Reseller Manager: From Audit to Docker Tests for WooCommerce

When I revisit a demonstration project, one of the most useful questions is: which behaviours can I prove through a repeatable check?

I addressed this question while working on Reseller Manager, my demonstration WooCommerce plugin for reseller registration, account approval and dedicated pricing.

The work covered code, tests and documentation. The reference for the verified application code is revision 3f4e199. The result is a Docker-based suite that passed 48 behavioural checks, together with syntax checks for the 17 PHP files in the repository. This is a further step in the project, which remains educational and still has limitations to explore.

Project overview

Reseller Manager is a demonstration project built to explore a common B2B e-commerce requirement: adding a dedicated reseller journey to a standard WooCommerce catalogue without turning the store into a separate commercial platform.

The workflow begins with a registration request. A new account receives the reseller role and remains pending until an administrator approves it. From the Resellers administration area, authorised users can create, approve, disable or delete accounts and configure their dedicated commercial terms.

The repository implements two pricing strategies:

• dedicated catalogue and cart prices, set for individual products or calculated through a global percentage discount;
• public prices with a cart discount, where the catalogue remains unchanged and the reduction is applied as a negative fee to the subtotal.

Registration and login forms are available as both shortcodes and Gutenberg blocks. In the codebase, the entry file boots the plugin, the core class contains the main logic, and the interfaces are separated into administration pages, shortcodes and blocks. This structure makes the boundaries between bootstrap, business rules and presentation easy to inspect.

The project is public to document technical decisions, checks and progress. It remains an educational laboratory: it is neither a hosted service nor software presented as production-ready. The GitHub repository contains the code, instructions, tests and current limitations.

The local demo form, using sample data and no production website.

Reproduce first, then fix

The starting point was a focused registration-form test built with simulated WordPress functions. It was useful for checking that the field names matched those read by the handler and that the Italian tax code and VAT number remained separate.

Verifying authorisation, users and prices also required an environment with a real WordPress installation, WooCommerce and a database.

I therefore added a dedicated Docker stack. The first integration cycle exposed 14 failures out of 18 cases. Later checks extended the scope to administrative actions, uninstallation, Gutenberg blocks and malformed input.

For every group of problems, the objective was to reproduce the behaviour before correcting it and to retain the case in the suite as a regression test.

Permissions: a nonce is only part of the check

Part of the work concerned access to reseller profiles and administrative operations.

The tests showed that nonce checks alone did not guarantee that the user was also entitled to perform the action. I added explicit capability checks and validation of the target account's role.

Profile management and administrative actions now require manage_options; deletion also verifies the capability associated with removing the target user. The tests cover both rejection of unauthorised operations and the approval path available to an administrator.

This is an important distinction in WordPress development: validating a request and authorising the person making it are separate controls.

WooCommerce pricing: keep numbers and presentation separate

Another group of problems concerned reseller price calculations.

In the cart path, a custom price was formatted as HTML before being assigned to the product. An early exit from the loop also prevented all cart rows from being processed.

I separated the numeric value from its presentation and corrected processing across the entire cart. The tests also cover two easily overlooked cases: a custom price with a global discount of zero and recalculation of totals.

For example, a product with a current price of 160 and a 10% reseller discount must remain at 144 even after a second calculation. The product's regular price must remain unchanged.

The checks also cover excluding disabled accounts and users without the reseller role from discounts.

A fictional account and two sample products show the available administration settings.

Forms, blocks and data retention

The work included other observable behaviours:

• saving prices on one catalogue page preserves those assigned to products on other pages;
• shortcodes return their content and Gutenberg blocks render the forms correctly;
• some array-shaped inputs are handled without triggering the PHP error reproduced in the tests;
• passwords are entrusted to WordPress rather than treated as ordinary text to sanitise;
• uninstallation removes the plugin's own data while preserving WordPress accounts and content.

The last behaviour is also documented in the README: removing an account from the administration area and uninstalling the plugin are distinct operations.

Response to a real form submission in the local browser. The confirmation does not prove that an email was delivered.

What the tests verify

The complete suite comprises:

Layer	Checks	Scope
Form contract	12	Fields, nonce and registration data with simulated functions
Integration	29	Permissions, approval, prices, cart, forms and data cleanup
HTTP	7	Registration and login through requests to local WordPress

The HTTP checks verify that registration creates a pending account, login is denied before approval, and an enabled account receives the redirect and login cookie. They also include an invalid nonce and an incorrect password.

The verified environment uses WordPress 7.0, WooCommerce 11.2.1 and MariaDB 10.11, with PHP 8.3.33 for command-line tests and PHP 8.2.31 for web requests.

Visual report generated from the local Docker runner output, separate from the GitHub Actions run.

The screenshots and the complete verification output accompany the case study in the repository.

A repeatable suite without using the production website

The entry command is:

bash tests/run.sh

The runner creates a new Docker project with dedicated volumes, installs dependencies, runs the checks and removes its temporary environment afterwards. Images are pinned by digest and the WooCommerce version is explicit.

The environment exposes no ports and mounts the repository as read-only. The checks were run locally; matcode.dev was not modified.

Making the check available on GitHub

I added a GitHub Actions workflow that uses the same runner on pushes and pull requests and retains the log as an artifact. The configuration was checked with actionlint.

The first public pipeline run, for commit 440ceae, completed successfully. The docker-test-output artifact was also verified. This result applies to that revision; subsequent checks remain available on the repository's Actions page.

The repository also includes the GPLv2-or-later licence text, consistent with the declaration already present in the plugin.

Limitations for the next increment

The results describe the scenarios that were executed. Variable products, complex tax and coupon combinations, Store API and Checkout Blocks, multisite, earlier versions, and interactions with other price-modifying plugins still need to be verified.

Actual email delivery also requires a dedicated check: controller tests intercept it. The suite does not replace a complete security audit or prove compatibility with every WooCommerce installation.

The next increment will start from these limitations, adding new reproducible cases. To follow the project and inspect its code and documentation, visit the Reseller Manager repository on GitHub.

---

Return to the collection of recent projects, or contact me to discuss WordPress, WooCommerce or PHP backend work.