test: add WordPress REST auth fixture

[atomnoid]

What does this PR do?

Implements GitHub issue #409 with an offline, synthetic WordPress REST authentication fixture.

This adds:

• docs/WORDPRESS_REST_AUTH.md
• tests/fixtures/wordpress-rest-auth.json
• tests/wordpress-rest-auth.test.js

The fixture covers valid/invalid authentication, missing/invalid nonce, and missing/insufficient capability. Rejected cases fail closed before protected data access.

Fixes #409

Acceptance criteria covered

• Linked issue has clear acceptance criteria, or this PR adds them first
• This PR completes the listed criteria or names the remaining work

How was it tested?

• Ran locally (npm start for the desktop app, or npm run dev for a browser at http://localhost:3000)
• Built the installer (npm run build) if build/packaging was touched
• Relevant tests pass
• Used the relevant checks from docs/CONTRIBUTOR_QUICKSTART.md

Validation:

• npx prettier --check docs/WORDPRESS_REST_AUTH.md tests/wordpress-rest-auth.test.js tests/fixtures/wordpress-rest-auth.json
• node --test tests/wordpress-rest-auth.test.js
• git diff --check

All passed.

Checklist

• One focused change per PR
• Only people are credited as authors/contributors; no AI tool attribution or signature footer is included
• Commits are signed off (git commit -s, DCO)
• Works fully offline (no new external network calls in the local edition)
• Matches surrounding code style
• No real customer, tax, payment, credential, token, or production data is included

[atomnoid]

Hello @sridharkalaibala
Implemented and validated the proposed fix for #409.

The PR adds an offline synthetic WordPress REST authentication fixture covering:

• Valid and invalid authentication
• Missing and invalid nonces
• Missing and insufficient capabilities
• Fail-closed behavior before protected data access

Validation completed successfully:

• Prettier check
• node --test tests/wordpress-rest-auth.test.js — 3/3 passed
• git diff --check

No live API calls, credentials, or production/customer data are involved.

Ready for review. Thanks!

[sridharkalaibala]

Reviewed and approved. This is a focused, offline synthetic fixture with clear documentation and fail-closed authorization coverage. I also ran
ode --test tests/wordpress-rest-auth.test.js locally (3 passing) and confirmed the PR’s required checks are green.

[github-actions]

Merged to develop. Anyone can test this - you do not need write access.

Try it at https://develop.posnic.io, or run it yourself:

git fetch origin develop && git checkout develop
npm install && npm --prefix api install
npm run dev   # then http://localhost:3000

When you have tested it, say what you did and what happened, and set
QA passed or QA failed. If you cannot set labels, just comment -
a maintainer will.

Reporting that something is broken is as useful as fixing it. It is
better found here than by a shopkeeper.