69 lines
2.3 KiB
PHP
69 lines
2.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
require_once dirname(__DIR__, 2) . '/feca_mailshots_plugin/src/autoload.php';
|
|
|
|
use FecaMailshots\Admin\DataSourcesAdminPage;
|
|
use FecaMailshots\Admin\SetupAdminPage;
|
|
use FecaMailshots\WordPress\FixtureWordPressFacade;
|
|
|
|
$wp = new FixtureWordPressFacade();
|
|
|
|
/** @param callable():void $fn */
|
|
$capture = static function (callable $fn): string {
|
|
ob_start();
|
|
try {
|
|
$fn();
|
|
return (string) ob_get_clean();
|
|
} catch (\Throwable $e) {
|
|
ob_end_clean();
|
|
throw $e;
|
|
}
|
|
};
|
|
|
|
$assertTrue = static function (bool $condition, string $message): void {
|
|
if (!$condition) {
|
|
fwrite(STDERR, "Assertion failed: {$message}\n");
|
|
exit(1);
|
|
}
|
|
};
|
|
|
|
$assertContains = static function (string $needle, string $haystack, string $label): void {
|
|
if (strpos($haystack, $needle) === false) {
|
|
fwrite(STDERR, "Missing expected text in {$label}: {$needle}\n");
|
|
exit(1);
|
|
}
|
|
};
|
|
|
|
$setup = new SetupAdminPage($wp);
|
|
$dataSources = new DataSourcesAdminPage(
|
|
static function (): never {
|
|
throw new RuntimeException('Data source service should not be resolved in this test.');
|
|
},
|
|
$wp
|
|
);
|
|
|
|
// Editor policy: operational features allowed via edit_pages, setup denied.
|
|
$wp->setAllowedCapabilities(['edit_pages']);
|
|
$assertTrue($dataSources->restCanRead() === true, 'Editor must be able to read data source REST endpoints.');
|
|
$assertTrue($dataSources->restCanManage() === true, 'Editor must be able to manage data source REST endpoints.');
|
|
$setupDeniedHtml = $capture(static function () use ($setup): void {
|
|
$setup->render();
|
|
});
|
|
$assertContains('Permission denied', $setupDeniedHtml, 'Setup (editor)');
|
|
|
|
// Administrator policy: setup/settings allowed via manage_options.
|
|
$wp->setAllowedCapabilities(['manage_options']);
|
|
$setupAdminHtml = $capture(static function () use ($setup): void {
|
|
$setup->render();
|
|
});
|
|
$assertContains('FECA Mailshots Setup', $setupAdminHtml, 'Setup (admin)');
|
|
|
|
// No-capability baseline: operational data-source endpoints denied.
|
|
$wp->setAllowedCapabilities([]);
|
|
$assertTrue($dataSources->restCanRead() === false, 'User without edit_pages must not read data source REST endpoints.');
|
|
$assertTrue($dataSources->restCanManage() === false, 'User without edit_pages must not manage data source REST endpoints.');
|
|
|
|
echo "Access control policy integration test passed\n";
|