fix: enforce adversarial HTTP action contracts

Author: chubes4

packages/runtime-playground/src/wordpress-adversarial-adapter.ts

@@ -138,11 +138,13 @@ export function wordpressAdversarialActionSpec(action: WordPressAdversarialActio
     return { kind: "command", command: "wordpress.wp-cli", args: [`command=${command}`], operation: `adversarial:${action.surface}`, metadata: actionMetadata(action, capability) }
   }
   if (action.surface === "ajax") {
+    requirePostOperation(action)
     if (!action.target) throw new Error("WordPress adversarial AJAX actions require the target action name.")
-    const body = new URLSearchParams({ action: action.target, ...httpFormValues(action.input) }).toString()
+    const body = new URLSearchParams({ ...httpFormValues(action.input), action: action.target }).toString()
     return { kind: "command", command: "wordpress.browser-actions", args: [`steps-json=${JSON.stringify(httpBrowserSteps("/wp-admin/admin-ajax.php", "application/x-www-form-urlencoded", body))}`], operation: "adversarial:ajax", metadata: actionMetadata(action, capability) }
   }
   if (action.surface === "xmlrpc") {
+    requirePostOperation(action)
     if (typeof action.input !== "string" || action.input.trim() === "") throw new Error("WordPress adversarial XML-RPC actions require a non-empty XML request body.")
     return { kind: "command", command: "wordpress.browser-actions", args: [`steps-json=${JSON.stringify(httpBrowserSteps("/xmlrpc.php", "text/xml", action.input))}`], operation: "adversarial:xmlrpc", metadata: actionMetadata(action, capability) }
   }
@@ -324,6 +326,12 @@ function httpFormValues(value: unknown): Record<string, string> {
   return Object.fromEntries(Object.entries(record ?? {}).map(([name, item]) => [name, typeof item === "string" ? item : JSON.stringify(item)]))
 }
 
+function requirePostOperation(action: WordPressAdversarialAction): void {
+  if (action.operation.trim().toUpperCase() !== "POST") {
+    throw new Error(`WordPress adversarial ${action.surface.toUpperCase()} actions only support POST requests.`)
+  }
+}
+
 function httpBrowserSteps(path: string, contentType: string, body: string): Array<Record<string, unknown>> {
   const expression = `const response = await fetch(${JSON.stringify(path)}, { method: 'POST', headers: { 'Content-Type': ${JSON.stringify(contentType)} }, body: ${JSON.stringify(body)} }); return response.ok`
   return [{ kind: "navigate", url: "/", waitFor: "load" }, { kind: "evaluate", expression, assert: true }]

tests/wordpress-adversarial-adapter.test.ts

@@ -26,12 +26,15 @@ const rest = wordpressAdversarialActionSpec({ surface: "rest", operation: "POST"
 assert.equal(rest.command, "wordpress.run-php")
 assert.equal(rest.metadata?.fidelity, "exact")
 assert.match(rest.args?.[0] ?? "", /WP_REST_Request/)
-const ajax = wordpressAdversarialActionSpec({ surface: "ajax", operation: "POST", target: "fixture_save", input: { value: "mutated" } })
+const ajax = wordpressAdversarialActionSpec({ surface: "ajax", operation: "POST", target: "fixture_save", input: { action: "overridden", value: "mutated" } })
 assert.equal(ajax.command, "wordpress.browser-actions")
 assert.match(ajax.args?.find((arg) => arg.startsWith("steps-json=")) ?? "", /action=fixture_save&value=mutated/)
+assert.doesNotMatch(ajax.args?.find((arg) => arg.startsWith("steps-json=")) ?? "", /overridden/)
+assert.throws(() => wordpressAdversarialActionSpec({ surface: "ajax", operation: "GET", target: "fixture_save" }), /only support POST/)
 const xmlrpc = wordpressAdversarialActionSpec({ surface: "xmlrpc", operation: "POST", input: "<methodCall><methodName>fixture.echo</methodName></methodCall>" })
 assert.equal(xmlrpc.command, "wordpress.browser-actions")
 assert.match(xmlrpc.args?.[0] ?? "", /xmlrpc\.php/)
+assert.throws(() => wordpressAdversarialActionSpec({ surface: "xmlrpc", operation: "PUT", input: "<methodCall />" }), /only support POST/)
 
 const cli = wordpressAdversarialActionSpec({ surface: "cli", operation: "run", input: "option get home" })
 assert.deepEqual(cli.args, ["command=option get home"])