Skip to content

Fix four defects found by real-WordPress integration testing - #4

Merged
ibuilder merged 1 commit into
mainfrom
fix/integration-findings
Aug 8, 2026
Merged

Fix four defects found by real-WordPress integration testing#4
ibuilder merged 1 commit into
mainfrom
fix/integration-findings

Conversation

@ibuilder

@ibuilder ibuilder commented Aug 8, 2026

Copy link
Copy Markdown
Owner

Installed the v2.0.0 release ZIP into a fresh WordPress 7.0.3 with a mocked Procore API and exercised every surface. Four defects surfaced that the unit suite structurally cannot catch — it shims the very WordPress functions involved.

Defects

# Defect Impact
1 page=1 sent to every endpoint, including single-record ones like /projects/{id} and /me Meaningless on the wire, and varied the cache key for identical requests
2 REST proxy ignored the configured default company Every proxied request failed with a missing-company error unless company_id was passed explicitly
3 Translations loaded before init _load_textdomain_just_in_time notice on WP 6.7+, and translations silently dropped
4 WP-CLI subcommands registered with underscores wp procore-connect cache-clear — the documented form — did not exist

On #2: the route declares company_id as an integer defaulting to 0, and Client::fetch() used isset(), so a supplied zero read as a deliberate choice rather than an omission. Zero now falls back to the site default, which also aligns the proxy with shortcode behaviour.

On #4: WP-CLI derives subcommand names from method names and does not convert underscores. Fixed with @subcommand annotations rather than renaming methods.

Tests

Regression tests added for the two API-layer defects (62 tests, 277 assertions, all green). Defects 3 and 4 are registration-time behaviours only a real WordPress exhibits, so they are covered by the integration run rather than the unit suite.

Verified in the live install after fixing

  • All 24 shortcode invocations render; zero PHP notices, warnings or fatals
  • Token request goes to login.procore.com — the headline 1.x fix, confirmed live
  • Single-record URLs carry no pagination; paginated ones still do
  • Second identical render makes no HTTP call; simulated outage serves the stale copy
  • REST proxy returns records, excludes identity endpoints, refuses writes, leaks no credentials
  • All six admin tabs render; secret and token never appear in the HTML
  • 1.x migration: plaintext secret re-encrypted, stale token discarded, option de-autoloaded
  • Uninstall removes all 10 options and transients; keep_data honoured
  • wp procore-connect test passes all 6 stages and probes all 16 endpoints

🤖 Generated with Claude Code

Installed the v2.0.0 release ZIP into a fresh WordPress 7.0.3 with a
mocked Procore API and exercised every surface. Four defects surfaced
that the unit suite structurally cannot catch, because it shims the
WordPress functions involved.

Pagination was sent to endpoints that have none. Every request carried
page=1, including /projects/{id} and /me. Beyond being meaningless on
the wire, it varied the cache key for what was the same request.
Pagination now applies only where the registry marks an endpoint
paginated, and an explicitly requested page is still honoured.

The REST proxy ignored the configured default company. The route
declares company_id as an integer defaulting to 0, and the client
treated a supplied zero as a deliberate choice rather than an omission,
so the site default never applied and every proxied request failed with
a missing-company error. A zero identifier now falls back to the
configured default, which also makes the proxy behave like shortcodes.

Translations loaded before init. Shortcode definitions carry translated
titles and were built on plugins_loaded, so WordPress 6.7+ emitted a
_load_textdomain_just_in_time notice and silently dropped translations.
Registration is deferred to init, where add_shortcode belongs anyway.

WP-CLI subcommands did not match the documentation. They registered as
cache_clear, cache_warm and reset_token because WP-CLI derives names
from methods and does not convert underscores. Added @subcommand
annotations so the documented hyphenated forms work.

Regression tests added for the two API-layer defects. The other two are
registration-time behaviours that only a real WordPress exhibits.

Verified after the fixes, in the live install: all 24 shortcode
invocations render, no PHP notices or warnings, the token request goes
to login.procore.com, single-record URLs carry no pagination, caching
suppresses the second HTTP call, a simulated outage serves stale cache,
the REST proxy returns records, all six admin tabs render without
leaking the secret or token, the 1.x migration re-encrypts the secret
and discards the stale token, and uninstall removes all 10 options.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@ibuilder
ibuilder merged commit f656a58 into main Aug 8, 2026
13 checks passed
@ibuilder
ibuilder deleted the fix/integration-findings branch August 8, 2026 00:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant