[irozum]

Summary

• Adds PHPUnit coverage for WP_REST_Comments_Controller::check_read_post_permission() using a post type's custom REST controller. Follow-up to [46272], which made the comments controller ask WP_Post_Type::get_rest_controller() for the controller.
• Test-only change: no src/ files are touched and no production behaviour is added.

Cases covered

• GET /wp/v2/comments?post=<id> returns rest_cannot_read_post (401) for an anonymous user when the custom controller's check_read_permission() denies access.
• GET /wp/v2/comments/<id> returns rest_cannot_read (401) in the same situation.
• A control test: when the custom controller allows access, the same single-comment request returns 200 with the comment. This shows the two denial tests don't pass for an unrelated reason.
• When a post type's REST controller is not a WP_REST_Posts_Controller (here WP_REST_Post_Types_Controller), the comments controller falls back to a posts controller instead of calling a missing method.

Why these cases

The existing tests only check get_rest_controller() itself. Nothing checked that the comments endpoints actually defer to a custom controller for read access, or that they fall back safely.

Verification

• Each denial test fails if the controller lookup is replaced with a plain WP_REST_Posts_Controller.
• The control test and the fallback test fail if the controller's check_read_permission() result is ignored, and the fallback test also fails if the instanceof fallback is removed.

Trac ticket: https://core.trac.wordpress.org/ticket/40383

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Planning the test cases and writing the tests.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props irozum.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.