kw/nolimit-discounts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Assert the REST namespace by name, not against its own constant

Browse Source 
tests/smoke.php filtered the registered routes by WC_EDM_REST_API::REST_NAMESPACE
and then asserted that the filtered list was non-empty. That agrees with itself
whatever the constant says: rename it and the routes are still "registered",
while every caller already integrated against wc-edm/v1 gets a 404 and nothing
goes red.

Pointed out by the woo-security-manager session, which had the same shape in its
own tree — an assertion that derives its expected value from the thing it tests
is agreeing with itself, and would pass somewhere no plugin had ever been
installed.

wc-edm/v1 is the one string in this plugin that somebody else's code depends on
by name, and it is exactly the kind of thing a rename quietly takes with it. The
namespace is now spelled out in the test.

Proven red before being believed: changing the constant to
'nolimit-discounts/v1' fails the new assertion and names both sides —
"expected 'wc-edm/v1', got 'nolimit-discounts/v1'". Green on unchanged code.

Two nearby assertions checked and deliberately left alone. The DB-version one
compares WC_EDM_VERSION against the option the activation routine wrote, which
is two independent sources rather than one. The update-URI one asserts a
property (non-empty, https) and says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kristianwind
2026-09-17 10:29:40 +02:00
co-authored by Claude Opus 5
parent 3f24b57579
commit 9901efd8b2
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/smoke.php
+12
View File
@@ -211,6 +211,18 @@ $ours = array_filter(
); );
wc_edm_ok( 'the REST routes are registered', count( $ours ) > 0, 'namespace ' . WC_EDM_REST_API::REST_NAMESPACE ); wc_edm_ok( 'the REST routes are registered', count( $ours ) > 0, 'namespace ' . WC_EDM_REST_API::REST_NAMESPACE );
// The namespace spelled out, NOT compared to the constant it came from. The
// filter above derives what it looks for from REST_NAMESPACE, so it agrees
// with itself whatever that constant says: rename it and the routes are still
// "registered", while every caller that already integrated against
// wc-edm/v1 gets a 404 and nothing here goes red. This is the one string in
// the plugin that somebody else's code depends on by name.
wc_edm_is(
'and under the namespace callers already integrated against',
'wc-edm/v1',
WC_EDM_REST_API::REST_NAMESPACE
);
$request = new WP_REST_Request( 'GET', '/' . WC_EDM_REST_API::REST_NAMESPACE . '/groups' ); $request = new WP_REST_Request( 'GET', '/' . WC_EDM_REST_API::REST_NAMESPACE . '/groups' );
$response = rest_get_server()->dispatch( $request ); $response = rest_get_server()->dispatch( $request );
wc_edm_is( 'and they refuse an unauthenticated caller', 401, $response->get_status() ); wc_edm_is( 'and they refuse an unauthenticated caller', 401, $response->get_status() );