Files
Geoff TaylorandGitHub 1807b2e798 Add authenticated download URLs for headless frontends (#995)
* feat: add authenticated download URLs for headless frontends

- Add downloadNonce and downloadUrl fields to DownloadableItem type
  using the existing Protected Router session transfer pattern
- Add preAuthDownloadUrl field (toggleable via settings) that generates
  tokenized download URLs for direct file access without cookie auth
- Add download_url nonce handling to Protected_Router
- Add enable_pre_auth_download_urls and download_url_nonce_param settings
- Add GraphQLE2E helpers for checkout and account shortcode pages
- Rewrite ProtectedRouterCest to test redirect flow without JS-dependent
  page content assertions, add account and payment method URL tests
- Add DownloadableItemAuthCest with 5 e2e tests covering both options

* fix: test suite stability and code coverage collection

- Add WC_Unit_Tests_Bootstrap stub to wpunit bootstrap to bypass
  wc_get_product_visibility_term_ids static cache between suites
- Add setWooGraphQLSetting helper to GraphQLE2E for safe individual
  field updates to woographql_settings option with proper defaults
- Update all functional tests to use setWooGraphQLSetting instead of
  replacing the entire woographql_settings option
- Fix createRelated factory to use explicit shared category instead
  of relying on default Uncategorized category
- Add download_url to ProtectedRouterTest nonce names assertion
- Remove debug logs from ProductQueriesTest and ProductsQueriesTest
- Fix CI workflow to run suites separately and aggregate coverage
  via phpcov merge
- Wire c3.php into WordPress index.php for remote coverage collection
- Update .coveralls.yml service_name to github-actions
- Clean up Xdebug 2 settings in Dockerfile

* chore: Linter compliances met

* fix: ensure tests/_output is writable for c3.php coverage collection

* devops: .env.docker removed from setup

* devops: split CI into separate jobs per suite with retry and coverage aggregation

* devops: add +Coverage indicator to CI job names

* devops: add --fail-fast to first run, fix retry to mark job as passing on retry success
2026-03-26 17:20:55 -04:00

59 lines
2.6 KiB
PHP

<?php
class ProtectedRouterTest extends \Tests\WPGraphQL\WooCommerce\TestCase\WooGraphQLTestCase {
public function testRouteEndpoint() {
/**
* Test that the default route is set to "graphql"
*/
$this->assertEquals( 'transfer-session', apply_filters( 'woographql_authorizing_url_endpoint', \WPGraphQL\WooCommerce\Utils\Protected_Router::$route ) );
}
/**
* Test to make sure that the rewrite rules properly include the graphql route
*/
public function testGraphQLRewriteRule() {
global $wp_rewrite;
$route = apply_filters( 'woographql_authorizing_url_endpoint', \WPGraphQL\WooCommerce\Utils\Protected_Router::$route );
$this->assertArrayHasKey( $route . '/?$', $wp_rewrite->extra_rules_top );
}
public function testAddQueryVar() {
$query_vars = [];
$router = \WPGraphQL\WooCommerce\Utils\Protected_Router::instance();
$actual = $router->add_query_var( $query_vars );
$this->assertEquals( $actual, [ apply_filters( 'woographql_authorizing_url_endpoint', \WPGraphQL\WooCommerce\Utils\Protected_Router::$route ) ] );
}
public function testGetNonceNames() {
$router = \WPGraphQL\WooCommerce\Utils\Protected_Router::instance();
$this->assertEquals(
[
'cart_url' => '_wc_cart',
'checkout_url' => '_wc_checkout',
'account_url' => '_wc_account',
'add_payment_method_url' => '_wc_payment',
'download_url' => '_wc_download',
],
$router->get_nonce_names()
);
}
public function testGetNoncePrefix() {
$router = \WPGraphQL\WooCommerce\Utils\Protected_Router::instance();
$this->assertEquals( 'load-cart_', $router->get_nonce_prefix( 'cart_url' ) );
$this->assertEquals( 'load-checkout_', $router->get_nonce_prefix( 'checkout_url' ) );
$this->assertEquals( 'load-account_', $router->get_nonce_prefix( 'account_url' ) );
$this->assertEquals( 'add-payment-method_', $router->get_nonce_prefix( 'add_payment_method_url' ) );
$this->assertEquals( null, $router->get_nonce_prefix( 'invalid' ) );
}
public function testGetTargetEndpoint() {
$router = \WPGraphQL\WooCommerce\Utils\Protected_Router::instance();
$this->assertEquals( get_permalink( wc_get_page_id( 'cart' ) ), $router->get_target_endpoint( 'cart_url' ) );
$this->assertEquals( wc_get_endpoint_url( 'checkout' ), $router->get_target_endpoint( 'checkout_url' ) );
$this->assertEquals( get_permalink( get_option( 'woocommerce_myaccount_page_id' ) ), $router->get_target_endpoint( 'account_url' ) );
$this->assertEquals( wc_get_account_endpoint_url( 'add-payment-method' ), $router->get_target_endpoint( 'add_payment_method_url' ) );
$this->assertEquals( null, $router->get_nonce_prefix( 'invalid' ) );
}
}