From 9901efd8b25ac912b7f722a3e02b0b2d4bf4f2da Mon Sep 17 00:00:00 2001 From: kristianwind Date: Thu, 17 Sep 2026 10:29:40 +0200 Subject: [PATCH] Assert the REST namespace by name, not against its own constant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tests/smoke.php filtered the registered routes by WC_EDM_REST_API::REST_NAMESPACE and then asserted that the filtered list was non-empty. That agrees with itself whatever the constant says: rename it and the routes are still "registered", while every caller already integrated against wc-edm/v1 gets a 404 and nothing goes red. Pointed out by the woo-security-manager session, which had the same shape in its own tree — an assertion that derives its expected value from the thing it tests is agreeing with itself, and would pass somewhere no plugin had ever been installed. wc-edm/v1 is the one string in this plugin that somebody else's code depends on by name, and it is exactly the kind of thing a rename quietly takes with it. The namespace is now spelled out in the test. Proven red before being believed: changing the constant to 'nolimit-discounts/v1' fails the new assertion and names both sides — "expected 'wc-edm/v1', got 'nolimit-discounts/v1'". Green on unchanged code. Two nearby assertions checked and deliberately left alone. The DB-version one compares WC_EDM_VERSION against the option the activation routine wrote, which is two independent sources rather than one. The update-URI one asserts a property (non-empty, https) and says so. Co-Authored-By: Claude Opus 5 (1M context) --- tests/smoke.php | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tests/smoke.php b/tests/smoke.php index b25a339..05d18bb 100644 --- a/tests/smoke.php +++ b/tests/smoke.php @@ -211,6 +211,18 @@ $ours = array_filter( ); wc_edm_ok( 'the REST routes are registered', count( $ours ) > 0, 'namespace ' . WC_EDM_REST_API::REST_NAMESPACE ); +// The namespace spelled out, NOT compared to the constant it came from. The +// filter above derives what it looks for from REST_NAMESPACE, so it agrees +// with itself whatever that constant says: rename it and the routes are still +// "registered", while every caller that already integrated against +// wc-edm/v1 gets a 404 and nothing here goes red. This is the one string in +// the plugin that somebody else's code depends on by name. +wc_edm_is( + 'and under the namespace callers already integrated against', + 'wc-edm/v1', + WC_EDM_REST_API::REST_NAMESPACE +); + $request = new WP_REST_Request( 'GET', '/' . WC_EDM_REST_API::REST_NAMESPACE . '/groups' ); $response = rest_get_server()->dispatch( $request ); wc_edm_is( 'and they refuse an unauthenticated caller', 401, $response->get_status() );