Skip to content

Suggest mode: REST permissions and PHP coverage for note suggestions#78351

Open
adamsilverstein wants to merge 8 commits into
suggest-mode-phase-4from
phase-5a-rest-backend
Open

Suggest mode: REST permissions and PHP coverage for note suggestions#78351
adamsilverstein wants to merge 8 commits into
suggest-mode-phase-4from
phase-5a-rest-backend

Conversation

@adamsilverstein

@adamsilverstein adamsilverstein commented May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Overview

One of three replacement PRs for the now-closed #77407. This slice is the REST/PHP backend for the Suggest-mode lifecycle.

Tracking issue: #73411.

What's in this PR

  • REST permission override — lib/compat/wordpress-6.9/class-gutenberg-rest-comment-controller-6-9.php overrides update_item_permissions_check so a user with edit_post on the parent can update note comments — but only for suggestion-lifecycle fields (status limited to approved/hold, plus meta._wp_suggestion_status). Any other field falls back to core's edit_comment check.
  • Meta auth_callbacks — _wp_suggestion and _wp_suggestion_status both authorize on edit_post against the parent.
  • Payload size cap — 64 KB ceiling on the serialized _wp_suggestion payload, enforced at the controller before sanitize fires (matching the client-side pre-flight cap).
  • PHPUnit coverage — class-wp-rest-comments-controller-gutenberg-test.php: meta round-trip, editor-can-apply, contributor-cannot-apply, restricted-field pass-through, payload-size truncation.

Pure backend. No JS, no UI. Safe to merge ahead of the rest of the stack.

Test plan

npm run wp-env run cli -- --env-cwd='wp-content/plugins/gutenberg' vendor/bin/phpunit --filter=WP_Test_REST_Comments_Controller_Gutenberg
vendor/bin/phpcs lib/compat/wordpress-6.9/class-gutenberg-rest-comment-controller-6-9.php lib/compat/wordpress-6.9/block-comments.php

Manual:

  1. Editor on a post they can edit_post: PATCH /wp/v2/comments/<id> with { status: 'approved', meta: { _wp_suggestion_status: 'applied' } } — succeeds.
  2. Contributor: same PATCH — 403.
  3. PATCH with { content: 'rewritten' } — falls back to core edit_comment.
  4. PATCH with { status: 'spam' } — falls back to core edit_comment.
  5. Submit a _wp_suggestion meta payload > 64 KB — 400.

Replaces part of #77407.

🗺️ PR Stack Navigation

# PR Phase
1 #77403 Intent scaffolding Edit / Suggest / View mode
2 #77404 Overlay capture In-memory suggestion overlay
3 #77405 Provider + Accept/Reject _wp_suggestion meta, provider, sidebar actions
4 #77406 Summary + docs + attribute tests Add/Delete/Formatting summary, architecture stub, conflict scoping
5a #78351 REST permissions and PHP coverage ← this PR Permissions, payload cap, PHP tests
5b #78352 Summary + attribute conflict + docs Renderer, per-attribute staleness, architecture docs
5c #78353 Surface Apply/Reject in the collaboration sidebar Icon buttons + e2e + sidebar wiring
6 #78308 Auto-save subsystem Background debounced save (replaces commit-bar)

📋 Tracking issue: #73411

@github-actions github-actions Bot added the [Package] Editor /packages/editor label May 15, 2026
@github-actions

github-actions Bot commented May 15, 2026 •
edited
Loading

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: adamsilverstein <adamsilverstein@git.wordpress.org>
Co-authored-by: ciampo <mciampini@git.wordpress.org>
Co-authored-by: retrofox <retrofox@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

This was referenced May 15, 2026
Open
Open
Closed
Open
Open
Open
Open
Open
@adamsilverstein adamsilverstein self-assigned this May 15, 2026
@adamsilverstein adamsilverstein added [Status] In Progress Tracking issues with work in progress [Type] Feature New feature to highlight in changelogs. [Feature] Notes Phase 3 of the Gutenberg roadmap around block commenting labels May 15, 2026
@github-actions

github-actions Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Flaky tests detected in e5403ae.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/28144766166
📝 Reported issues:

@adamsilverstein adamsilverstein requested review from Mamaduka and t-hamano and removed request for spacedmonkey May 18, 2026 22:13
@adamsilverstein adamsilverstein added Backport from WordPress Core Pull request that needs to be backported to a Gutenberg release from WordPress Core [Type] Enhancement A suggestion for improvement. and removed [Status] In Progress Tracking issues with work in progress [Package] Editor /packages/editor [Type] Feature New feature to highlight in changelogs. labels May 18, 2026
@adamsilverstein adamsilverstein mentioned this pull request May 18, 2026
Open
@github-actions github-actions Bot mentioned this pull request May 19, 2026
Closed
This was referenced Jun 6, 2026
Draft
Open
@github-actions github-actions Bot added [Package] Element /packages/element [Package] Date /packages/date [Package] Data /packages/data [Package] Server Side Render /packages/server-side-render [Package] A11y /packages/a11y [Package] Autop /packages/autop [Package] DOM ready /packages/dom-ready [Package] Hooks /packages/hooks [Package] i18n /packages/i18n [Package] is-shallow-equal /packages/is-shallow-equal [Package] Url /packages/url [Package] Word count /packages/wordcount [Package] Deprecated packages/deprecated [Package] Blob /packages/blob [Package] Compose /packages/compose [Package] Core data /packages/core-data [Package] API fetch /packages/api-fetch [Package] HTML entities /packages/html-entities [Package] Viewport /packages/viewport [Package] DOM /packages/dom [Package] Keycodes /packages/keycodes [Package] Plugins /packages/plugins [Package] Components /packages/components [Package] Blocks /packages/blocks labels Jun 24, 2026
@adamsilverstein
Add 6.9/block-comments.php so the note REST test has its dependency
d74a075 
phase-5a introduces class-wp-rest-comments-controller-gutenberg-test.php,
which calls gutenberg_register_block_comment_metadata(). That function
lives in lib/compat/wordpress-6.9/block-comments.php, which was only wired
in higher up the stack (autosave), so PHP unit tests failed here with
"Call to undefined function". Relocate the self-contained file and its
require down to where the test first needs it.
@adamsilverstein
Guard setAccessible() for PHP 8.5 in the note REST controller test
7a667de 
ReflectionMethod::setAccessible() is a no-op since PHP 8.1 and emits a
deprecation in 8.5 that PHPUnit fails on. Only call it on PHP < 8.1,
matching the guard already used higher in the stack.
@adamsilverstein
Merge remote-tracking branch 'origin/suggest-mode-phase-4' into phase…
e5403ae 
…-5a-rest-backend

# Conflicts:
#	packages/editor/CHANGELOG.md
@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown

Size Change: +255 B (0%)

Total Size: 7.51 MB

📦 View Changed
Filename Size Change
build/scripts/components/index.min.js 264 kB +255 B (+0.1%)

compressed-size-action

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@t-hamano t-hamano Awaiting requested review from t-hamano
@Mamaduka Mamaduka Awaiting requested review from Mamaduka
@swissspidy swissspidy Awaiting requested review from swissspidy

Assignees

@adamsilverstein adamsilverstein

Labels

Backport from WordPress Core Pull request that needs to be backported to a Gutenberg release from WordPress Core [Feature] Notes Phase 3 of the Gutenberg roadmap around block commenting [Package] Components /packages/components [Package] Editor /packages/editor [Type] Enhancement A suggestion for improvement.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@adamsilverstein @ciampo @retrofox