Skip to content

feat: Allow view access of navigation REST endpoint to anyone with edit_post capability.#69794

Closed
coder-rancho wants to merge 2 commits intoWordPress:trunkfrom
coder-rancho:feat/change-post-rest-controller-to-allow-view-access-of-navigation
Closed

feat: Allow view access of navigation REST endpoint to anyone with edit_post capability.#69794
coder-rancho wants to merge 2 commits intoWordPress:trunkfrom
coder-rancho:feat/change-post-rest-controller-to-allow-view-access-of-navigation

Conversation

@coder-rancho
Copy link
Copy Markdown

What?

Part of #60809, inspired from #60317

Modify the navigation rest endpoint to allow any user role with the edit_post capability to view entities.

Why?

In order to render the navigation block in the locked template preview inside the post editor we need to be able to fetch the contents of any navigation block for any user role that can edit a post.

How?

Overwriting the get_items_permissions_check and get_item_permissions_check methods of the rest_controller_class of the wp_navigation post type to check whether the current user can edit_posts.

Testing Instructions

Testing Instructions for Keyboard

Try making an authenticated rest request to the navigation rest endpoint with any user role that has the edit_post capability. -> The navigation should get returned
Try making an unauthenticated request and still get an unauthorized error.

Note: Make sure to include ?context=edit query param.

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 2, 2025

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @jonnynews.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: jonnynews.

Co-authored-by: coder-rancho <vyasnaman@git.wordpress.org>
Co-authored-by: spacedmonkey <spacedmonkey@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@github-actions github-actions bot added the First-time Contributor Pull request opened by a first-time contributor to Gutenberg repository label Apr 2, 2025
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 2, 2025

👋 Thanks for your first Pull Request and for helping build the future of Gutenberg and WordPress, @coder-rancho! In case you missed it, we'd love to have you join us in our Slack community.

If you want to learn more about WordPress development in general, check out the Core Handbook full of helpful information.

@Mamaduka Mamaduka added [Type] Enhancement A suggestion for improvement. [Block] Navigation Affects the Navigation Block labels Apr 2, 2025
@Mamaduka
Copy link
Copy Markdown
Member

Mamaduka commented Apr 3, 2025

Thanks for contributing, @coder-rancho!

I don't think there's a need to copy the solution from #60317 for the Navigation block. Instead, we should modify the capabilities definition for this post type. See register_post_type.

P.S. The Correct folder for this enhancement would be compat/wordpress-6.9.

@coder-rancho
Copy link
Copy Markdown
Author

Thanks for the suggestion @Mamaduka. But I still think we need this implementation because get_item_permissions_check checks whether the user has update permission.

We cannot allow Editor to update wp_navigation and hence this patch is required. I can however move the implementation to compat/wordpress-6.9

@Mamaduka
Copy link
Copy Markdown
Member

Mamaduka commented Apr 3, 2025

I still think we need this implementation because get_item_permissions_check checks whether the user has update permission.

We should experiment and see if we can request a Navigation item in view context when a user can't edit it. Hardcoding special cases for post type in the general controller probably goes against REST API component best practices.

cc @spacedmonkey, @TimothyBJacobs

@coder-rancho
Copy link
Copy Markdown
Author

coder-rancho commented Apr 3, 2025

We should experiment and see if we can request a Navigation item in view context when a user can't edit it.

Setting the context as view inside block editor may cause regression issues with existing APIs. wdyt?

@Mamaduka
Copy link
Copy Markdown
Member

Mamaduka commented Apr 3, 2025

We'll have to re-arrange how the Navigation blocks edit component is rendered, but technically, it should be doable. That's one of the reasons I suggested combining PRs (#69806 (comment)).

If we go to the post type capabilities route, PHP changes should be minimal, so there's no reason to split PRs, and that would make it easier to test.

@coder-rancho
Copy link
Copy Markdown
Author

Alright, I'll spend some time to figure it out.

Copy link
Copy Markdown
Member

@spacedmonkey spacedmonkey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure about this change. This could be seen as leaking information. Can you provide more context on why this is needed?

@Mamaduka
Copy link
Copy Markdown
Member

Mamaduka commented Apr 4, 2025

@spacedmonkey, the associated issue explains this: #60809. tl;dr; Editor needs to render, non-editable Navigation block for low-cap users, currently requests will fail and block will display "Missing navigation" message.

@coder-rancho
Copy link
Copy Markdown
Author

We'll have to re-arrange how the Navigation blocks edit component is rendered, but technically, it should be doable.

I researched about the above suggestion. Some of the important points to note:

  1. We need to change three files:
    1.1. edit/index.js: This file is the entry point and render the NavigationInnerBlocks component based on conditions fetched using useNavigationMenu hook.
    1.2 use-navigation-menu.js: Define useNavigationMenu hook.
    1.3 edit/inner-blocks.js: Define NavigationInnerBlocks component.
  2. At most places we're using useEntityBlockEditor to fetch list of blocks.
  3. I thought, we can replace useEntityBlockEditor with getEntityRecord as follows:
    3.1 Fetch the record using getEntityRecord with { context: 'view' } argument.
    3.2 Use parse(record.content) function to get list of blocks.

My assumption was partially correct but when we set { context: 'view' }, we get the rendered content. But when we set { context: 'edit' }, we get raw content. The parse function expects the block markup (i.e. raw content).

Hence, even if we want to go this way, we have to hardcode some conditions in REST APIs.

@jonnynews
Copy link
Copy Markdown
Contributor

jonnynews commented Apr 7, 2025

Can we limit this to just context=view then?

@spacedmonkey, the associated issue explains this: #60809. tl;dr; Editor needs to render, non-editable Navigation block for low-cap users, currently requests will fail and block will display "Missing navigation" message.

@coder-rancho
Copy link
Copy Markdown
Author

Can we limit this to just context=view then?

@jonnynews, we need the block markup which is available only with context=edit. see this comment

@Mamaduka
Copy link
Copy Markdown
Member

Mamaduka commented Apr 8, 2025

@coder-rancho, let's merge/combine #69806 into this one. Otherwise, it would be hard to test these changes. The suggestion (#58301 (comment)) was valid for that case, but I don't think it applies here.

Once combined, please update the PR description accordingly 🙇

Regarding the REST API, I think we should try to introduce minimal changes only (or primarily) for the wp_navigation post type capabilities.

@coder-rancho coder-rancho deleted the feat/change-post-rest-controller-to-allow-view-access-of-navigation branch April 8, 2025 12:40
@coder-rancho
Copy link
Copy Markdown
Author

@Mamaduka , I've merged the branches into #69855.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

[Block] Navigation Affects the Navigation Block First-time Contributor Pull request opened by a first-time contributor to Gutenberg repository [Type] Enhancement A suggestion for improvement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants