Summary

PHPUnit unit tests for the four core tracking classes in src/Tracker/: Tracker (server/client mode, dedup), Processor (IP handling, GDPR modes), Session (visit_id), Ajax (get_stat regression for #163).

Motivation

src/Tracker/ is the highest bug-density area in recent releases: #163 (critical), #155 (critical), #174 (high). Unit tests here run in <30s and catch regressions before E2E or manual QA.

Dependencies

• Depends on: testing: Bootstrap PHPUnit 10 + Brain Monkey for Free plugin unit tests #193 (PHPUnit + Brain Monkey)

Implementation

Files to create

• tests/unit/Tracker/TrackerTest.php
• tests/unit/Tracker/ProcessorTest.php
• tests/unit/Tracker/SessionTest.php
• tests/unit/Tracker/AjaxTest.php

Key test cases

TrackerTest:

• test_server_mode_calls_db_save_exactly_once()
• test_client_mode_defers_to_javascript()
• test_bot_useragent_is_excluded()
• test_dedup_guard_prevents_double_insert()

ProcessorTest:

• test_ip_full_stored_when_gdpr_disabled()
• test_ip_last_octet_zeroed_when_anonymized()
• test_ip_stored_as_salted_hash_when_hashed()
• test_no_ip_stored_when_consent_denied()
• test_geolocation_fields_populated_from_provider()

SessionTest:

• test_visit_id_is_positive_integer()
• test_same_visit_id_returned_within_session_window()
• test_new_visit_id_after_session_expiry()
• test_cookie_name_matches_documented_constant()

AjaxTest — regression for #163:
```php
/** @link #163 */
public function test_get_stat_does_not_overwrite_local_state(): void {
// Set up local state before get_stat() call
// Assert local state is preserved after handle()
}
```

• test_invalid_nonce_returns_error()
• test_rate_limiting_blocks_repeated_requests()

Standards

• All tests extend SlimStatUnitTestCase (from testing: Bootstrap PHPUnit 10 + Brain Monkey for Free plugin unit tests #193)
• Mock only WP functions via Brain Monkey — never mock own classes (research 02 §1.4)
• AjaxTest::test_get_stat_does_not_overwrite_local_state() is a named regression test with @link annotation
• Skill category: Tracker.php → tracking, Ajax.php → transport+tracking (skill spec §1.1)

Acceptance criteria

• composer test:unit -- --filter=Tracker runs in <30s
• TrackerTest covers server mode (DB call) and client mode (no DB call)
• ProcessorTest covers all 3 GDPR IP modes: full, anonymized, hashed
• AjaxTest contains regression test for [Bug] Screen resolution and fingerprint not saved in Server tracking mode #163 with @link annotation

References

• Research 01 §D — Tracking collection correctness
• Research 02 §1.2 (Brain Monkey), §1.4 (hook patterns)
• Skill spec §1.1 — file-to-category mapping