Skip to content

Tests: Cover note edit and delete permissions for comment moderators #15187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rvpatel wants to merge 2 commits into from
Closed

Tests: Cover note edit and delete permissions for comment moderators #15187

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
910628e
Tests: Cover note edit and delete permissions for comment moderators.
rvpatel Oct 29, 2026
f411c03
Merge branch 'trunk' into 65819-note-edit-permission-tests
rvpatel Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 61 additions & 0 deletions tests/phpunit/tests/rest-api/rest-comments-controller.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5567,6 +5567,67 @@ public function test_update_note_is_still_allowed() {
$this->assertSame( 200, $response->get_status() );
}

/**
* Creates a note on a post the given moderator cannot edit.
*
* @return array{0: int, 1: int} The note ID and the ID of a user who can moderate
* comments but cannot edit the note's post.
*/
private function create_note_and_moderator_without_edit_access() {
$post_id = self::factory()->post->create( array( 'post_author' => self::$editor_id ) );
$note_id = self::factory()->comment->create(
array(
'comment_post_ID' => $post_id,
'comment_type' => 'note',
'comment_approved' => 0,
'user_id' => self::$editor_id,
'comment_content' => 'Test note',
)
);

$moderator = self::factory()->user->create_and_get( array( 'role' => 'subscriber' ) );
$moderator->add_cap( 'moderate_comments' );

$this->assertFalse( user_can( $moderator, 'edit_post', $post_id ), 'The moderator should not be able to edit the post.' );

return array( $note_id, $moderator->ID );
}

/**
* A user who can moderate comments but cannot edit the note's post cannot update the note.
*
* @ticket 65819
*/
public function test_moderator_without_edit_access_cannot_update_note() {
list( $note_id, $moderator_id ) = $this->create_note_and_moderator_without_edit_access();

wp_set_current_user( $moderator_id );
$request = new WP_REST_Request( 'PUT', '/wp/v2/comments/' . $note_id );
$request->add_header( 'Content-Type', 'application/json' );
$request->set_body( wp_json_encode( array( 'content' => 'Edited note' ) ) );
$response = rest_get_server()->dispatch( $request );

$this->assertErrorResponse( 'rest_cannot_edit', $response, 403 );
$this->assertSame( 'Test note', get_comment( $note_id )->comment_content );
}

/**
* A user who can moderate comments but cannot edit the note's post cannot delete the note.
*
* @ticket 65819
*/
public function test_moderator_without_edit_access_cannot_delete_note() {
list( $note_id, $moderator_id ) = $this->create_note_and_moderator_without_edit_access();

wp_set_current_user( $moderator_id );
$request = new WP_REST_Request( 'DELETE', '/wp/v2/comments/' . $note_id );
$request->set_param( 'force', true );
$response = rest_get_server()->dispatch( $request );

$this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
$this->assertInstanceOf( WP_Comment::class, get_comment( $note_id ) );
}

/**
* The note response exposes a `reaction_summary` field aggregating
* counts per emoji hex key, plus the current user's reaction ID as
Expand Down
Loading