Ticket #38412: 38412.4.diff

src/wp-includes/capabilities.php

@@ -242 +242 @@
         case 'edit_post_meta':
         case 'delete_post_meta':
         case 'add_post_meta':
-                $post = get_post( $args[0] );
-                if ( ! $post ) {
+        case 'edit_comment_meta':
+        case 'delete_comment_meta':
+        case 'add_comment_meta':
+        case 'edit_term_meta':
+        case 'delete_term_meta':
+        case 'add_term_meta':
+        case 'edit_user_meta':
+        case 'delete_user_meta':
+        case 'add_user_meta':
+                list( $_, $object_type, $_ ) = explode( '_', $cap );
+                $object_id = (int) $args[0];
+
+                switch ( $object_type ) {
+                        case 'post':
+                                $post = get_post( $object_id );
+                                if ( ! $post ) {
+                                        break;
+                                }
+
+                                $sub_type = get_post_type( $post );
+                                break;
+
+                        case 'comment':
+                                $comment = get_comment( $object_id );
+                                if ( ! $comment ) {
+                                        break;
+                                }
+
+                                $sub_type = empty( $comment->comment_type ) ? 'comment' : $comment->comment_type;
+                                break;
+
+                        case 'term':
+                                $term = get_term( $object_id );
+                                if ( ! $term ) {
+                                        break;
+                                }
+
+                                $sub_type = $term->taxonomy;
+                                break;
+
+                        case 'user':
+                                $user = get_user_by( 'id', $object_id );
+                                if ( ! $user ) {
+                                        break;
+                                }
+
+                                $sub_type = 'user';
+                                break;
+                }
+
+                if ( empty( $sub_type ) ) {
                         $caps[] = 'do_not_allow';
                         break;
                 }
 
-                $post_type = get_post_type( $post );
+                $caps = map_meta_cap( "edit_{$object_type}", $user_id, $object_id );
 
-                $caps = map_meta_cap( 'edit_post', $user_id, $post->ID );
+                $meta_key = isset( $args[1] ) ? $args[1] : false;
 
-                $meta_key = isset( $args[ 1 ] ) ? $args[ 1 ] : false;
+                $has_filter = has_filter( "auth_{$object_type}_meta_{$meta_key}" ) || has_filter( "auth_{$object_type}_{$sub_type}_meta_{$meta_key}" );
+                if ( $meta_key && $has_filter ) {
+                        /** This filter is documented in wp-includes/meta.php */
+                        $allowed = apply_filters( "auth_{$object_type}_meta_{$meta_key}", false, $meta_key, $object_id, $user_id, $cap, $caps );
 
-                if ( $meta_key && ( has_filter( "auth_post_meta_{$meta_key}" ) || has_filter( "auth_post_{$post_type}_meta_{$meta_key}" ) ) ) {
-                        /**
-                         * Filters whether the user is allowed to add post meta to a post.
-                         *
-                         * The dynamic portion of the hook name, `$meta_key`, refers to the
-                         * meta key passed to map_meta_cap().
-                         *
-                         * @since 3.3.0
-                         *
-                         * @param bool   $allowed  Whether the user can add the post meta. Default false.
-                         * @param string $meta_key The meta key.
-                         * @param int    $post_id  Post ID.
-                         * @param int    $user_id  User ID.
-                         * @param string $cap      Capability name.
-                         * @param array  $caps     User capabilities.
-                         */
-                        $allowed = apply_filters( "auth_post_meta_{$meta_key}", false, $meta_key, $post->ID, $user_id, $cap, $caps );
+                        /** This filter is documented in wp-includes/meta.php */
+                        $allowed = apply_filters( "auth_{$object_type}_{$sub_type}_meta_{$meta_key}", $allowed, $meta_key, $object_id, $user_id, $cap, $caps );
 
-                        /**
-                         * Filters whether the user is allowed to add post meta to a post of a given type.
-                         *
-                         * The dynamic portions of the hook name, `$meta_key` and `$post_type`,
-                         * refer to the meta key passed to map_meta_cap() and the post type, respectively.
-                         *
-                         * @since 4.6.0
-                         *
-                         * @param bool   $allowed  Whether the user can add the post meta. Default false.
-                         * @param string $meta_key The meta key.
-                         * @param int    $post_id  Post ID.
-                         * @param int    $user_id  User ID.
-                         * @param string $cap      Capability name.
-                         * @param array  $caps     User capabilities.
-                         */
-                        $allowed = apply_filters( "auth_post_{$post_type}_meta_{$meta_key}", $allowed, $meta_key, $post->ID, $user_id, $cap, $caps );
-
-                        if ( ! $allowed )
+                        if ( ! $allowed ) {
                                 $caps[] = $cap;
-                } elseif ( $meta_key && is_protected_meta( $meta_key, 'post' ) ) {
+                        }
+                } elseif ( $meta_key && is_protected_meta( $meta_key, $object_type ) ) {
                         $caps[] = $cap;
                 }
                 break;

