Description

Hello, wp-graphql seems to not respect user capabilities for viewing private posts. We have a user with capabilities: "read_private_posts" and "read_private_pages", which are added to the user at the time of its creation, if it passes some conditions

    $user = new WP_User($user_id);
    $user->add_cap( 'read_private_posts' );
    $user->add_cap( 'read_private_pages' );

and when i try to make an authorized request as this user with a query like this

query GetPostsEdges {
  posts(where: { stati: [PUBLISH, PRIVATE]}) {
    edges {
      node {
        id
        title
        date
      }
    }
  }
}

it returns published posts but no private posts, and WPs own front-end shows them in the main loop query, without any additional modifications to the query, which indicates that the capabilities work as expected. Is this a bug, or i missing something?

Steps to reproduce

This is how we add the capabilities

add_action('profile_update', 'set_capabilities', 10, 3);

function set_capabilities($user_id, $oldUserData, $newUserData)
{
    $categories = get_field('cats', 'user_' . $user_id);

    if ($categories) {
        $user = new WP_User($user_id);

        $user->add_cap( 'read_private_posts' );
        $user->add_cap( 'read_private_pages' );

        foreach ($categories as $category) {

            $user->add_cap('read_private_custom_' . $category->slug);
        }
    }
}

Additional context

No response

WPGraphQL Version

1.14.7

WordPress Version

6.2.2

PHP Version

7.4.26

Additional enviornment details

WPGraphQL JWT Authentication 0.7.0 - plugin is active

Please confirm that you have searched existing issues in the repo.

• Yes

Please confirm that you have disabled ALL plugins except for WPGraphQL.

• Yes
• My issue is with compatibility with a specific WordPress plugin, and I have listed all my installed plugins (and version info) above.