evil
', + ) + ) + ); + + $this->assertPushRejected( 401, 'citecue_bad_signature', $request ); + } + + /** + * The signature also covers the timestamp, so a captured request cannot be + * re-dated to make it fresh again. + * + * @return void + */ + public function test_a_re_dated_signature_is_rejected() { + $request = $this->signed_push(); + $request->set_header( 'x-citecue-timestamp', (string) ( time() + 1 ) ); + + $this->assertPushRejected( 401, 'citecue_bad_signature', $request ); + } + + /** + * @dataProvider provide_stale_timestamps + * + * @param int $offset Seconds away from now. + * @return void + */ + public function test_timestamps_outside_the_window_are_rejected( $offset ) { + $request = $this->signed_push( array(), array( 'timestamp' => time() + $offset ) ); + + $this->assertPushRejected( 401, 'citecue_stale_timestamp', $request ); + } + + /** + * Timestamps that must fail the ±300s window. + * + * @return arrayWhat is Acme?
A company.
', + ), + $payload + ) + ); + + $secret = isset( $signing['secret'] ) ? $signing['secret'] : self::SECRET; + $timestamp = isset( $signing['timestamp'] ) ? $signing['timestamp'] : time(); + + $request = new WP_REST_Request( 'POST', '/citecue/v1/content' ); + $request->set_header( 'content-type', 'application/json' ); + $request->set_header( 'x-citecue-timestamp', (string) $timestamp ); + $request->set_header( 'x-citecue-signature', 'sha256=' . hash_hmac( 'sha256', $timestamp . '.' . $body, $secret ) ); + $request->set_body( $body ); + + return $request; + } + + /** + * An identical copy of a request, as a captured replay would be. + * + * @param WP_REST_Request $request Original request. + * @return WP_REST_Request + */ + private function replay_of( WP_REST_Request $request ) { + $replay = new WP_REST_Request( 'POST', '/citecue/v1/content' ); + $replay->set_headers( $request->get_headers() ); + $replay->set_body( $request->get_body() ); + + return $replay; + } + + /** + * Asserts a push was refused with a specific status and error code. + * + * @param int $status Expected HTTP status. + * @param string $code Expected WP_Error code. + * @param WP_REST_Request $request Request to send. + * @return void + */ + private function assertPushRejected( $status, $code, WP_REST_Request $request ) { + $response = rest_do_request( $request ); + + $this->assertSame( $status, $response->get_status() ); + $this->assertSame( $code, $response->get_data()['code'] ); + } +} diff --git a/tests/cases/test-ingest-content.php b/tests/cases/test-ingest-content.php new file mode 100644 index 0000000..5f7d831 --- /dev/null +++ b/tests/cases/test-ingest-content.php @@ -0,0 +1,627 @@ +plugin->settings->update( + array( + 'ingest_enabled' => true, + 'ingest_secret' => self::SECRET, + ) + ); + } + + /** + * @return void + */ + public function test_a_push_creates_a_draft_post() { + $response = $this->push( + array( + 'title' => 'Acme FAQ', + 'content' => 'What is Acme?
A company.
', + ) + ); + + $this->assertSame( 201, $response->get_status() ); + $this->assertTrue( $response->get_data()['created'] ); + + $post = get_post( $response->get_data()['post_id'] ); + $this->assertSame( 'Acme FAQ', $post->post_title ); + $this->assertSame( 'draft', $post->post_status ); + $this->assertSame( 'post', $post->post_type ); + $this->assertStringContainsString( 'What is Acme?', $post->post_content ); + } + + /** + * Nothing CiteCue pushes is visible until a human says so — that is the + * default the plugin promises. + * + * @return void + */ + public function test_content_is_a_draft_even_when_publish_is_requested() { + $response = $this->push( array( 'status' => 'publish' ) ); + + $this->assertSame( 'draft', get_post_status( $response->get_data()['post_id'] ) ); + } + + /** + * @dataProvider provide_status_caps + * + * @param string $cap Configured maximum status. + * @param string $requested Requested status. + * @param string $expected Effective status. + * @return void + */ + public function test_status_is_capped_by_the_setting( $cap, $requested, $expected ) { + $this->plugin->settings->update( array( 'ingest_post_status' => $cap ) ); + + $response = $this->push( array( 'status' => $requested ) ); + + $this->assertSame( $expected, get_post_status( $response->get_data()['post_id'] ) ); + } + + /** + * Cap/request/result combinations. + * + * @return arrayHello
Hello
', $content ); + } + + /** + * @return void + */ + public function test_the_title_is_stored_as_plain_text() { + $response = $this->push( array( 'title' => 'Acme FAQ' ) ); + + $this->assertStringNotContainsString( 'Rewritten by the site owner.
', + ) + ); + + $response = $this->push( array( 'content' => 'Pushed again.
' ), array( 'timestamp' => time() + 1 ) ); + + $this->assertSame( 409, $response->get_status() ); + $this->assertSame( 'citecue_edited_locally', $response->get_data()['code'] ); + $this->assertStringContainsString( 'site owner', get_post( $id )->post_content ); + } + + /** + * …but an explicit force overrides it. + * + * @return void + */ + public function test_force_overwrites_a_locally_edited_post() { + $id = $this->push()->get_data()['post_id']; + wp_update_post( + array( + 'ID' => $id, + 'post_content' => 'Local edit.
