[rvpatel]

Trac ticket: https://core.trac.wordpress.org/ticket/65819

Follow-up to [64875].

Summary

[64875] requires edit access to a note's post to update or delete the note, instead of the moderate_comments capability, but no test covers that check. This adds two tests to WP_Test_REST_Comments_Controller:

• a user who can moderate comments but cannot edit the note's post gets rest_cannot_edit (403) when updating the note, and the content is unchanged;
• the same user gets rest_cannot_delete (403) when deleting the note, and the note still exists.

Both tests fail if the note check added in [64875] is removed (the update and delete then succeed). No source changes.

Related: #15130 adds the equivalent coverage for reactions.

Testing

• New tests: OK on single site and multisite.
• Without the [64875] check: both new tests fail.
• WP_Test_REST_Comments_Controller: OK (286 tests).
• phpcs: no issues.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Finding the untested permission check, drafting the tests and this description. I reviewed the tests and confirmed they fail without the fix.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the WordPress Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props ravipatel.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[rvpatel]

Update: resolved — after updating the branch with trunk, all checks pass, so no re-run is needed.

The one failing job (PHP 8.3 / MariaDB 11.8 with memcached) fails in Tests_Link_GetCommentsLink::test_comments_link_deprecated_arguments: it got a plain permalink (?p=109#respond) although the test's set_up() sets /%postname%/, so the permalink structure didn't take effect in that run. This PR doesn't touch comments_link(), permalinks or that file — it only adds two note-permission tests to the REST comments controller — and the same job passes on trunk. Looks like a flaky persistent-cache case; could someone re-run it? Thanks!

[SainathPoojary]

Thanks for adding these tests!
The tests cover the intended permission check and confirm that rejected requests leave the note unchanged. Both tests fail when the note permission check is removed. The full REST comments test class passes in random order on single-site and multisite. LGTM 🚀

[Copilot]

🟢 Approval recommended

No active review issues are reported for the added note-permission regression tests.

No open issues 🎉

What changed in this PR

Adds regression coverage for the note permission checks introduced in [64875], verifying that comment moderation alone does not allow editing or deleting notes. No production code changes.

Changes:

• Adds a shared fixture creating a note and a moderator without edit access to its post.
• Tests that updating the note returns rest_cannot_edit (403) and leaves its content unchanged.
• Tests that deleting the note returns rest_cannot_delete (403) and preserves the note.

File	Description
tests/​phpunit/​tests/​rest-api/​rest-comments-controller.php	Adds a shared fixture and two note permission regression tests.

_{Review effort: Balanced}

[lancewillett]

The tests exercise the real REST permission checks and confirm rejected requests preserve the note. Both fail when the note-specific permission check is removed. The affected classes pass three randomized orders on single-site and multisite, and PHPCS passes.

_{AI review · gpt-6}

[lancewillett]

PR #15187 landed in https://core.trac.wordpress.org/changeset/65083