Replace network-dependent login tests with mocked versions

.buildkite/swift-test.sh

@@ -6,8 +6,25 @@ set -euo pipefail
 
 export SKIP_PACKAGE_WP_API=true
 
+# Create and unlock a temporary keychain for SecPKCS12Import (used by MockWebServer TLS tests).
+# On CI, the default keychain may be locked, causing errSecInteractionNotAllowed (-25308).
+if [ "${BUILDKITE:-}" = "true" ]; then
+    echo "--- :key: Setting up keychain for TLS tests"
+    security delete-keychain ci-test.keychain-db 2>/dev/null || true
+    security create-keychain -p "" ci-test.keychain-db
+    security default-keychain -s ci-test.keychain-db
+    security unlock-keychain -p "" ci-test.keychain-db
+    security set-keychain-settings ci-test.keychain-db
+fi
+
 function run_tests() {
     local platform; platform=$1
+
+    if [ "$platform" = "iOS" ]; then
+        echo "--- :lock: Trusting test CA certificate"
+        make trust-test-ca || echo "⚠️ Could not trust test CA — spec 19 (custom CA cert) will be skipped"
+    fi
+
     echo "--- :swift: Testing on $platform simulator"
     make "test-swift-$platform"
 }

Makefile

@@ -25,6 +25,17 @@ clean:
 	@# Help: Remove untracked files from the project via Git.
 	git clean -ffXd
 
+trust-test-ca:
+	@# Help: Trust the test CA certificate (macOS only).
+	@# Uses admin domain (-d) for system-wide trust. Requires user interaction
+	@# on headless CI — if this fails, HTTPS tests using the test CA (spec 19)
+	@# will be skipped.
+	sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain test-data/ssl-certs/ca-cert.pem
+
+trust-test-ca-jvm:
+	@# Help: Trust the test CA certificate in the JVM keystore (requires write access to cacerts).
+	keytool -importcert -file test-data/ssl-certs/ca-cert.pem -keystore $$JAVA_HOME/lib/security/cacerts -storepass changeit -noprompt -alias wordpress-rs-test-ca
+
 .PHONY: docs # Rebuild docs each time we run this command
 docs:
 	@# Help: Generate project documentation.

Package.swift

@@ -34,6 +34,7 @@ var package = Package(
     ],
     dependencies: [
         .package(url: "https://github.com/apple/swift-docc-plugin", from: "1.0.0"),
+        .package(url: "https://github.com/jkmassel/mocktail-swift.git", branch: "main"),
     ],
     targets: [
         .target(
@@ -74,10 +75,15 @@ var package = Package(
             dependencies: [
                 .target(name: "WordPressAPI"),
                 .target(name: "WordPressApiCache"),
-                .target(name: libwordpressFFI.name)
+                .target(name: libwordpressFFI.name),
+                .product(name: "MockWebServer", package: "mocktail-swift", condition: .when(platforms: [.iOS, .macOS, .tvOS, .watchOS])),
             ],
             path: "native/swift/Tests/wordpress-api",
-            resources: [.copy("../../../../test-data/integration-test-responses/")],
+            resources: [
+                .copy("../../../../test-data/integration-test-responses/"),
+                .copy("../../../../test-data/login-mocks/"),
+                .copy("../../../../test-data/ssl-certs/"),
+            ],
             swiftSettings: [
                 .define("PROGRESS_REPORTING_ENABLED", .when(platforms: [.iOS, .macOS, .tvOS, .watchOS]))
             ]

native/kotlin/api/kotlin/build.gradle.kts

@@ -130,6 +130,9 @@ tasks.named("processIntegrationTestResources").configure {
     dependsOn(rootProject.tasks.named("copyTestCredentials"))
     dependsOn(rootProject.tasks.named("copyTestMedia"))
     dependsOn(rootProject.tasks.named("copySampleJSON"))
+    dependsOn(rootProject.tasks.named("copyTestResponses"))
+    dependsOn(rootProject.tasks.named("copyLoginMocks"))
+    dependsOn(rootProject.tasks.named("copySslCerts"))
 }
 tasks.named("sourcesJar").configure {
     dependsOn(generateUniFFIBindingsTask)