Tests: Add unit coverage for the core abilities registered in abilities.php

[hmbashar]

src/wp-includes/abilities.php registers the core ability categories and the core/get-site-info, core/get-user-info and core/get-environment-info abilities. The existing tests in tests/phpunit/tests/abilities-api/wpRegisterCoreAbilities.php cover their schemas, execution, the fields input and the permissions of core/get-environment-info (#66369), but a few behaviors have no test:

• Permission of core/get-site-info. The ability requires manage_options, but no test checks that a user without it, or a logged-out visitor, is denied, or that an administrator is allowed. core/get-environment-info and core/get-user-info already have such tests.
• The site, user and content categories. Only the uncategorized category has its label and description asserted. The other three are only used as a slug by the tests of other abilities.
• The annotations. The readonly, destructive and idempotent annotations of the three abilities are not asserted. The registration tests only check public and show_in_rest.
• The roles field of core/get-user-info. Only the first role of a user with one role is asserted. The ability re-indexes the roles with array_values() so they are encoded as a JSON list, but there is no test for a user with several roles or with none.

Proposed scope

Add tests to wpRegisterCoreAbilities.php that verify:

• core/get-site-info: check_permissions() and execute() for an administrator, a subscriber and a logged-out visitor, and that a user with only manage_options delegated can use it.
• The label and description of the site, user and content categories, and the category of each of the three abilities.
• The annotations of the three abilities (read-only, not destructive, idempotent).
• core/get-user-info: the roles of a user with several roles and of a user without roles are lists, in the order of the user's roles.

The tests check the outcome (check_permissions() and execute()) and not how the capability is declared, so they stay valid if the way abilities declare capabilities changes (see #66325).

Out of scope

This ticket only adds tests and does not change behavior. The settings, users and content abilities registered at the end of wp_register_core_abilities() have their own test files and are not touched.

Related: #65819, #66369, #66325.

Adds unit tests for behaviors of the core abilities registered in src/wp-includes/abilities.php that had no test, in tests/phpunit/tests/abilities-api/wpRegisterCoreAbilities.php. No behavior is changed.

What is covered:

• core/get-site-info permission
  • Allowed for an administrator, and for a user who only has manage_options delegated.
  • Denied, through both check_permissions() and execute(), for a subscriber and for a logged-out visitor.
• Core ability categories
  • The label and description of the site, user and content categories. Only uncategorized was asserted before.
• The core information abilities (core/get-site-info, core/get-user-info and core/get-environment-info)
  • Each one belongs to the expected, registered category.
  • Each one is annotated as read-only, not destructive and idempotent.
• roles of core/get-user-info
  • A user with several roles gets them in order.
  • Roles that are not numbered in sequence are still returned as a list, and encoded as a JSON array.
  • A user without roles gets an empty list.

The permission tests check the outcome (check_permissions() and execute()), not how the capability is declared, so they stay valid if the way abilities declare required capabilities changes (see #66325).

Testing:

• vendor/bin/phpunit --filter Tests_Abilities_API_WpRegisterCoreAbilities
• vendor/bin/phpunit -c tests/phpunit/multisite.xml --filter Tests_Abilities_API_WpRegisterCoreAbilities
• vendor/bin/phpunit --group abilities-api
• vendor/bin/phpcs tests/phpunit/tests/abilities-api/wpRegisterCoreAbilities.php

I also temporarily broke the related lines in src/wp-includes/abilities.php (the required capability of core/get-site-info, the label and descriptions of the three categories, the category of an ability, each of the three annotations, and the array_values() call for the roles) and confirmed that a new test fails for each one.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Written with AI and manually reviewed by me.

[gziolo]

In 65307:

Tests: Extend coverage for core abilities

Cover core/get-site-info permissions, the categories and annotations of the core information abilities, and the roles returned by core/get-user-info.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/15528.

Props hmbashar, gziolo.
Fixes #66493.