[3.0][Testing] Cover last week's fixes that the unit suite can reach

[albertlast]

Note

This change was produced by an LLM. The tests, the commit message and this
description were all written by Claude (Anthropic), driven by @albertlast. It has
not yet had human code review.

The suite was run rather than only reasoned about, and every test below was also
run against the unfixed code it covers. Please review it as untrusted work.

Description

This is the first instalment of what #9326 was for: a sweep of the bug fixes merged
into release-3.0 over the past week, asking of each one whether the unit suite can
reach it, and writing a test where it can.

Twenty-five or so fixes landed in that window. Most of them are templates, JavaScript,
or SQL, and most of the PHP ones need Db::$db or User::$me. Three do not.

Fix	What is now covered
#9506	IP::ip2range() on IPv6 ranges, written both elided and in full, plus IPv4 and the wildcard forms as the control
#9507	Url::proxied() refusing a private, loopback or documentation IPv6 host written in brackets, and still proxying a global one
#9499	TimeInterval being a \DateInterval rather than holding one: \DateTime::add() and ::sub(), the %a fallback, fractional seconds, and the string form

IP::matchToCIDR() is covered too. #9507 restructured it without meaning to change it,
and those cases pass either side of that commit — which is the point of having them.

140 tests, 206 assertions, still well under a second.

These are regression tests, not tests written to fit

Each set was run against the code as it was before its fix, by checking out the single
file at the commit before the merge.

• Sources/IP.php before [3.0] Makes SMF\IP::ip2range() work correctly with IPv6 addresses #9506: both IPv6 range cases fail, and the failure is worth
  reading. 2001:db8::1-2001:db8::ff came back as 255.255.255.255 for the low end,
  because neither end validated as IPv4, so the range was not recognised as a range and
  the address was walked as though it were a fragment. A ban on an IPv6 range was
  landing somewhere else entirely.
• Sources/Url.php before [3.0] Improves handling of IPv6 hosts in SMF\IP and SMF\Url #9507: the three private IPv6 cases fail, each by producing a
  proxy.php URL. http://[::1]/pic.png was being handed to the proxy, which is the
  forum fetching its own loopback on behalf of whoever pasted the address. The IPv4
  cases pass either side, as they should.
• Sources/TimeInterval.php before [3.0] Restores full compatibility of SMF\TimeInterval with \DateInterval #9499: the two date-arithmetic cases do not fail so
  much as stop, with
  DateObjectError: Object of type SMF\TimeInterval (inheriting DateInterval) has not been correctly initialized by calling parent::__construct().
  Four more fail on the string form.

Two existing tests changed

testTimeOnlyDurationsKeepTheirTimeDesignator and testStringifyingIsStableAcrossARoundTrip
asserted P0DT30M. #9499 removed the behaviour behind that — the class no longer
populates days for a duration naming no years or months, and no longer writes a zero
day count out — so both now assert PT30M, which is the shorter and more conventional
form. A third case, testAZeroUnitIsDroppedOnTheWayBackOut, keeps P0DT30M as input
so the normalisation itself stays watched.

This is the suite doing its job on the first change to reach it: #9499 was a deliberate
behaviour change, and the two failures said so.

What is deliberately not here

Two of the week's fixes looked reachable and are not:

• [3.0] Correctly restores original content of code BBC in MarkdownParser #9509, the code BBC restoration in MarkdownParser. The constructor calls
  Parser::setStaticVars(), which calls User::setMe(), which wants Db::$db.
• TimeInterval::localize(), the other half of [3.0] Restores full compatibility of SMF\TimeInterval with \DateInterval #9499. Every branch of it goes
  through Lang::getTxt(), which loads a language file, which wants Theme::$current
  and Db::$db. toParsable() walks the same units with the strings hard coded, so the
  ordering is not entirely unwatched.

Both belong to an integration suite. Neither is a reason to contort the production code.

The rest of the week was out of reach for the ordinary reasons: #9433, #9459, #9463,
#9455, #9466, #9482 and #9476 need a database; #9453 reaches Db::$db through
PageIndex's constructor; #9449, #9444 and #9454 are templates; #9479, #9494 and #9495
are JavaScript; #9505 needs a socket; #9502 sits inside a protected method on a loaded
Profile.

One defect found while writing these

IP::matchToCIDR() builds its IPv6 mask like this:

$bin_mask = str_repeat('f', (int) $cidr_subnetmask / 4);

The cast binds to $cidr_subnetmask, not to the division, so the argument is a float
whenever the prefix length is not a multiple of four, and str_repeat() throws a
TypeError. matchToCIDR('2001:db8::/33') is a fatal error, not a false.

The switch ($cidr_subnetmask % 4) immediately below it exists to add the odd nibble
for exactly those prefix lengths, so all three of its cases are unreachable and always
have been. The line predates #9507, which renamed the variable on it; it came in with
9cc402c99, moving the method over from QueryString::matchIPtoCIDR().

Nothing here fixes it. The data provider keeps to multiples of four and says why in a
comment, because asserting the TypeError would preserve it. Worth its own PR.

How this was verified

• vendor/bin/phpunit: OK (140 tests, 206 assertions) on PHP 8.4.24.
• Each new group re-run against the pre-fix file, as described above.
• php-cs-fixer check --allow-risky=yes tests/: Found 0 of 13 files that can be fixed.
• check-signed-off.php passes locally.

A word on the three lines of Sources/ in this diff

They are #9512, merged in, and they are not this branch's doing.

.github/workflows/php-cs-fixer.yml restricts the check to the files a pull request
touched, unless that pull request changes .php-cs-fixer.dist.php or composer.lock,
in which case it scans everything. This branch changes composer.lock, because #9326
adds PHPUnit, so it got the whole-tree scan and reported three pre-existing violations
of the SMF/section_comments fixer in Alert.php, Autolinker.php and Help.php —
none of which this branch goes anywhere near. They are one blank line added and two
removed, and they have been sitting in release-3.0 unnoticed because no pull request
since has touched those files or triggered a full scan.

#9512 fixes them against release-3.0 and is worth merging on its own. It is merged
here so this branch is green now rather than green later; merge #9512 first and it
disappears from this diff.

Relationship to other PRs

This is stacked on #9326 and contains it, so the diff shown here is that branch's as
well as its own. It also therefore carries everything #9326 carries: #9317, #9321,
#9324 and #9325, plus #9512 as described above. Merge those and rebase this on
release-3.0, and only tests/ is left.

The three fixes it covers — #9499, #9506, #9507 — are already in release-3.0, which is
merged into this branch.

Issues References (Fixes|Related|Closes)

1. Depends on: [3.0][Testing] Add a PHPUnit suite for the parts that need no database #9326 (and through it [3.0][Testing] Add a Docker development environment for MySQL and PostgreSQL #9317, [3.0] Give each action subclass its own instance in ActionTrait::load() #9321, [3.0] Parse memory settings that carry no unit designator #9324, [3.0] Compare URL schemes case insensitively #9325), [3.0] Restore the blank line the section banners want around them #9512
2. Related: [3.0] Restores full compatibility of SMF\TimeInterval with \DateInterval #9499, [3.0] Makes SMF\IP::ip2range() work correctly with IPv6 addresses #9506, [3.0] Improves handling of IPv6 hosts in SMF\IP and SMF\Url #9507
3. Related: [3.0] Correctly restores original content of code BBC in MarkdownParser #9509 (out of reach for this suite, noted above)