', + ) + ); + + $response = $this->push( + array( + 'content' => 'Pushed again.
', + 'force' => true, + ), + array( 'timestamp' => time() + 1 ) + ); + + $this->assertSame( 200, $response->get_status() ); + $this->assertStringContainsString( 'Pushed again.', get_post( $id )->post_content ); + } + + /** + * An unchanged post is not an edited one — pushes must keep flowing. + * + * @return void + */ + public function test_an_untouched_post_keeps_accepting_pushes() { + $this->push(); + + $response = $this->push( array( 'content' => 'Updated copy.
' ), array( 'timestamp' => time() + 1 ) ); + + $this->assertSame( 200, $response->get_status() ); + } + + /** + * Throwing a pushed draft away is a decision: it must not be resurrected, + * and it must not come back as a duplicate either. + * + * @return void + */ + public function test_a_trashed_push_stays_trashed() { + $id = $this->push()->get_data()['post_id']; + wp_trash_post( $id ); + + $response = $this->push( array(), array( 'timestamp' => time() + 1 ) ); + + $this->assertSame( 410, $response->get_status() ); + $this->assertSame( 'citecue_trashed', $response->get_data()['code'] ); + $this->assertSame( 'trash', get_post_status( $id ) ); + $this->assertCount( + 0, + get_posts( + array( + 'post_status' => 'draft', + 'fields' => 'ids', + ) + ) + ); + } + + /** + * @return void + */ + public function test_changing_the_type_of_an_existing_push_is_refused() { + $this->push( array( 'type' => 'post' ) ); + + $response = $this->push( array( 'type' => 'page' ), array( 'timestamp' => time() + 1 ) ); + + $this->assertSame( 409, $response->get_status() ); + $this->assertSame( 'citecue_type_conflict', $response->get_data()['code'] ); + } + + /** + * @return void + */ + public function test_pages_can_be_pushed() { + $response = $this->push( array( 'type' => 'page' ) ); + + $this->assertSame( 'page', get_post_type( $response->get_data()['post_id'] ) ); + } + + /** + * @return void + */ + public function test_an_unknown_type_falls_back_to_the_configured_default() { + $this->plugin->settings->update( array( 'ingest_post_type' => 'page' ) ); + + $response = $this->push( array( 'type' => 'attachment' ) ); + + $this->assertSame( 'page', get_post_type( $response->get_data()['post_id'] ) ); + } + + /** + * @return void + */ + public function test_products_are_refused_without_woocommerce() { + if ( class_exists( 'WooCommerce' ) ) { + $this->markTestSkipped( 'WooCommerce is loaded in this run.' ); + } + + $response = $this->push( array( 'type' => 'product' ) ); + + $this->assertSame( 400, $response->get_status() ); + $this->assertSame( 'citecue_woocommerce_missing', $response->get_data()['code'] ); + } + + /** + * A configured product default must degrade to a post if WooCommerce is + * deactivated, rather than failing every push. + * + * @return void + */ + public function test_a_stale_product_default_degrades_to_post() { + if ( class_exists( 'WooCommerce' ) ) { + $this->markTestSkipped( 'WooCommerce is loaded in this run.' ); + } + + update_option( + 'citecue_settings', + array_merge( Citecue_Settings::defaults(), array( 'ingest_post_type' => 'product' ) ) + ); + $this->reset_settings_cache(); + $this->plugin->settings->update( + array( + 'ingest_enabled' => true, + 'ingest_secret' => self::SECRET, + ) + ); + + $response = $this->push(); + + $this->assertSame( 201, $response->get_status() ); + $this->assertSame( 'post', get_post_type( $response->get_data()['post_id'] ) ); + } + + /** + * @return void + */ + public function test_categories_and_tags_are_created_and_assigned() { + $response = $this->push( + array( + 'categories' => array( 'AI Search' ), + 'tags' => array( 'llms', 'faq' ), + ) + ); + $id = $response->get_data()['post_id']; + + $this->assertSame( array( 'AI Search' ), wp_list_pluck( get_the_category( $id ), 'name' ) ); + $this->assertEqualSets( array( 'llms', 'faq' ), wp_list_pluck( wp_get_post_tags( $id ), 'name' ) ); + } + + /** + * @return void + */ + public function test_an_existing_category_is_reused_not_duplicated() { + $existing = self::factory()->category->create( array( 'name' => 'AI Search' ) ); + + $response = $this->push( array( 'categories' => array( 'AI Search' ) ) ); + + $this->assertSame( + array( $existing ), + wp_list_pluck( get_the_category( $response->get_data()['post_id'] ), 'term_id' ) + ); + } + + /** + * @return void + */ + public function test_optional_fields_are_stored() { + $response = $this->push( + array( + 'excerpt' => 'A short summary.', + 'slug' => 'acme-faq', + 'source' => 'faq_pack:opp_42', + 'meta_description' => 'Everything about Acme.', + ) + ); + $id = $response->get_data()['post_id']; + + $this->assertSame( 'A short summary.', get_post( $id )->post_excerpt ); + $this->assertSame( 'acme-faq', get_post( $id )->post_name ); + $this->assertSame( 'faq_pack:opp_42', get_post_meta( $id, '_citecue_source', true ) ); + $this->assertSame( 'Everything about Acme.', get_post_meta( $id, '_citecue_meta_description', true ) ); + $this->assertSame( 'faq-pack-1', get_post_meta( $id, '_citecue_external_id', true ) ); + } + + /** + * @return void + */ + public function test_pushed_posts_are_attributed_to_an_administrator() { + self::factory()->user->create( array( 'role' => 'administrator' ) ); + + $response = $this->push(); + $author = (int) get_post( $response->get_data()['post_id'] )->post_author; + + $this->assertSame( $this->oldest_administrator(), $author ); + $this->assertTrue( user_can( $author, 'edit_posts' ) ); + } + + /** + * @return void + */ + public function test_a_configured_author_is_used_when_it_can_edit_posts() { + $editor = self::factory()->user->create( array( 'role' => 'editor' ) ); + self::factory()->user->create( array( 'role' => 'administrator' ) ); + $this->plugin->settings->update( array( 'ingest_author' => $editor ) ); + + $response = $this->push(); + + $this->assertSame( $editor, (int) get_post( $response->get_data()['post_id'] )->post_author ); + } + + /** + * @return void + */ + public function test_a_configured_author_without_edit_rights_is_ignored() { + $subscriber = self::factory()->user->create( array( 'role' => 'subscriber' ) ); + $this->plugin->settings->update( array( 'ingest_author' => $subscriber ) ); + + $response = $this->push(); + + $this->assertSame( + $this->oldest_administrator(), + (int) get_post( $response->get_data()['post_id'] )->post_author + ); + } + + /** + * The fallback author the plugin picks: the site's oldest administrator. + * + * @return int + */ + private function oldest_administrator() { + $admins = get_users( + array( + 'role' => 'administrator', + 'orderby' => 'ID', + 'order' => 'ASC', + 'number' => 1, + 'fields' => 'ID', + ) + ); + + return (int) $admins[0]; + } + + /** + * @return void + */ + public function test_the_postarr_filter_can_adjust_the_push() { + add_filter( + 'citecue_ingest_postarr', + static function ( $postarr ) { + $postarr['post_title'] = 'Filtered title'; + return $postarr; + } + ); + + $response = $this->push(); + + $this->assertSame( 'Filtered title', get_post( $response->get_data()['post_id'] )->post_title ); + } + + /** + * @return void + */ + public function test_the_response_describes_where_the_content_landed() { + $data = $this->push()->get_data(); + + $this->assertSame( 'draft', $data['status'] ); + $this->assertStringContainsString( 'post.php', $data['edit_link'] ); + $this->assertStringContainsString( (string) $data['post_id'], $data['edit_link'] ); + $this->assertNotEmpty( $data['permalink'] ); + } + + /** + * The meta description is printed for pushed content… + * + * @return void + */ + public function test_the_meta_description_is_printed_on_the_post() { + $id = $this->push( array( 'meta_description' => 'Everything about Acme.' ) )->get_data()['post_id']; + wp_publish_post( $id ); + $this->go_to( get_permalink( $id ) ); + + $this->assertStringContainsString( + '', + $this->render_head() + ); + } + + /** + * …and can be turned off, e.g. when an SEO plugin owns the tag. + * + * @return void + */ + public function test_the_meta_description_can_be_suppressed() { + $id = $this->push( array( 'meta_description' => 'Everything about Acme.' ) )->get_data()['post_id']; + wp_publish_post( $id ); + $this->go_to( get_permalink( $id ) ); + + add_filter( 'citecue_output_meta_description', '__return_false' ); + + $this->assertStringNotContainsString( 'render_head() ); + } + + /** + * @return void + */ + public function test_no_meta_description_is_printed_for_ordinary_posts() { + $id = self::factory()->post->create(); + $this->go_to( get_permalink( $id ) ); + + $this->assertStringNotContainsString( 'render_head() ); + } + + /** + * Captures what the plugin adds to wp_head. + * + * @return string + */ + private function render_head() { + ob_start(); + do_action( 'wp_head' ); + return (string) ob_get_clean(); + } + + /** + * Sends a signed push. + * + * @param array $payload Body fields merged over a valid default. + * @param array $signing Optional 'timestamp' override. + * @return WP_REST_Response + */ + private function push( array $payload = array(), array $signing = array() ) { + $body = wp_json_encode( + array_merge( + array( + 'external_id' => 'faq-pack-1', + 'title' => 'Acme FAQ', + 'content' => 'What is Acme?
A company.
', + ), + $payload + ) + ); + + $timestamp = isset( $signing['timestamp'] ) ? $signing['timestamp'] : time(); + + $request = new WP_REST_Request( 'POST', '/citecue/v1/content' ); + $request->set_header( 'content-type', 'application/json' ); + $request->set_header( 'x-citecue-timestamp', (string) $timestamp ); + $request->set_header( 'x-citecue-signature', 'sha256=' . hash_hmac( 'sha256', $timestamp . '.' . $body, self::SECRET ) ); + $request->set_body( $body ); + + return rest_do_request( $request ); + } +} diff --git a/tests/cases/test-ingest-products.php b/tests/cases/test-ingest-products.php new file mode 100644 index 0000000..9d860d3 --- /dev/null +++ b/tests/cases/test-ingest-products.php @@ -0,0 +1,219 @@ +markTestSkipped( 'Requires a real WooCommerce (CITECUE_WITH_WOOCOMMERCE=1).' ); + } + + global $wp_rest_server; + $wp_rest_server = new WP_REST_Server(); + do_action( 'rest_api_init', $wp_rest_server ); + + $this->plugin->settings->update( + array( + 'ingest_enabled' => true, + 'ingest_secret' => self::SECRET, + ) + ); + } + + /** + * @return void + */ + public function test_a_product_push_creates_a_draft_simple_product() { + $response = $this->push( + array( + 'type' => 'product', + 'title' => 'Acme Widget', + 'content' => 'A very good widget.