src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -631 +631 @@
                         if ( ! $change ) {
                                 return new WP_Error( 'rest_comment_failed_edit', __( 'Updating comment status failed.' ), array( 'status' => 500 ) );
                         }
-                } else {
+                } elseif ( ! empty( $prepared_args ) ) {
                         if ( is_wp_error( $prepared_args ) ) {
                                 return $prepared_args;
                         }

src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php

@@ -122 +122 @@
          */
         public function update_value( $request, $object_id ) {
                 $fields = $this->get_registered_fields();
-
                 foreach ( $fields as $name => $args ) {
                         if ( ! array_key_exists( $name, $request ) ) {
                                 continue;
@@ -159 +158 @@
          * @return bool|WP_Error True if meta field is deleted, WP_Error otherwise.
          */
         protected function delete_meta_value( $object_id, $name ) {
-                if ( ! current_user_can( 'delete_post_meta', $object_id, $name ) ) {
+                $meta_type = $this->get_meta_type();
+                if ( ! current_user_can( "delete_{$meta_type}_meta", $object_id, $name ) ) {
                         return new WP_Error(
                                 'rest_cannot_delete',
                                 sprintf( __( 'You do not have permission to edit the %s custom field.' ), $name ),
@@ -167 +167 @@
                         );
                 }
 
-                if ( ! delete_metadata( $this->get_meta_type(), $object_id, wp_slash( $name ) ) ) {
+                if ( ! delete_metadata( $meta_type, $object_id, wp_slash( $name ) ) ) {
                         return new WP_Error(
                                 'rest_meta_database_error',
                                 __( 'Could not delete meta value from database.' ),
@@ -192 +192 @@
          * @return bool|WP_Error True if meta fields are updated, WP_Error otherwise.
          */
         protected function update_multi_meta_value( $object_id, $name, $values ) {
-                if ( ! current_user_can( 'edit_post_meta', $object_id, $name ) ) {
+                $meta_type = $this->get_meta_type();
+                if ( ! current_user_can( "edit_{$meta_type}_meta", $object_id, $name ) ) {
                         return new WP_Error(
                                 'rest_cannot_update',
                                 sprintf( __( 'You do not have permission to edit the %s custom field.' ), $name ),
@@ -200 +201 @@
                         );
                 }
 
-                $current = get_metadata( $this->get_meta_type(), $object_id, $name, false );
+                $current = get_metadata( $meta_type, $object_id, $name, false );
 
                 $to_remove = $current;
                 $to_add    = $values;
@@ -227 +228 @@
                 $to_remove = array_unique( $to_remove );
 
                 foreach ( $to_remove as $value ) {
-                        if ( ! delete_metadata( $this->get_meta_type(), $object_id, wp_slash( $name ), wp_slash( $value ) ) ) {
+                        if ( ! delete_metadata( $meta_type, $object_id, wp_slash( $name ), wp_slash( $value ) ) ) {
                                 return new WP_Error(
                                         'rest_meta_database_error',
                                         __( 'Could not update meta value in database.' ),
@@ -237 +238 @@
                 }
 
                 foreach ( $to_add as $value ) {
-                        if ( ! add_metadata( $this->get_meta_type(), $object_id, wp_slash( $name ), wp_slash( $value ) ) ) {
+                        if ( ! add_metadata( $meta_type, $object_id, wp_slash( $name ), wp_slash( $value ) ) ) {
                                 return new WP_Error(
                                         'rest_meta_database_error',
                                         __( 'Could not update meta value in database.' ),
@@ -261 +262 @@
          * @return bool|WP_Error True if the meta field was updated, WP_Error otherwise.
          */
         protected function update_meta_value( $object_id, $name, $value ) {
-                if ( ! current_user_can( 'edit_post_meta', $object_id, $name ) ) {
+                $meta_type = $this->get_meta_type();
+                if ( ! current_user_can(  "edit_{$meta_type}_meta", $object_id, $name ) ) {
                         return new WP_Error(
                                 'rest_cannot_update',
                                 sprintf( __( 'You do not have permission to edit the %s custom field.' ), $name ),
@@ -269 +271 @@
                         );
                 }
 
