[shail-mehta]

Trac ticket: #65819

What

Adds a dedicated PHPUnit class for rest_cookie_check_errors(), covering existing-result passthrough, missing/invalid/valid nonces, and skipping when another auth method is in use.

Test-only; no production code changes.

Why

rest_cookie_check_errors() had no direct @covers coverage. Small helper coverage fits the #65819 test cleanup track.

How

Add tests/phpunit/tests/rest-api/restCookieCheckErrors.php with @covers ::rest_cookie_check_errors.

• Returns an existing non-empty result unchanged
• Clears the current user and returns true when no nonce is present
• Returns rest_cookie_invalid_nonce for an invalid nonce
• Returns true for a valid wp_rest nonce
• Skips the cookie check when the user is logged in via another auth method

Testing Instructions

1. npm run test:php -- --filter Tests_REST_API_RestCookieCheckErrors
2. npm run test:php -- --filter Tests_REST_API_RestCookieCheckErrors -c tests/phpunit/multisite.xml
3. npm run test:php -- --filter Tests_REST_API_RestCookieCheckErrors --order-by=random
4. npm run test:php -- --group restapi

Use of AI Tools

• Cursor

[Copilot]

🟡 Changes recommended

The test teardown leaves $GLOBALS['wp_rest_server'] populated, allowing shared routes and captured nonce headers to leak into subsequent tests; it should be reset to null.

1 open issue

• Reset the shared REST server during teardown · New

What changed in this PR

Adds direct PHPUnit coverage for rest_cookie_check_errors() as part of the #65819 test cleanup effort. No production code changes.

Changes:

• Adds a dedicated REST API test class with an explicit @covers annotation.
• Tests existing-result passthrough, missing/invalid/valid nonces, and alternate authentication.
• Adds teardown cleanup for authentication and nonce state.

File	Description
tests/​phpunit/​tests/​rest-api/​restCookieCheckErrors.php	Adds five tests covering cookie authentication results and nonce handling.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The valid-nonce test can pass even if authentication clears the user, so it needs an assertion that the current user ID remains unchanged.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Assert valid nonce preserves the authenticated user

tests/​phpunit/​tests/​rest-api/​restCookieCheckErrors.php:65

The missing-nonce branch also returns true, so this test would still pass if a valid nonce were mistakenly treated as absent and the authenticated user were cleared. Assert that get_current_user_id() remains $user_id after the call so the test distinguishes successful cookie authentication from an anonymous request.

1 resolved since last review

• Reset the shared REST server during teardown

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human review is needed to assess whether the nonce tests adequately cover header-based cookie authentication.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the test-only addition of PHPUnit coverage for REST cookie authentication.

No open issues 🎉

_{Review effort: Balanced}