', + 'excerpt' => 'A good widget.', + 'sku' => 'ACME-1', + 'regular_price' => '19.99', + ) + ); + + $this->assertSame( 201, $response->get_status() ); + + $product = wc_get_product( $response->get_data()['post_id'] ); + + $this->assertInstanceOf( 'WC_Product_Simple', $product ); + $this->assertSame( 'Acme Widget', $product->get_name() ); + $this->assertSame( 'draft', $product->get_status() ); + $this->assertSame( 'ACME-1', $product->get_sku() ); + $this->assertSame( '19.99', $product->get_regular_price() ); + $this->assertStringContainsString( 'very good widget', $product->get_description() ); + $this->assertSame( 'A good widget.', $product->get_short_description() ); + } + + /** + * @return void + */ + public function test_product_terms_use_the_product_taxonomies() { + $response = $this->push( + array( + 'type' => 'product', + 'categories' => array( 'Widgets' ), + 'tags' => array( 'metal' ), + ) + ); + $id = $response->get_data()['post_id']; + + $this->assertSame( array( 'Widgets' ), wp_list_pluck( get_the_terms( $id, 'product_cat' ), 'name' ) ); + $this->assertSame( array( 'metal' ), wp_list_pluck( get_the_terms( $id, 'product_tag' ), 'name' ) ); + } + + /** + * The status cap applies to products exactly as it does to posts. + * + * @return void + */ + public function test_products_respect_the_status_cap() { + $response = $this->push( + array( + 'type' => 'product', + 'status' => 'publish', + ) + ); + + $this->assertSame( 'draft', get_post_status( $response->get_data()['post_id'] ) ); + } + + /** + * Adopting a product the plugin did not create replaces its description, + * so it must never happen by accident. + * + * @return void + */ + public function test_an_existing_sku_is_not_adopted_without_force() { + $existing = new WC_Product_Simple(); + $existing->set_name( 'Hand-written Widget' ); + $existing->set_description( 'Written by the store owner.
' ); + $existing->set_sku( 'ACME-1' ); + $existing->save(); + + $response = $this->push( + array( + 'type' => 'product', + 'sku' => 'ACME-1', + ) + ); + + $this->assertSame( 409, $response->get_status() ); + $this->assertSame( 'citecue_sku_exists', $response->get_data()['code'] ); + $this->assertStringContainsString( + 'store owner', + wc_get_product( $existing->get_id() )->get_description() + ); + } + + /** + * With force, the adoption goes through and the product becomes a normal + * push target from then on. + * + * @return void + */ + public function test_force_adopts_an_existing_product_by_sku() { + $existing = new WC_Product_Simple(); + $existing->set_name( 'Hand-written Widget' ); + $existing->set_sku( 'ACME-1' ); + $existing->save(); + + $adopted = $this->push( + array( + 'type' => 'product', + 'sku' => 'ACME-1', + 'content' => 'Optimized copy.
', + 'force' => true, + ) + ); + + $this->assertSame( 200, $adopted->get_status() ); + $this->assertSame( $existing->get_id(), $adopted->get_data()['post_id'] ); + + // Subsequent pushes match on external_id, no SKU or force needed. + $update = $this->push( + array( + 'type' => 'product', + 'content' => 'Newer copy.
', + ), + array( 'timestamp' => time() + 1 ) + ); + + $this->assertSame( 200, $update->get_status() ); + $this->assertSame( $existing->get_id(), $update->get_data()['post_id'] ); + } + + /** + * @return void + */ + public function test_products_are_attributed_to_an_administrator() { + $response = $this->push( array( 'type' => 'product' ) ); + + $author = (int) get_post( $response->get_data()['post_id'] )->post_author; + + $this->assertTrue( user_can( $author, 'edit_posts' ) ); + } + + /** + * @return void + */ + public function test_the_health_endpoint_reports_woocommerce() { + $response = rest_do_request( new WP_REST_Request( 'GET', '/citecue/v1/health' ) ); + + $this->assertTrue( $response->get_data()['woocommerce'] ); + } + + /** + * Sends a signed push. + * + * @param array $payload Body fields merged over a valid default. + * @param array $signing Optional 'timestamp' override. + * @return WP_REST_Response + */ + private function push( array $payload = array(), array $signing = array() ) { + $body = wp_json_encode( + array_merge( + array( + 'external_id' => 'product-1', + 'title' => 'Acme Widget', + 'content' => 'A very good widget.
