Throw a _doing_it_wrong() when returning an invalid value

src/alley/wp/alleyvate/features/class-prevent-framing.php

@@ -78,6 +78,18 @@ public static function filter__wp_headers( $headers ): array {
 		 */
 		$headers['X-Frame-Options'] = apply_filters( 'alleyvate_prevent_framing_x_frame_options', 'SAMEORIGIN' );
 
+		if ( ! in_array( $headers['X-Frame-Options'], [ 'DENY', 'SAMEORIGIN' ], true ) && 0 !== strpos( $headers['X-Frame-Options'], 'ALLOW-FROM' ) ) {
+			_doing_it_wrong(
+				__METHOD__,
+				\sprintf(
+					/* translators: %s: The value of the X-Frame-Options header. */
+					\esc_html__( 'Invalid value for %s. Must be DENY, SAMEORIGIN, or ALLOW-FROM uri.', 'alley' ),
+					'X-Frame-Options'
+				),
+				'2.4.0'
+			);
+		}
+
 		return $headers;
 	}
 

tests/alley/wp/alleyvate/features/test-prevent-framing.php

@@ -59,6 +59,20 @@ public function test_filter_x_frame_options_header(): void {
 		$this->get( '/' )->assertHeader( 'X-Frame-Options', 'DENY' );
 	}
 
+	/**
+	 * Test that the X-Frame-Options header can be filtered to an invalid value
+	 * while throwing a _doing_it_wrong() notice.
+	 */
+	public function test_filter_x_frame_options_invalid_header(): void {
+		$this->setExpectedIncorrectUsage( Prevent_Framing::class . '::filter__wp_headers' );
+
+		add_filter( 'alleyvate_prevent_framing_x_frame_options', fn () => 'INVALID' );
+
+		$this->feature->boot();
+
+		$this->get( '/' )->assertHeader( 'X-Frame-Options', 'INVALID' );
+	}
+
 	/**
 	 * Test that the X-Frame-Options header is not output if it already exists.
 	 */