peptide-repo/prautoblogger
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: dossier page 403 — options.php-parent pattern (v0.19.3)

Browse Source 
Dossier page dead on prod (403) since v0.19.2 deploy. Root cause:
on_register_menu() registered under 'prautoblogger-settings' parent then
unset the slug from $submenu to hide the nav entry. At request time
get_admin_page_parent() scanned $submenu, found nothing, fell back to
orphan hookname 'admin_page_prautoblogger-dossier'. Render callback was
registered under 'prautoblogger_page_prautoblogger-dossier'. Mismatch ->
wp_die(403). Same hookname-mismatch class as the board 404 (v0.19.1).

Fix (seq 21 §Required fix items 1-6):

1. options.php-parent: add_submenu_page('options.php', ...) -> hookname
   is 'admin_page_prautoblogger-dossier' at BOTH registration and request
   time. Hidden by construction; no $submenu mutation needed or permitted.
   Add PARENT_SLUG = 'options.php' constant.

2. Asset enqueue gate: updated from 'prautoblogger_page_*' to
   'admin_page_*' prefix to match options.php-parent hookname.

3. Deep-link URLs (admin.php?page=prautoblogger-dossier&post_id=N):
   parent-agnostic; unchanged. Asserted in
   test_url_for_post_contains_slug_and_post_id +
   test_url_for_post_exact_shape.

4. Regression test upgraded to request-time faithful:
   test_request_time_hookname_matches_registration_hookname simulates
   get_admin_page_parent() against post-registration $submenu state.
   FAILS on v0.19.2 hide-by-unset (4 failures, captured in evidence):
     - test_request_time_hookname_matches_registration_hookname FAIL
     - test_dossier_parent_slug_is_options_php FAIL
     - test_no_submenu_mutation_after_registration FAIL
     - test_asset_enqueue_gate_uses_admin_page_prefix FAIL
   PASSES on v0.19.3 options.php-parent (9/9 OK, captured in evidence).
   test_hide_by_unset_would_fail_request_time_check documents broken
   pattern inline.

5. ARCHITECTURE.md §22b: hidden-page convention cross-reference + v0.19.3
   incident record added. §23: page registration description updated to
   options.php-parent. File tree entry updated.
   CONVENTIONS.md §Hidden Admin Pages: full rule + both incident history
   (board 404 v0.19.1, dossier 403 v0.19.2) + test methodology.

6. Version 0.19.2 -> 0.19.3, CHANGELOG entry. tests/bootstrap.php:
   PRAUTOBLOGGER_PLUGIN_URL + PRAUTOBLOGGER_VERSION constants added
   (resolves 'Undefined constant' in enqueue tests).

Deletion audit: removed lines are the broken 'prautoblogger-settings'
parent string, the 12-line $submenu mutation block, the wrong hook prefix
'prautoblogger_page_*'. No other logic removed.

Agent-Session: dossier-403-hotfix-20260612
This commit is contained in:
peptiderepo
2026-06-12 11:18:15 +00:00
parent 9c8e500244
commit ae32876b6b
7 changed files with 654 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
tests/bootstrap.php
View File

@@ -205,3 +205,16 @@ if ( ! class_exists( 'WP_Post' ) ) {
}
}
}
// Plugin URL and version constants used by admin enqueue methods.
// Defined here so all tests that load admin classes can stub WP enqueue calls
// without hitting "Undefined constant" errors.
if ( ! defined( 'PRAUTOBLOGGER_PLUGIN_URL' ) ) {
define( 'PRAUTOBLOGGER_PLUGIN_URL', 'https://test.example.com/wp-content/plugins/prautoblogger/' );
}
if ( ! defined( 'PRAUTOBLOGGER_VERSION' ) ) {
define( 'PRAUTOBLOGGER_VERSION', '0.19.3-test' );
}
if ( ! defined( 'PRAUTOBLOGGER_PLUGIN_DIR' ) ) {
define( 'PRAUTOBLOGGER_PLUGIN_DIR', dirname( __DIR__ ) . '/' );
}