', + ), + $payload + ) + ); + + $timestamp = isset( $signing['timestamp'] ) ? $signing['timestamp'] : time(); + + $request = new WP_REST_Request( 'POST', '/citecue/v1/content' ); + $request->set_header( 'content-type', 'application/json' ); + $request->set_header( 'x-citecue-timestamp', (string) $timestamp ); + $request->set_header( 'x-citecue-signature', 'sha256=' . hash_hmac( 'sha256', $timestamp . '.' . $body, self::SECRET ) ); + $request->set_body( $body ); + + return rest_do_request( $request ); + } +} diff --git a/tests/cases/test-lifecycle.php b/tests/cases/test-lifecycle.php new file mode 100644 index 0000000..3724bc7 --- /dev/null +++ b/tests/cases/test-lifecycle.php @@ -0,0 +1,178 @@ +assertNotFalse( wp_next_scheduled( Citecue_Plugin::CRON_HOOK ) ); + $this->assertSame( 'daily', wp_get_schedule( Citecue_Plugin::CRON_HOOK ) ); + } + + /** + * @return void + */ + public function test_activation_generates_an_ingest_secret() { + $this->plugin->settings->update( array( 'ingest_secret' => '' ) ); + + Citecue_Plugin::activate(); + $this->reset_settings_cache(); + + $secret = (string) $this->plugin->settings->get( 'ingest_secret' ); + + $this->assertStringStartsWith( 'cws_', $secret ); + $this->assertSame( 44, strlen( $secret ) ); + } + + /** + * Re-activating must not rotate the secret out from under CiteCue. + * + * @return void + */ + public function test_reactivation_keeps_the_existing_secret() { + Citecue_Plugin::activate(); + $this->reset_settings_cache(); + $first = $this->plugin->settings->get( 'ingest_secret' ); + + Citecue_Plugin::activate(); + $this->reset_settings_cache(); + + $this->assertSame( $first, $this->plugin->settings->get( 'ingest_secret' ) ); + } + + /** + * @return void + */ + public function test_activation_is_idempotent() { + Citecue_Plugin::activate(); + $first = wp_next_scheduled( Citecue_Plugin::CRON_HOOK ); + + Citecue_Plugin::activate(); + + $this->assertSame( $first, wp_next_scheduled( Citecue_Plugin::CRON_HOOK ) ); + } + + /** + * @return void + */ + public function test_deactivation_clears_the_cron() { + Citecue_Plugin::activate(); + + Citecue_Plugin::deactivate(); + + $this->assertFalse( wp_next_scheduled( Citecue_Plugin::CRON_HOOK ) ); + } + + /** + * A dropped schedule (a cron plugin, a botched migration) must heal itself + * rather than silently stop refreshing the crawler registry forever. + * + * @return void + */ + public function test_a_missing_cron_is_rescheduled_on_init() { + $this->assertFalse( wp_next_scheduled( Citecue_Plugin::CRON_HOOK ) ); + + $this->plugin->on_init(); + + $this->assertNotFalse( wp_next_scheduled( Citecue_Plugin::CRON_HOOK ) ); + } + + /** + * @return void + */ + public function test_the_daily_sync_refreshes_the_crawler_registry() { + $this->http->queue( + 'crawlers', + 200, + wp_json_encode( + array( + 'version' => 3, + 'tokens' => array( 'FutureBot' ), + ) + ) + ); + + $this->plugin->daily_sync(); + + $this->assertContains( 'FutureBot', $this->plugin->crawlers->get_tokens() ); + } + + /** + * A failing sync must not throw — it runs unattended on cron. + * + * @return void + */ + public function test_the_daily_sync_survives_an_outage() { + $this->http->queue_error( 'crawlers' ); + + $this->plugin->daily_sync(); + + $this->assertSame( 'GPTBot', $this->plugin->crawlers->match( 'GPTBot/1.2' ) ); + } + + /** + * Uninstall removes the plugin's own settings… + * + * @return void + */ + public function test_uninstall_removes_plugin_options() { + $this->configure_delivery(); + $this->plugin->activity->record( 'GPTBot', '/a/', 'served' ); + Citecue_Plugin::activate(); + + $this->run_uninstall(); + + $this->assertFalse( get_option( Citecue_Settings::OPTION ) ); + $this->assertFalse( get_option( Citecue_Activity_Log::OPTION ) ); + $this->assertFalse( get_option( Citecue_Crawlers::OPTION ) ); + $this->assertFalse( wp_next_scheduled( Citecue_Plugin::CRON_HOOK ) ); + } + + /** + * …but content pushed by CiteCue belongs to the site, so it stays. + * + * @return void + */ + public function test_uninstall_keeps_pushed_content() { + $post_id = self::factory()->post->create( array( 'post_title' => 'Pushed brief' ) ); + update_post_meta( $post_id, '_citecue_external_id', 'brief-1' ); + + $this->run_uninstall(); + + $this->assertSame( 'Pushed brief', get_post( $post_id )->post_title ); + } + + /** + * Runs uninstall.php the way WordPress does. + * + * @return void + */ + private function run_uninstall() { + if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) { + define( 'WP_UNINSTALL_PLUGIN', 'citecue/citecue.php' ); + } + + require dirname( __DIR__, 2 ) . '/uninstall.php'; + } +} diff --git a/tests/cases/test-llms-txt.php b/tests/cases/test-llms-txt.php new file mode 100644 index 0000000..5e93913 --- /dev/null +++ b/tests/cases/test-llms-txt.php @@ -0,0 +1,322 @@ + An example site.