Changeset 54396 for trunk/tests/phpunit/tests/rest-api/rest-posts-controller.php

Timestamp:

10/05/2022 02:47:07 PM (4 years ago)

Author:

SergeyBiryukov

Message:

Tests: Add comments to clarify a REST API test for password protected posts.

Authenticated users should only be allowed to read password protected content if they have the edit_post meta capability for the post. In other words, the content of a password protected post created by an Editor should not be viewable by a Contributor.

This commit aims to clarify the usage of a negative assertion assertStringNotContainsString() and describe the intention behind the test to avoid confusion.

Follow-up to [50717].

Fixes #56681.

File:

• trunk/tests/phpunit/tests/rest-api/rest-posts-controller.php (modified) (4 diffs)

trunk/tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -1955 +1955 @@
         }
 
+        /**
+         * Tests that authenticated users are only allowed to read password protected content
+         * if they have the 'edit_post' meta capability for the post.
+         */
         public function test_get_post_draft_edit_context() {
                 $post_content = 'Hello World!';
+
+                // Create a password protected post as an Editor.
                 self::factory()->post->create(
                         array(
@@ -1966 +1972 @@
                         )
                 );
+
+                // Create a draft with the Latest Posts block as a Contributor.
                 $draft_id = self::factory()->post->create(
                         array(
@@ -1973 +1981 @@
                         )
                 );
+
+                // Set the current user to Contributor and request the draft for editing.
                 wp_set_current_user( self::$contributor_id );
                 $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', $draft_id ) );
@@ -1978 +1988 @@
                 $response = rest_get_server()->dispatch( $request );
                 $data     = $response->get_data();
+
+                /*
+                 * Verify that the content of a password protected post created by an Editor
+                 * is not viewable by a Contributor.
+                 */
                 $this->assertStringNotContainsString( $post_content, $data['content']['rendered'] );
         }