First increment of the panel de-duplication, plus the test infrastructure it needs.
Helper
The device-permission preamble (get_simple_device_perms then, for non-simple users, intropage_get_allowed_devices) is copied ~39 times across the panels. This adds one documented intropage_device_scope($user_id) returning {simple, allowed} and adopts it in the two alert.php panels (an 8-line block becomes 4, behaviour identical). It returns only the uniform parts: the IN() clause is left to the caller because the column and any AND prefix differ between panels (for example alert.php uses AND host.id IN (...)).
Coverage harness
The plugin had no coverage configuration, and its tests/Security/* are source-pattern scans rather than behavioural tests. This adds a phpunit.xml with a coverage source list so coverage is measurable, plus tests/Unit/DeviceScopeTest.php and permission-chain stubs in tests/bootstrap.php. The test drives every branch of the helper (all pass under PHP 8.4).
Note: five tests/Security/* cases already fail on develop (verified by stashing this change); they are pre-existing and untouched here.
This is deliberately one family. The remaining ~37 sites want per-site verification of each IN()-clause variant, done family by family, not a blind sweep.
Tracking issue for #378, which carries the fix.
First increment of the panel de-duplication, plus the test infrastructure it needs.
Helper
The device-permission preamble (
get_simple_device_permsthen, for non-simple users,intropage_get_allowed_devices) is copied ~39 times across the panels. This adds one documentedintropage_device_scope($user_id)returning{simple, allowed}and adopts it in the twoalert.phppanels (an 8-line block becomes 4, behaviour identical). It returns only the uniform parts: the IN() clause is left to the caller because the column and anyANDprefix differ between panels (for examplealert.phpusesAND host.id IN (...)).Coverage harness
The plugin had no coverage configuration, and its
tests/Security/*are source-pattern scans rather than behavioural tests. This adds aphpunit.xmlwith a coverage source list so coverage is measurable, plustests/Unit/DeviceScopeTest.phpand permission-chain stubs intests/bootstrap.php. The test drives every branch of the helper (all pass under PHP 8.4).Note: five
tests/Security/*cases already fail ondevelop(verified by stashing this change); they are pre-existing and untouched here.This is deliberately one family. The remaining ~37 sites want per-site verification of each IN()-clause variant, done family by family, not a blind sweep.
Tracking issue for #378, which carries the fix.