\n"; + + /** + * Sets up a configured site requesting /llms.txt. + * + * @return void + */ + public function set_up() { + parent::set_up(); + $this->configure_delivery(); + $this->request_llms_txt(); + } + + /** + * Points the current request at /llms.txt. + * + * @return void + */ + private function request_llms_txt() { + $_SERVER['REQUEST_METHOD'] = 'GET'; + $_SERVER['REQUEST_URI'] = '/llms.txt'; + } + + /** + * @return void + */ + public function test_200_is_served_and_cached() { + $this->http->queue( 'llms', 200, self::BODY, array( 'etag' => '"v1"' ) ); + + $decision = $this->llms_txt()->decide(); + + $this->assertTrue( $decision['serve'] ); + $this->assertSame( self::BODY, $decision['body'] ); + $this->assertSame( self::BODY, $this->plugin->cache->get_llms_txt()['body'] ); + } + + /** + * The file is served to everyone, not only to AI crawlers. + * + * @return void + */ + public function test_it_is_served_to_human_visitors_too() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh) Chrome/126.0.0.0 Safari/537.36'; + $this->http->queue( 'llms', 200, self::BODY ); + + $this->assertTrue( $this->llms_txt()->decide()['serve'] ); + } + + /** + * @return void + */ + public function test_other_urls_are_left_alone() { + $_SERVER['REQUEST_URI'] = '/hello-world/'; + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * @return void + */ + public function test_non_get_requests_are_left_alone() { + $_SERVER['REQUEST_METHOD'] = 'POST'; + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * @return void + */ + public function test_it_can_be_switched_off_in_settings() { + $this->configure_delivery( array( 'llms_txt_enabled' => false ) ); + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * A fresh cached copy is served without touching the API — this endpoint + * is hit by every visitor, so it must not be an outbound call each time. + * + * @return void + */ + public function test_a_fresh_cached_copy_skips_the_api() { + $this->plugin->cache->set_llms_txt( self::BODY, '"v1"' ); + + $decision = $this->llms_txt()->decide(); + + $this->assertSame( self::BODY, $decision['body'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * Past the freshness window it revalidates with the stored ETag. + * + * @return void + */ + public function test_a_stale_cached_copy_is_revalidated() { + $this->stale_cache( self::BODY, '"v1"' ); + $this->http->queue( 'llms', 304 ); + + $decision = $this->llms_txt()->decide(); + + $this->assertSame( self::BODY, $decision['body'] ); + $this->assertSame( '"v1"', $this->http->last( 'llms' )['args']['headers']['If-None-Match'] ); + } + + /** + * @return void + */ + public function test_revalidation_refreshes_the_freshness_window() { + $this->stale_cache( self::BODY, '"v1"' ); + $this->http->queue( 'llms', 304 ); + $this->llms_txt()->decide(); + + // A second request inside the window must now be answered locally. + $this->llms_txt()->decide(); + + $this->assertSame( 1, $this->http->count( 'llms' ) ); + } + + /** + * @return void + */ + public function test_404_stops_serving_and_evicts_the_cached_copy() { + $this->stale_cache( self::BODY, '"v1"' ); + $this->http->queue( 'llms', 404 ); + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + $this->assertNull( $this->plugin->cache->get_llms_txt() ); + } + + /** + * A project with llms.txt switched off must not turn every hit on the URL + * into an outbound call — this endpoint answers humans, not just crawlers. + * + * @return void + */ + public function test_404_is_negative_cached() { + $this->http->queue( 'llms', 404 ); + $this->llms_txt()->decide(); + + for ( $i = 0; $i < 10; $i++ ) { + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + } + + $this->assertSame( 1, $this->http->count( 'llms' ) ); + } + + /** + * @return void + */ + public function test_flushing_the_cache_retries_a_disabled_project() { + $this->http->queue( 'llms', 404 ); + $this->http->queue( 'llms', 200, self::BODY ); + + $this->llms_txt()->decide(); + $this->assertTrue( $this->plugin->cache->is_recent_llms_txt_miss() ); + + $this->plugin->cache->flush(); + + $this->assertSame( self::BODY, $this->llms_txt()->decide()['body'] ); + } + + /** + * @return void + */ + public function test_lookups_are_capped_by_the_budget() { + $this->exhaust_lookup_budget(); + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * Degrading on an exhausted budget must not cost visitors a body the + * plugin already holds. + * + * @return void + */ + public function test_an_exhausted_budget_still_serves_a_stale_copy() { + $this->stale_cache( self::BODY, '"v1"' ); + $this->exhaust_lookup_budget(); + + $this->assertSame( self::BODY, $this->llms_txt()->decide()['body'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * The budget is one ceiling for the whole site, so traffic on one path + * cannot be used to get around the limit on the other. + * + * @return void + */ + public function test_the_budget_is_shared_with_the_crawler_path() { + add_filter( 'citecue_lookup_budget', static fn() => 1 ); + + $this->http->queue( 'llms', 404 ); + $this->llms_txt()->decide(); + + $this->set_permalink_structure( '/%postname%/' ); + $this->fake_crawler_request( '/hello-world/' ); + + $this->assertPassedThrough( 'budget-exhausted', $this->proxy()->decide() ); + $this->assertSame( 0, $this->http->count( 'page' ) ); + } + + /** + * A served llms.txt