-                $meta_type  = $this->get_meta_type();
                 $meta_key   = wp_slash( $name );
                 $meta_value = wp_slash( $value );
 

new file tests/phpunit/tests/comment/capabilities.php

@@ +1 @@
+<?php
+
+/**
+ * @group comment
+ * @group capabilities
+ */
+
+class Tests_Comment_Capabilities extends WP_UnitTestCase {
+        protected static $admin;
+        protected static $u1;
+        protected static $u2;
+        protected static $post_id;
+        protected static $comment_id;
+
+        public static function wpSetUpBeforeClass( $factory ) {
+                self::$admin = $factory->user->create( array( 'role' => 'administrator' ) );
+                self::$u1 = $factory->user->create( array( 'role' => 'author' ) );
+                self::$u2 = $factory->user->create( array( 'role' => 'author' ) );
+
+                self::$post_id = $factory->post->create( array( 'post_author' => self::$u1 ) );
+                self::$comment_id = $factory->comment->create( array( 'comment_post_ID' => self::$post_id ) );
+        }
+
+        public static function wpTearDownAfterClass() {
+                self::delete_user( self::$u1 );
+                self::delete_user( self::$u2 );
+                self::delete_user( self::$admin );
+
+                wp_delete_post( self::$post_id, true );
+                wp_delete_comment( self::$comment_id, true );
+        }
+
+        public function test_no_one_can_edit_comment_meta_for_non_existent_comment() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'edit_comment_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_edit_comment_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'edit_comment_meta', self::$comment_id, 'foo' ) );
+        }
+
+        public function test_user_cannot_edit_comment_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'edit_comment_meta', self::$comment_id, 'foo' ) );
+        }
+
+        public function test_no_one_can_delete_comment_meta_for_non_existent_comment() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'delete_comment_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_delete_comment_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'delete_comment_meta', self::$comment_id, 'foo' ) );
+        }
+
+        public function test_user_cannot_delete_comment_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'delete_comment_meta', self::$comment_id, 'foo' ) );
+        }
+
+        public function test_no_one_can_add_comment_meta_for_non_existent_comment() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'add_comment_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_add_comment_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'add_comment_meta', self::$comment_id, 'foo' ) );
+        }
+
+        public function test_user_cannot_add_comment_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'add_comment_meta', self::$comment_id, 'foo' ) );
+        }
+}

new file tests/phpunit/tests/post/capabilities.php

@@ +1 @@
+<?php
+
+/**
+ * @group post
+ * @group capabilities
+ */
+
+class Tests_Post_Capabilities extends WP_UnitTestCase {
+        protected static $admin;
+        protected static $u1;
+        protected static $u2;
+        protected static $post_id;
+
+        public static function wpSetUpBeforeClass( $factory ) {
+                self::$admin = $factory->user->create( array( 'role' => 'administrator' ) );
+                self::$u1 = $factory->user->create( array( 'role' => 'author' ) );
+                self::$u2 = $factory->user->create( array( 'role' => 'author' ) );
+
+                self::$post_id = $factory->post->create( array( 'post_author' => self::$u1 ) );
+        }
+
+        public static function wpTearDownAfterClass() {
+                self::delete_user( self::$u1 );
+                self::delete_user( self::$u2 );
+                self::delete_user( self::$admin );
+
+                wp_delete_post( self::$post_id, true );
+        }
+
+        public function test_no_one_can_edit_post_meta_for_non_existent_post() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'edit_post_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_edit_post_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'edit_post_meta', self::$post_id, 'foo' ) );
+        }
+
+        public function test_user_cannot_edit_post_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'edit_post_meta', self::$post_id, 'foo' ) );
+        }
+
+        public function test_no_one_can_delete_post_meta_for_non_existent_post() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'delete_post_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_delete_post_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'delete_post_meta', self::$post_id, 'foo' ) );
+        }
+
+        public function test_user_cannot_delete_post_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'delete_post_meta', self::$post_id, 'foo' ) );
+        }
+
+        public function test_no_one_can_add_post_meta_for_non_existent_post() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'add_post_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_add_post_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'add_post_meta', self::$post_id, 'foo' ) );
+        }
+
+        public function test_user_cannot_add_post_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'add_post_meta', self::$post_id, 'foo' ) );
+        }
+}

