[gziolo]

When an author's only published posts belong to a non-viewable post type exposed to abilities, a subscriber can confirm the author's slug through core/content-query: the query returns no items but nonzero pagination totals. An unknown slug returns zero totals.

Filter the post types used by get_visible_author() through is_post_type_viewable(), retaining the show_in_abilities requirement. This applies the viewability check used by core/users-query. Update the existing positive fixture and add a focused regression test verifying that hidden and unknown slugs both return zero totals. Existing tests cover public author names and slugs.

Follow-up to WordPress/ai#1241 and core changeset r64688. The plugin can sync this change after it lands in core.

Trac ticket: https://core.trac.wordpress.org/ticket/66268 (original implementation).

Testing

• Confirmed the new regression test fails before the fix: pagination total and total_pages are 1 instead of 0.
• npm run test:php -- --filter 'Tests_Abilities_API_WpRegisterCore(Content|Users)Ability' — 346 tests, 1574 assertions passed.
• vendor/bin/phpcs --standard=phpcs.xml.dist src/wp-includes/abilities/class-wp-abilities-content.php tests/phpunit/tests/abilities-api/wpRegisterCoreContentAbility.php — passed.
• git diff --check — passed.

Use of AI Tools

AI assistance: Yes.
Tool: OpenAI Codex.
Used for: Investigating the issue, implementing the fix and regression coverage, running validation, and drafting this PR description.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props gziolo, laurisaarni, jorgefilipecosta, sadmansakibnadvi.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[sadmansakibnadvi]

Tested on 7.2-beta3-64990 over REST as a subscriber (GET /wp-abilities/v1/abilities/core/content-query/run, input in the query string, cookie auth + nonce). The setup mirrors the new test: hidden_author_cpt registered with public => true, publicly_queryable => false, show_in_abilities => true, and an author whose only published post is in it.

where	Before	After
type: hidden_author_cpt, real author slug	0 items, total 1	0 items, total 0
type: hidden_author_cpt, made-up slug	0 items, total 0	0 items, total 0
type: post, slug of an author with a published post (control)	1 item, total 1	1 item, total 1
type: post, made-up slug (control)	0 items, total 0	0 items, total 0

Before the patch the totals tell a real slug apart from a made-up one. With the patch they look the same, and authors of viewable posts still match.

[jorgefilipecosta]

The change looks good thank you for the fix 👍

[gziolo]

@propsbot add laurisaarni

[gziolo]

@propsbot add saarnilauri
@propsbot remove laurisaarni

[gziolo]

Comitted with https://core.trac.wordpress.org/changeset/65045.