[wp-trac] [WordPress Trac] #38412: cannot update or delete user, term or comment meta via REST API

[WordPress Trac]

#38412: cannot update or delete user, term or comment meta via REST API
----------------------------------------+---------------------------
 Reporter:  tharsheblows                |       Owner:  boonebgorges
     Type:  defect (bug)                |      Status:  reviewing
 Priority:  normal                      |   Milestone:  4.7
Component:  REST API                    |     Version:  trunk
 Severity:  normal                      |  Resolution:
 Keywords:  needs-unit-tests has-patch  |     Focuses:
----------------------------------------+---------------------------

Comment (by boonebgorges):

 Thanks for the ping, and sorry for the delay.

 The general approach of the `map_meta_cap()` part of the patch looks good
 to me.

 [attachment:38412.4.diff] does the following:

 - Adds core (non-REST-API) tests for each of the new caps
 - Casts mine frugal gaze on the tests written by @tharsheblows
 - Fixes the user-meta-fields tests for multisite, where we have to dance
 around the fact that you need `manage_network_users`, but granting super-
 admin means that the metadata cap check will automatically pass
 - Some minor documentation and formatting cleanup

 I haven't spent a huge amount of time looking at the endpoint-specific
 tests. They look good at a glance, but they should have a readthrough by
 someone more familiar with the pattern of the API tests.

 One last note - I'm slightly uneasy about making so deep a change to the
 capability API at this point in the development cycle. Technically, this
 is a compat break - people are likely relying on edit_post_meta etc for
 non-post-related meta checks. Not a good situation to be sure, and
 something that very much should be fixed, but it should be carefully
 documented for public consumption. I'm OK with the change, but a signoff
 from @helen as the release lead would put my mind at ease somewhat.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/38412#comment:7>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform