This plugin had no tests/Security category at all, and setup.php's
lifecycle/device-hook functions had zero test coverage (only db_functions.php
and the request-output escaping/wiring were tested). Closed both gaps:
- Security: added the standard PHP compatibility scan (8.0-8.4
removed/added syntax) and a static structure check (required
functions, INFO keys), matching the baseline used across the rest of
the plugin fleet.
- Unit: plugin_monitor_version(), the lifecycle contract functions
(plugin_monitor_uninstall - verifies it drops every table it owns,
plugin_monitor_check_config - both the out-of-range and valid
monitor_refresh branches, plugin_monitor_upgrade,
monitor_check_upgrade()'s page-guard and version-drift branches),
the device-list hooks (monitor_device_filters, monitor_device_sql_where,
monitor_device_action_array, monitor_device_remove), monitor_draw_navigation_text(),
monitor_get_default(), monitor_setup_table() (verifies every table it
provisions), and monitor_poller_bottom() (primary-poller and
non-primary-poller branches).
- Integration: plugin_monitor_install() (verifies every hook, the
realm, the tables it provisions, and the config defaults it sets,
together, in one pass) - this plugin had no tests/Integration
coverage of setup.php before (the existing Integration tests cover
request-output wiring, not the plugin lifecycle).
No new unserialize() hardening was needed: setup.php's one
unserialize() call already goes through
sanitize_unserialize_selected_items().
Also fixed tests/.cacti-version, which was pinned to a stale "1.2.31"
and failed the bootstrap's version check against any other real Cacti
checkout (e.g. a local 1.2.32 checkout); "1.2.x" matches the
moving-branch convention used elsewhere in this fleet.
Intentionally left uncovered: monitor_device_table_bottom()/monitor_show_tab()/
monitor_top_graph_refresh()/plugin_monitor_page_head() (print-heavy UI
rendering), monitor_config_settings()/monitor_config_arrays()/monitor_config_form()
(very large), monitor_device_action_execute()/monitor_device_action_prepare()
(large, print/DB-heavy confirmation dialogs), and monitor_api_device_save()
(moderate complexity, comparatively low value relative to the effort of
safely mocking its dependencies) - consistent with similarly-scoped
functions skipped elsewhere in this coverage-expansion pass.
tests/bootstrap-unit.php gained a fixture-mock DB API
(monitor_test_mock_db/monitor_test_reset_db_mocks/monitor_test_db_result,
matching the convention used elsewhere in the plugin fleet),
api_plugin_register_hook/api_plugin_register_realm call-logging stubs,
db_table_exists, and exec_background (call-logging, safe here since
setup.php's poller include always goes through $config['library_path'],
which points at a throwaway test stub, never Cacti core's real
lib/poller.php); read_config_option/set_config_option were rewired from
hardcoded no-ops to a real backing store - all needed by the new tests.
Verified via a real WSL Cacti install (composer-managed Pest, not a
plugin-local vendor tree): 63 passed (303 assertions), up from 31.