spends budget too, so a flood on this URL is bounded + * even when CiteCue is answering normally. + * + * @return void + */ + public function test_serving_consumes_budget() { + add_filter( 'citecue_lookup_budget', static fn() => 2 ); + $this->http->queue( 'llms', 200, self::BODY ); + + // Each pass revalidates, because the cache is aged out every time. + for ( $i = 0; $i < 5; $i++ ) { + $this->stale_cache( self::BODY, '"v1"' ); + $this->llms_txt()->decide(); + } + + $this->assertSame( 2, $this->http->count( 'llms' ) ); + } + + /** + * @return void + */ + public function test_a_timeout_serves_the_cached_copy() { + $this->stale_cache( self::BODY, '"v1"' ); + $this->http->queue_error( 'llms' ); + + $this->assertSame( self::BODY, $this->llms_txt()->decide()['body'] ); + $this->assertTrue( $this->plugin->cache->is_circuit_open() ); + } + + /** + * With nothing cached there is no body to fall back to, so WordPress must + * answer — serving an empty llms.txt would look like a published, empty + * file. + * + * @return void + */ + public function test_a_timeout_without_a_cached_copy_passes_through() { + $this->http->queue_error( 'llms' ); + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + } + + /** + * @return void + */ + public function test_a_500_body_is_never_served() { + $this->http->queue( 'llms', 500, 'Internal Server Error' ); + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + } + + /** + * @return void + */ + public function test_401_records_the_auth_failure_and_backs_off() { + $this->http->queue( 'llms', 401 ); + + $this->assertFalse( $this->llms_txt()->decide()['serve'] ); + $this->assertNotFalse( get_option( 'citecue_auth_failed' ) ); + $this->assertTrue( $this->plugin->cache->is_circuit_open() ); + } + + /** + * @return void + */ + public function test_an_open_circuit_serves_the_cached_copy_without_calling_the_api() { + $this->stale_cache( self::BODY, '"v1"' ); + $this->plugin->cache->trip_circuit(); + + $this->assertSame( self::BODY, $this->llms_txt()->decide()['body'] ); + $this->assertSame( 0, $this->http->count() ); + } + + /** + * Caches an llms.txt body that is already past its freshness window. + * + * @param string $body llms.txt content. + * @param string $etag Cached ETag. + * @return void + */ + private function stale_cache( $body, $etag ) { + // Reading through the cache first forces the lazily generated key salt + // into existence, so the transient below lands on the key the plugin + // will look under. + $this->plugin->cache->get_llms_txt(); + + set_transient( + 'citecue_llms_' . get_option( 'citecue_cache_salt' ), + array( + 'body' => $body, + 'etag' => $etag, + 'cached_at' => time() - ( Citecue_Llms_Txt::FRESH_SECONDS + 1 ), + ), + DAY_IN_SECONDS + ); + } +} diff --git a/tests/cases/test-proxy-delivery.php b/tests/cases/test-proxy-delivery.php new file mode 100644 index 0000000..703c215 --- /dev/null +++ b/tests/cases/test-proxy-delivery.php @@ -0,0 +1,323 @@ +set_permalink_structure( '/%postname%/' ); + $this->configure_delivery(); + $this->factory->post->create( array( 'post_name' => 'hello-world' ) ); + $this->url = $this->fake_crawler_request( '/hello-world/' ); + } + + /** + * @return void + */ + public function test_200_is_served_and_cached() { + $this->http->queue( + 'page', + 200, + 'optimized', + array( + 'etag' => '"v1"', + 'x-citecue-mode' => 'enriched', + ) + ); + + $decision = $this->proxy()->decide(); + + $this->assertServed( 'optimized', $decision ); + $this->assertSame( 'enriched', $decision['mode'] ); + + $cached = $this->plugin->cache->get_page( $this->url ); + $this->assertSame( 'optimized', $cached['body'] ); + $this->assertSame( '"v1"', $cached['etag'] ); + $this->assertSame( 'enriched', $cached['mode'] ); + } + + /** + * The request carries the credentials, the channel marker and the crawler + * token — CiteCue attributes the hit from these. + * + * @return void + */ + public function test_delivery_request_is_addressed_correctly() { + $this->http->queue( 'page', 200, 'optimized' ); + $this->proxy()->decide(); + + $request = $this->http->last( 'page' ); + + $this->assertStringContainsString( 'k=' . self::PUBLIC_KEY, $request['url'] ); + $this->assertStringContainsString( 'b=GPTBot', $request['url'] ); + $this->assertStringContainsString( rawurlencode( $this->url ), $request['url'] ); + $this->assertSame( 'Bearer ' . self::API_KEY, $request['args']['headers']['Authorization'] ); + // phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText -- the header value is literally lowercase. + $this->assertSame( 'wordpress', $request['args']['headers']['X-Citecue-Channel'] ); + } + + /** + * A second hit revalidates with the stored ETag instead of re-downloading. + * + * @return void + */ + public function test_304_serves_the_cached_body() { + $this->prime_page_cache( $this->url, 'cached', '"v1"', 'rewrite' ); + $this->http->queue( 'page', 304 ); + + $decision = $this->proxy()->decide(); + + $this->assertServed( 'cached', $decision ); + $this->assertSame( 'rewrite', $decision['mode'] ); + $this->assertSame( '"v1"', $this->http->last( 'page' )['args']['headers']['If-None-Match'] ); + } + + /** + * A 304 is a served hit, not a stale one — CiteCue already counted it. + * + * @return void + */ + public function test_304_is_not_flagged_stale() { + $this->prime_page_cache( $this->url, 'cached' ); + $this->http->queue( 'page', 304 ); + + $this->assertFalse( $this->proxy()->decide()['stale'] ); + } + + /** + * A 304 with nothing cached (evicted mid-flight) has no body to serve, so + * the theme must answer rather than the plugin emitting an empty page. + * + * @return void + */ + public function test_304_without_a_cached_body_passes_through() { + $this->http->queue( 'page', 304 ); + + $this->assertPassedThrough( 'revalidated-without-cache', $this->proxy()->decide() ); + } + + /** + * @return void + */ + public function test_404_passes_through_and_negative_caches() { + $this->http->queue( 'page', 404 ); + + $this->assertPassedThrough( 'miss', $this->proxy()->decide() ); + $this->assertTrue( $this->plugin->cache->is_recent_miss( $this->url ) ); + } + + /** + * A negative-cached URL must not hit the API again for a minute. + * + * @return void + */ + public function test_a_recent_miss_short_circuits_the_api() { + $this->http->queue( 'page', 404 ); + $this->proxy()->decide(); + + $this->assertPassedThrough( 'recent-miss', $this->proxy()->decide() ); + $this->assertSame( 1, $this->http->count( 'page' ) ); + } + + /** + * A page that was optimized and then removed in CiteCue must disappear + * here too — otherwise the stale-on-error path would resurrect content the + * site owner has already withdrawn. + * + * @return void + */ + public function test_404_evicts_a_previously_cached_body() { + $this->prime_page_cache( $this->url, 'withdrawn' ); + $this->http->queue( 'page', 404 ); + + $this->proxy()->decide(); + + $this->assertNull( $this->plugin->cache->get_page( $this->url ) ); + } + + /** + * @return void + */ + public function test_401_passes_through_and_records_the_auth_failure() { + $this->http->queue( 'page', 401 ); + + $this->assertPassedThrough( 'unauthorized', $this->proxy()->decide() ); + $this->assertNotFalse( get_option( 'citecue_auth_failed' ) ); + $this->assertTrue( $this->plugin->cache->is_circuit_open() ); + } + + /** + * A rejected key must not be retried on every crawler hit. + * + * @return void + */ + public function test_401_stops_further_api_calls() { + $this->http->queue( 'page', 401 ); + $this->proxy()->decide(); + + $this->fake_crawler_request( '/another-page/' ); + $this->proxy()->decide(); + + $this->assertSame( 1, $this->http->count( 'page' ) ); + } + + /** + * A recovered key clears the failure flag. + * + * @return void + */ + public function test_a_later_miss_clears_the_auth_failure_flag() { + update_option( 'citecue_auth_failed', time() ); + $this->http->queue( 'page', 404 ); + + $this->proxy()->decide(); + + $this->assertFalse( get_option( 'citecue_auth_failed' ) ); + } + + /** + * @return void + */ + public function test_a_timeout_passes_through_and_opens_the_circuit() { + $this->http->queue_error( 'page', 'cURL error 28: Operation timed out' ); + + $this->assertPassedThrough( 'transport-error', $this->proxy()->decide() ); + $this->assertTrue( $this->plugin->cache->is_circuit_open() ); + } + + /** + * A CiteCue outage must not cost the crawler the page it already had. + * + * @return void + */ + public function test_a_timeout_serves_the_stale_cached_body() { + $this->prime_page_cache( $this->url, 'cached' ); + $this->http->queue_error( 'page' ); + + $this->assertServed( 'cached', $this->proxy()->decide(), true ); + } + + /** + * @return void + */ + public function test_a_500_passes_through_and_opens_the_circuit() { + $this->http->queue( 'page', 500, 'upstream exploded' ); + + $this->assertPassedThrough( 'server-error', $this->proxy()->decide() ); + $this->assertTrue( $this->plugin->cache->is_circuit_open() ); + } + + /** + * An error body must never reach a crawler as if it were the page. + * + * @return void + */ + public function test_a_500_body_is_never_served() { + $this->http->queue( 'page', 500, 'Internal Server Error' ); + + $this->assertFalse( $this->proxy()->decide()['serve'] ); + } + + /** + * @return void + */ + public function test_a_500_serves_the_stale_cached_body() { + $this->prime_page_cache( $this->url, 'cached' ); + $this->http->queue( 'page', 500 ); + + $this->assertServed( 'cached', $this->proxy()->decide(), true ); + } + + /** + * @dataProvider provide_outcomes + * + * @param int $status Delivery API status. + * @param string $outcome Expected activity-log outcome. + * @return void + */ + public function test_outcomes_are_logged( $status, $outcome ) { + $this->http->queue( 'page', $status ); + $this->proxy()->decide(); + + $entries = $this->plugin->activity->entries(); + + $this->assertNotEmpty( $entries, "No activity entry recorded for a {$status}." ); + $this->assertSame( $outcome, $entries[0]['outcome'] ); + $this->assertSame( 'GPTBot', $entries[0]['crawler'] ); + $this->assertSame( '/hello-world/', $entries[0]['path'] ); + } + + /** + * Status/outcome pairs. + * + * @return array