\d+)*(?:-(?:dev|alpha|beta|rc)(?:\.?\d+)?)?$/', $candidate_version ) ) { // PHP's version_compare() orders only these labels below their release as their names say, and misorders others, such as 'pre', 'patch' or 'Beta'. + continue; + } + + if ( 'stable' === $config['channel'] && false !== \strpos( $candidate_version, '-' ) ) { // GitHub's prerelease flag is set by hand, so a suffixed tag can be the latest release. continue; } @@ -230,21 +241,23 @@ protected static function get_release( array $config ): ?array { $headers = array( 'requires' => 'Requires at least', 'requires_php' => 'Requires PHP', + 'tested' => 'Tested up to', ); $requirements = array(); foreach ( $headers as $field => $header ) { $requirements[ $field ] = 1 === \preg_match( '/^(?:[ \t]*<\?(?:php)?)?[ \t\/*#@]*' . \preg_quote( $header, '/' ) . ':(.*)$/mi', $entry_file, $match ) ? \trim( (string) \preg_replace( '/\s*(?:\*\/|\?>).*/', '', $match[1] ) ) : ''; } - // WordPress prints the PHP requirement unescaped on its details screen, so anything but a version makes the release unusable. - if ( \preg_grep( '/^(?:\d+(?:\.\d+)*)?$/', $requirements ) === $requirements ) { + // WordPress prints the PHP requirement unescaped on its details screen, so a requirement that is not a version makes the release unusable, while the tested version passes through core's kses. + $checked = \array_diff_key( $requirements, array( 'tested' => true ) ); + if ( \preg_grep( '/^(?:\d+(?:\.\d+)*)?$/', $checked ) === $checked ) { $release = self::read_release( array( - 'version' => $version, - 'tag' => $tag, - 'package' => $package, - 'url' => $newest['html_url'] ?? null, - 'body' => $newest['body'] ?? '', + 'version' => $version, + 'package' => $package, + 'url' => $newest['html_url'] ?? null, + 'body' => $newest['body_html'] ?? '', + 'last_updated' => $newest['published_at'] ?? '', ) + $requirements ); } @@ -262,7 +275,7 @@ protected static function get_release( array $config ): ?array { * * @param mixed $value The candidate record. * - * @return array{version: string, tag: string, package: string, url: string, body: string, requires: string, requires_php: string}|null + * @return array{version: string, package: string, url: string, body: string, last_updated: string, requires: string, requires_php: string, tested: string}|null */ protected static function read_release( $value ): ?array { if ( ! \is_array( $value ) ) { @@ -270,7 +283,7 @@ protected static function read_release( $value ): ?array { } $release = array(); - foreach ( array( 'version', 'tag', 'package', 'url', 'body', 'requires', 'requires_php' ) as $field ) { + foreach ( array( 'version', 'package', 'url', 'body', 'last_updated', 'requires', 'requires_php', 'tested' ) as $field ) { $release[ $field ] = $value[ $field ] ?? ''; if ( ! \is_string( $release[ $field ] ) ) { return null; @@ -286,12 +299,13 @@ protected static function read_release( $value ): ?array { * @since 2.0.0 * @version 2.0.0 * - * @param string $url The URL. + * @param string $url The URL. + * @param array