Comments: Make REST comment moderation comment-type aware (Trac #35214, Stage 3)

src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -167,6 +167,11 @@ public function get_items_permissions_check( $request ) {
 						array( 'status' => rest_authorization_required_code() )
 					);
 				} elseif ( 0 === $post_id && ! current_user_can( 'moderate_comments' ) ) {
+					/*
+					 * The global primitive gates the ?post=0 collection, which can mix
+					 * comment types. Orphans of an independent type are filtered out
+					 * per comment, so a type's own moderators are rejected here.
+					 */
 					return new WP_Error(
 						'rest_cannot_read',
 						__( 'Sorry, you are not allowed to read comments without a post.' ),
@@ -218,6 +223,7 @@ public function get_items_permissions_check( $request ) {
 				}
 			}
 		} elseif ( $is_edit_context && ! current_user_can( 'moderate_comments' ) ) {
+			// The global primitive gates an edit-context collection that can mix comment types.
 			return new WP_Error(
 				'rest_forbidden_context',
 				__( 'Sorry, you are not allowed to edit comments.' ),
@@ -473,6 +479,7 @@ protected function get_comment( $id ) {
 	 * Checks if a given request has access to read the comment.
 	 *
 	 * @since 4.7.0
+	 * @since 7.3.0 The edit context is gated by the `moderate_comment` meta capability.
 	 *
 	 * @param WP_REST_Request $request Full details about the request.
 	 * @return true|WP_Error True if the request has read access for the item, error object otherwise.
@@ -483,8 +490,8 @@ public function get_item_permissions_check( $request ) {
 			return $comment;
 		}
 
-		// Re-map edit context capabilities when requesting `note` or `reaction` type.
-		$edit_cap = in_array( $comment->comment_type, array( 'note', 'reaction' ), true ) ? array( 'edit_comment', $comment->comment_ID ) : array( 'moderate_comments' );
+		// Match check_edit_permission(): notes and reactions need `edit_comment`, other types `moderate_comment`.
+		$edit_cap = in_array( $comment->comment_type, array( 'note', 'reaction' ), true ) ? array( 'edit_comment', $comment->comment_ID ) : array( 'moderate_comment', $comment->comment_ID );
 		if ( ! empty( $request['context'] ) && 'edit' === $request['context'] && ! current_user_can( ...$edit_cap ) ) {
 			return new WP_Error(
 				'rest_forbidden_context',
@@ -2401,6 +2408,7 @@ protected function prefetch_reaction_summaries( $note_ids ) {
 	 * Checks if the comment can be read.
 	 *
 	 * @since 4.7.0
+	 * @since 7.3.0 Orphaned comments are gated by the `moderate_comment` meta capability.
 	 *
 	 * @param WP_Comment      $comment Comment object.
 	 * @param WP_REST_Request $request Request data to check.
@@ -2420,7 +2428,7 @@ protected function check_read_permission( $comment, $request ) {
 			return false;
 		}
 
-		if ( empty( $comment->comment_post_ID ) && ! current_user_can( 'moderate_comments' ) ) {
+		if ( empty( $comment->comment_post_ID ) && ! current_user_can( 'moderate_comment', $comment->comment_ID ) ) {
 			return false;
 		}
 
@@ -2435,6 +2443,7 @@ protected function check_read_permission( $comment, $request ) {
 	 * Checks if a comment can be edited or deleted.
 	 *
 	 * @since 4.7.0
+	 * @since 7.3.0 Moderators are checked with the `moderate_comment` meta capability.
 	 *
 	 * @param WP_Comment $comment Comment object.
 	 * @return bool Whether the comment can be edited or deleted.
@@ -2452,7 +2461,8 @@ protected function check_edit_permission( $comment ) {
 			return current_user_can( 'edit_comment', $comment->comment_ID );
 		}
 
-		if ( current_user_can( 'moderate_comments' ) ) {
+		// Resolves to the type's own moderation primitive, or `moderate_comments` for the default model.
+		if ( current_user_can( 'moderate_comment', $comment->comment_ID ) ) {
 			return true;
 		}