Tests: Add unit tests for the uncovered code of the Abilities API classes and the users and content abilities

[hmbashar]

The code coverage report on Codecov shows lines of the Abilities API that no test runs:

• WP_Ability: unknown properties, a missing category, input without an input schema, wp_ability_validate_input and wp_ability_validate_output filters that return false, an invalid execute callback, a permission callback that returns a WP_Error, and serializing or unserializing the object.
• WP_Abilities_Registry and WP_Ability_Categories_Registry: serializing and unserializing, the registry being requested before init, and the first creation of the categories registry.
• WP_Ability_Category: an empty slug.
• WP_Abilities_Users: the description, url, first_name, last_name, nickname and locale fields, IDs that are not integers, rows that are not users, and a registration date that cannot be parsed.
• WP_Abilities_Content: posts whose parents loop, whose parent is not exposed, or whose status is not registered or not a string, and the IDs that are not in a list.

This ticket adds tests for these lines.

Summary

Adds tests for code of the Abilities API classes that no test runs, according to the Codecov report.

WP_Ability

• An unknown property is reported with _doing_it_wrong() and ignored.
• The category is required (missing, empty, null, integer and array).
• Input is rejected with ability_missing_input_schema when the ability has no input schema.
• The wp_ability_validate_input and wp_ability_validate_output filters can reject with false (Invalid input. / Invalid output.).
• An ability of a custom class without an execute callback returns ability_invalid_execute_callback.
• A permission callback that returns a WP_Error is reported with _doing_it_wrong() and its reason is not shown to the caller.
• The ability cannot be serialized or unserialized.

Registries and category

• WP_Abilities_Registry and WP_Ability_Categories_Registry cannot be serialized or unserialized.
• WP_Ability_Categories_Registry::get_instance() returns null before init, and creates the registry once and fires wp_abilities_api_categories_init.
• WP_Ability_Category throws for an empty slug.

Testing

vendor/bin/phpunit --filter 'Tests_Abilities_API_WpAbility::'
vendor/bin/phpunit --filter 'Tests_Abilities_API_WpAbilitiesRegistry::'
vendor/bin/phpunit --filter 'Tests_Abilities_API_WpAbilityCategoryRegistry::'
vendor/bin/phpunit -c tests/phpunit/multisite.xml --filter 'Tests_Abilities_API_'
vendor/bin/phpcs tests/phpunit/tests/abilities-api/

Mutation check: 24 changes to the source (conditions, error codes and messages, the throw of __sleep() and __wakeup(), the init check, the action and the instance creation) were each caught by a test.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Written with AI and manually reviewed by me.

Summary

Adds tests for code of the core/users-query ability that no test runs, according to the Codecov report.

• The description, url, first_name, last_name, nickname and locale fields are returned with their values to a caller who can edit the user, and only description and url are returned to a caller who cannot.
• The execute callback honors an ID sent as a digit string, a float, a decimal string or a signed string, and rejects a fraction, a number below 1, a float beyond 2 ** 53, a negative digit string and a word.
• A row that is not a user is skipped when a query filter changes the fields of the query.
• A registration date that cannot be parsed is reported as null.

Testing

vendor/bin/phpunit --filter 'Tests_Abilities_API_WpRegisterCoreUsersAbility::'
vendor/bin/phpunit -c tests/phpunit/multisite.xml --filter 'Tests_Abilities_API_WpRegisterCoreUsersAbility::'
vendor/bin/phpcs tests/phpunit/tests/abilities-api/wpRegisterCoreUsersAbility.php

Mutation check: 12 changes to class-wp-abilities-users.php (each field, the integer parsing, the skip of rows that are not users and the date check) were each caught by a test.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Written with AI and manually reviewed by me.

Summary

Adds tests for code of the core/content-query ability that no test runs, according to the Codecov report.

• An inherited post whose parents loop back to it is denied, and the check ends.
• An inherited post is denied when its parent is of a post type that is not exposed.
• A post with a status that is not registered is denied, even for an administrator.
• A post whose status is not a string is denied.
• The execute callback reads a single integer or float ID that is not in a list, and rejects ids that are not a list, a number or a string.

Testing

vendor/bin/phpunit --filter 'Tests_Abilities_API_WpRegisterCoreContentAbility::'
vendor/bin/phpunit -c tests/phpunit/multisite.xml --filter 'Tests_Abilities_API_WpRegisterCoreContentAbility::'
vendor/bin/phpcs tests/phpunit/tests/abilities-api/wpRegisterCoreContentAbility.php

Mutation check: 4 of 5 changes to class-wp-abilities-content.php were caught.

• The change that removes the "status is not a string" check survives. It is an equivalent change: get_post_status_object( false ) returns null, and the next check returns false for it too. The test still runs that line.
• The two changes that remove the loop guard (the isset() check and the $checked_post_ids update) were not run, because they recurse without end. The test fails instead of hanging only if the guard works.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Written with AI and manually reviewed by me.