Changeset 59032 for trunk/tests/phpunit/tests/rest-api/rest-server.php

Timestamp:

09/17/2024 09:50:38 PM (2 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Automatically populate targetHints for the Allow header.

The REST API uses the "Allow" header to communicate what methods a user is authorized to perform on a resource. This works great when operating on a single item route, but can break down when needing to determine authorization over a collection of items.

This commit uses the "targetHints" property of JSON Hyper Schema to provide access to the "allow" header for "self" links. This alleviates needing to make a separate network request for each item in a collection.

Props mamaduka, noisysocks, peterwilsoncc, spacedmonkey, swissspidy, timothyblynjacobs, tyxla, youknowriad.
Fixes #61739.

File:

• trunk/tests/phpunit/tests/rest-api/rest-server.php (modified) (3 diffs)

trunk/tests/phpunit/tests/rest-api/rest-server.php

@@ -10 +10 @@
 class Tests_REST_Server extends WP_Test_REST_TestCase {
         protected static $icon_id;
+        protected static $admin_id;
+        protected static $post_id;
 
         /**
@@ -22 +24 @@
 
         public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
-                $filename      = DIR_TESTDATA . '/images/test-image-large.jpg';
-                self::$icon_id = $factory->attachment->create_upload_object( $filename );
+                $filename       = DIR_TESTDATA . '/images/test-image-large.jpg';
+                self::$icon_id  = $factory->attachment->create_upload_object( $filename );
+                self::$admin_id = $factory->user->create(
+                        array(
+                                'role' => 'administrator',
+                        )
+                );
+                self::$post_id  = $factory->post->create();
         }
 
         public static function tear_down_after_class() {
                 wp_delete_attachment( self::$icon_id, true );
+                self::delete_user( self::$admin_id );
+                wp_delete_post( self::$post_id );
 
                 parent::tear_down_after_class();
@@ -2432 +2442 @@
         }
 
+        /**
+         * @ticket 61739
+         */
+        public function test_validates_request_when_building_target_hints() {
+                register_rest_route(
+                        'test-ns/v1',
+                        '/test/(?P<id>\d+)',
+                        array(
+                                array(
+                                        'methods'             => \WP_REST_Server::READABLE,
+                                        'callback'            => static function () {
+                                                return new \WP_REST_Response();
+                                        },
+                                        'permission_callback' => '__return_true',
+                                        'args'                => array(
+                                                'id' => array(
+                                                        'type' => 'integer',
+                                                ),
+                                        ),
+                                ),
+                        )
+                );
+
+                $response = new WP_REST_Response();
+                $response->add_link( 'self', rest_url( 'test-ns/v1/test/garbage' ) );
+
+                $links = rest_get_server()::get_response_links( $response );
+
+                $this->assertArrayHasKey( 'self', $links );
+                $this->assertArrayNotHasKey( 'targetHints', $links['self'][0] );
+        }
+
+        /**
+         * @ticket 61739
+         */
+        public function test_sanitizes_request_when_building_target_hints() {
+                $validated_param = null;
+                register_rest_route(
+                        'test-ns/v1',
+                        '/test/(?P<id>\d+)',
+                        array(
+                                array(
+                                        'methods'             => \WP_REST_Server::READABLE,
+                                        'callback'            => static function () {
+                                                return new \WP_REST_Response();
+                                        },
+                                        'permission_callback' => function ( WP_REST_Request $request ) use ( &$validated_param ) {
+                                                $validated_param = $request['id'];
+
+                                                return true;
+                                        },
+                                        'args'                => array(
+                                                'id' => array(
+                                                        'type' => 'integer',
+                                                ),
+                                        ),
+                                ),
+                        )
+                );
+
+                $response = new WP_REST_Response();
+                $response->add_link( 'self', rest_url( 'test-ns/v1/test/5' ) );
+
+                $links = rest_get_server()::get_response_links( $response );
+
+                $this->assertArrayHasKey( 'self', $links );
+                $this->assertArrayHasKey( 'targetHints', $links['self'][0] );
+                $this->assertIsInt( $validated_param );
+        }
+
+        /**
+         * @ticket 61739
+         */
+        public function test_populates_target_hints_for_administrator() {
+                wp_set_current_user( self::$admin_id );
+                $response = rest_do_request( '/wp/v2/posts' );
+                $post     = $response->get_data()[0];
+
+                $link = $post['_links']['self'][0];
+                $this->assertArrayHasKey( 'targetHints', $link );
+                $this->assertArrayHasKey( 'allow', $link['targetHints'] );
+                $this->assertSame( array( 'GET', 'POST', 'PUT', 'PATCH', 'DELETE' ), $link['targetHints']['allow'] );
+        }
+
+        /**
+         * @ticket 61739
+         */
+        public function test_populates_target_hints_for_logged_out_user() {
+                $response = rest_do_request( '/wp/v2/posts' );
+                $post     = $response->get_data()[0];
+
+                $link = $post['_links']['self'][0];
+                $this->assertArrayHasKey( 'targetHints', $link );
+                $this->assertArrayHasKey( 'allow', $link['targetHints'] );
+                $this->assertSame( array( 'GET' ), $link['targetHints']['allow'] );
+        }
+
+        /**
+         * @ticket 61739
+         */
+        public function test_does_not_error_on_invalid_urls() {
+                $response = new WP_REST_Response();
+                $response->add_link( 'self', 'this is not a real URL' );
+
+                $links = rest_get_server()::get_response_links( $response );
+                $this->assertArrayNotHasKey( 'targetHints', $links['self'][0] );
+        }
+
+        /**
+         * @ticket 61739
+         */
+        public function test_does_not_error_on_bad_rest_api_routes() {
+                $response = new WP_REST_Response();
+                $response->add_link( 'self', rest_url( '/this/is/not/a/real/route' ) );
+
+                $links = rest_get_server()::get_response_links( $response );
+                $this->assertArrayNotHasKey( 'targetHints', $links['self'][0] );
+        }
+
+        /**
+         * @ticket 61739
+         */
+        public function test_prefers_developer_defined_target_hints() {
+                $response = new WP_REST_Response();
+                $response->add_link(
+                        'self',
+                        '/wp/v2/posts/' . self::$post_id,
+                        array(
+                                'targetHints' => array(
+                                        'allow' => array( 'GET', 'PUT' ),
+                                ),
+                        )
+                );
+
+                $links = rest_get_server()::get_response_links( $response );
+                $link  = $links['self'][0];
+                $this->assertArrayHasKey( 'targetHints', $link );
+                $this->assertArrayHasKey( 'allow', $link['targetHints'] );
+                $this->assertSame( array( 'GET', 'PUT' ), $link['targetHints']['allow'] );
+        }
+
         public function _validate_as_integer_123( $value, $request, $key ) {
                 if ( ! is_int( $value ) ) {