Changeset 65334

Timestamp:

11/07/2026 06:52:00 PM (12 hours ago)

Author:

lancewillett

Message:

Tests: Cover the self-demotion guard and empty user searches.

Log in as a second administrator and try to change their own role to Subscriber with the bulk Change role control on the Users screen. Check for the error notice and that the role is unchanged. Search users for a missing name and check for the empty result, with another user present so the test fails if search is ignored.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/15779

Props shailu25.
See #52895.

File:

• trunk/tests/e2e/specs/users.test.js (modified) (1 diff)

trunk/tests/e2e/specs/users.test.js

@@ -155 +155 @@
                 ] );
         } );
+
+        test( 'prevents an administrator from changing their own role to subscriber', async ( {
+                browser,
+                requestUtils,
+                baseURL,
+        } ) => {
+                // Use a disposable administrator so a regression cannot demote the shared
+                // suite account and break cleanup or later tests.
+                const username = `${ prefix }-self-role`;
+                const password = randomUUID();
+                usernames.push( username );
+                const disposable = await requestUtils.createUser( {
+                        username,
+                        email: `${ username }@example.org`,
+                        password,
+                        roles: [ 'administrator' ],
+                } );
+
+                const context = await browser.newContext( {
+                        storageState: { cookies: [], origins: [] },
+                } );
+                try {
+                        const page = await context.newPage();
+                        await page.goto( new URL( 'wp-login.php', baseURL ).href );
+                        await page
+                                .getByLabel( 'Username or Email Address', { exact: true } )
+                                .fill( username );
+                        await page
+                                .getByLabel( 'Password', { exact: true } )
+                                .fill( password );
+                        await page
+                                .getByRole( 'button', { name: 'Log In', exact: true } )
+                                .click();
+                        await expect(
+                                page.getByRole( 'heading', {
+                                        name: 'Dashboard',
+                                        exact: true,
+                                } )
+                        ).toBeVisible();
+
+                        await page.goto( new URL( 'wp-admin/profile.php', baseURL ).href );
+                        await expect(
+                                page.getByLabel( 'Role', { exact: true } )
+                        ).toHaveCount( 0 );
+
+                        await page.goto(
+                                new URL(
+                                        `wp-admin/users.php?s=${ encodeURIComponent( username ) }`,
+                                        baseURL
+                                ).href
+                        );
+                        await page
+                                .locator( `#user-${ disposable.id }` )
+                                .getByRole( 'checkbox' )
+                                .check();
+                        // Top/bottom role controls share an accessible name, so use the top control ID.
+                        await page.locator( '#new_role' ).selectOption( 'subscriber' );
+                        await page.locator( '#changeit' ).click();
+                        await expect( page.locator( '#message.error' ) ).toContainText(
+                                'You cannot change your own role to one that does not allow managing other users. Your role was not changed.'
+                        );
+
+                        const stillAdmin = await requestUtils.rest( {
+                                path: `/wp/v2/users/${ disposable.id }`,
+                                params: { context: 'edit' },
+                        } );
+                        expect( stillAdmin.roles ).toContain( 'administrator' );
+                } finally {
+                        await context.close();
+                }
+        } );
+
+        test( 'shows an empty result when searching for a missing user', async ( {
+                admin,
+                page,
+                requestUtils,
+        } ) => {
+                // Ensure at least one non-matching user exists so ignoring `s` cannot
+                // vacuously pass with an empty users table.
+                const present = `${ prefix }-present`;
+                usernames.push( present );
+                await requestUtils.createUser( {
+                        username: present,
+                        email: `${ present }@example.org`,
+                        password: randomUUID(),
+                        roles: [ 'subscriber' ],
+                } );
+                const missing = `${ prefix }-missing-${ randomUUID().slice( 0, 8 ) }`;
+
+                await admin.visitAdminPage(
+                        '/users.php',
+                        `s=${ encodeURIComponent( missing ) }`
+                );
+                await expect(
+                        page.getByRole( 'cell', {
+                                name: 'No users found.',
+                                exact: true,
+                        } )
+                ).toBeVisible();
+        } );
 } );