Automattic / Automattic/jetpack
JSON API: Private metadata not available for authenticated user
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
Per https://developer.wordpress.com/2013/04/26/custom-post-type-and-metadata-support-in-the-rest-api/ , private metadata should be available when requested by an authenticated user with rights to edit the post. This appears to not be happening.
Steps to reproduce:
0. Have a post with private meta data (e.g. `_private_meta_key`).
1. Via the https://developer.wordpress.com/console/ while logged into the wpcom user that owns the JP connection and is the author of the post (thus no question has the cap), query `/v1.1/sites/$site//posts/$ID`
Expected: The metadata array includes `_private_meta_key`.
Actual: It does not.
Further testing, if the key is specifically whitelisted by `rest_api_allowed_public_metadata`, it is included (expected), so my first thought is https://github.com/Automattic/jetpack/blob/3.8.0/json-endpoints/class.wpcom-json-api-post-endpoint.php#L448 is failing.
Contributor guide
Research direction
Start in json-endpoints/class.wpcom-json-api-post-endpoint.php around line 448, then reproduce the authenticated request described through the WordPress.com console. Confirm that an authenticated user with rights to edit the post receives the private metadata key, while the existing whitelist behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- api, authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100