hardening: migrate quicktree SQL helpers to prepared variants, adopt Pest test harness

[TheWitness]

Summary

Forks the changes from #12 (opened from an external fork) into a branch on the Cacti org's own fork tree, and adopts the Cacti-standard Pest test harness used by plugin_evidence.

• migrate selected plugin_quicktree SQL helper reads to prepared variants (quicktree.php, setup.php)
• add quicktree_security.php with quicktree_normalize_location() and use it for location handling / redirects
• remove composer.json — Pest/PHPUnit are now provided by Cacti core's Composer-managed vendor tree, installed by the CI workflow, matching the plugin_evidence pattern
• bring in phpunit.xml, tests/bootstrap-unit.php, tests/TestCase.php, tests/.cacti-version, and tests/Pest.php from plugin_evidence, adapted to quicktree's own source files (quicktree.php, setup.php, quicktree_security.php, ui_helpers.php)
• convert the remaining plain-script tests (tests/test_prepared_statements.php, tests/test_form_wrapper.php) into Pest specs (tests/Security/PreparedStatementsMigrationTest.php, tests/Unit/FormWrapperTest.php) — all test cases now run under Pest
• drop stale references to the removed plain-script files from the existing Pest specs
• adapt .github/workflows/plugin-ci-workflow.yml from plugin_evidence to install/enable the quicktree plugin and run the full tests/ suite through Pest

Tests

• php -l across all plugin and test PHP files
• Pest suite under tests/ (Security, Unit, Integration, E2E) via the updated CI workflow

Closes #12

[Copilot]

🟡 Changes recommended

The redirect-safety tests fail against two redirects, and CI requests coverage without installing a coverage driver.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR hardens QuickTree database access and location handling while migrating all tests to Pest with a Cacti-provided test environment.

Changes:

• Converts selected SQL reads to prepared helpers.
• Adds location normalization and redirect-safety checks.
• Replaces standalone tests with Pest and updates CI integration.

File summaries

File	Description
.github/workflows/plugin-ci-workflow.yml	Adds Cacti-based Pest CI
phpunit.xml	Configures the Pest suite
quicktree.php	Uses prepared queries and normalized locations
quicktree_security.php	Adds location normalization
setup.php	Uses prepared version lookup
tests/bootstrap-unit.php	Adds Cacti test bootstrap and stubs
tests/TestCase.php	Adds shared test base
tests/Pest.php	Adds Pest configuration
tests/.cacti-version	Defines expected Cacti version
tests/Unit/*	Adds unit coverage
tests/Security/*	Adds security and compatibility checks
tests/Integration/*	Adds redirect wiring checks
tests/E2E/*	Adds debug-header regression check
tests/test_form_wrapper.php	Replaced by Pest spec
tests/test_prepared_statements.php	Replaced by Pest spec
composer.json	Removed plugin-local dependency manifest

Review details

Suppressed comments (2)

quicktree.php:324

• This redirect has the same termination problem: the switch break does not terminate the request, so RedirectSafetyTest fails and later code can run after the Location header. Add an exit immediately after the redirect.

		header('Location: quicktree.php?location=' . $location);

tests/Unit/FormWrapperTest.php:22

• These guarded declarations redefine Cacti's global UI functions while Pest is loading an individual spec. If Cacti or another spec has already declared one, the guard skips the stub and this test either records no events or invokes production behavior; move the configurable stubs into the shared bootstrap/fixture instead.

if (!function_exists('top_header')) {
	function top_header() {
		$GLOBALS['__form_wrapper_events'][] = 'top_header';
	}
}

• Files reviewed: 21/21 changed files
• Comments generated: 8
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.