new file tests/phpunit/tests/rest-api/rest-comment-meta-fields.php

@@ +1 @@
+<?php
+/**
+ * Unit tests covering WP_REST_Posts meta functionality.
+ *
+ * @package WordPress
+ * @subpackage REST API
+ */
+
+ /**
+  * @group restapi
+  */
+class WP_Test_REST_Comment_Meta_Fields extends WP_Test_REST_TestCase {
+        protected static $editor_id;
+        protected static $post_id;
+        protected static $comment_id;
+
+        public static function wpSetUpBeforeClass( $factory ) {
+                // Ensure we have write permission.
+                self::$editor_id = $factory->user->create( array(
+                        'role' => 'editor',
+                ) );
+                self::$post_id = $factory->post->create();
+                self::$comment_id = $factory->comment->create_post_comments( self::$post_id, 1 )[0];
+        }
+
+        public static function wpTearDownAfterClass() {
+                wp_delete_comment( self::$comment_id );
+                wp_delete_post( self::$post_id );
+        }
+
+        public function setUp() {
+                parent::setUp();
+
+                register_meta( 'comment', 'test_single', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                ));
+                register_meta( 'comment', 'test_multi', array(
+                        'show_in_rest' => true,
+                        'single' => false,
+                ));
+                register_meta( 'comment', 'test_bad_auth', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'auth_callback' => '__return_false',
+                ));
+                register_meta( 'comment', 'test_bad_auth_multi', array(
+                        'show_in_rest' => true,
+                        'single' => false,
+                        'auth_callback' => '__return_false',
+                ));
+                register_meta( 'comment', 'test_no_rest', array() );
+                register_meta( 'comment', 'test_rest_disabled', array(
+                        'show_in_rest' => false,
+                ));
+                register_meta( 'comment', 'test_custom_schema', array(
+                        'single' => true,
+                        'type' => 'integer',
+                        'show_in_rest' => array(
+                                'schema' => array(
+                                        'type' => 'number',
+                                ),
+                        ),
+                ));
+                register_meta( 'comment', 'test_invalid_type', array(
+                        'single' => true,
+                        'type' => false,
+                        'show_in_rest' => true,
+                ));
+
+                /** @var WP_REST_Server $wp_rest_server */
+                global $wp_rest_server;
+                $this->server = $wp_rest_server = new Spy_REST_Server;
+                do_action( 'rest_api_init' );
+        }
+
+        public function test_get_value() {
+                add_comment_meta( self::$comment_id, 'test_single', 'testvalue' );
+
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $this->assertArrayHasKey( 'meta', $data );
+
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'testvalue', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_multi_value() {
+                add_comment_meta( self::$comment_id, 'test_multi', 'value1' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_multi', $meta );
+                $this->assertInternalType( 'array', $meta['test_multi'] );
+                $this->assertContains( 'value1', $meta['test_multi'] );
+
+                // Check after an update.
+                add_comment_meta( self::$comment_id, 'test_multi', 'value2' );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertContains( 'value1', $meta['test_multi'] );
+                $this->assertContains( 'value2', $meta['test_multi'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_unregistered() {
+                add_comment_meta( self::$comment_id, 'test_unregistered', 'value1' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_unregistered', $meta );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_no_api_access() {
+                add_comment_meta( self::$comment_id, 'test_no_rest', 'for_the_wicked' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_no_rest', $meta );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_api_disabled() {
+                add_comment_meta( self::$comment_id, 'test_rest_disabled', 'sleepless_nights' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_rest_disabled', $meta );
+        }
+
+        public function test_get_value_types() {
+                register_meta( 'comment', 'test_string', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'string',
+                ));
+                register_meta( 'comment', 'test_number', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'number',
+                ));
+                register_meta( 'comment', 'test_bool', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'boolean',
+                ));
+
+                /** @var WP_REST_Server $wp_rest_server */
+                global $wp_rest_server;
+                $this->server = $wp_rest_server = new Spy_REST_Server;
+                do_action( 'rest_api_init' );
+
+                add_comment_meta( self::$comment_id, 'test_string', 42 );
+                add_comment_meta( self::$comment_id, 'test_number', '42' );
+                add_comment_meta( self::$comment_id, 'test_bool', 1 );
+
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+
+                $this->assertArrayHasKey( 'test_string', $meta );
+                $this->assertInternalType( 'string', $meta['test_string'] );
+                $this->assertSame( '42', $meta['test_string'] );
+
+                $this->assertArrayHasKey( 'test_number', $meta );
+                $this->assertInternalType( 'float', $meta['test_number'] );
+                $this->assertSame( 42.0, $meta['test_number'] );
+
+                $this->assertArrayHasKey( 'test_bool', $meta );
+                $this->assertInternalType( 'boolean', $meta['test_bool'] );
+                $this->assertSame( true, $meta['test_bool'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_set_value() {
+                // Ensure no data exists currently.
+                $values = get_comment_meta( self::$comment_id, 'test_single', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_single', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 1, $meta );
+                $this->assertEquals( 'test_value', $meta[0] );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'test_value', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_set_duplicate_single_value() {
+                // Start with an existing metakey and value.
+                $values = update_comment_meta( self::$comment_id, 'test_single', 'test_value' );
+                $this->assertEquals( 'test_value', get_comment_meta( self::$comment_id, 'test_single', true ) );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_single', true );
+                $this->assertNotEmpty( $meta );
+                $this->assertEquals( 'test_value', $meta );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'test_value', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_unauthenticated() {
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( 0 );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit', $response, 401 );
+
+                // Check that the value wasn't actually updated.
+                $this->assertEmpty( get_comment_meta( self::$comment_id, 'test_single', false ) );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_blocked() {
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( self::$editor_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 403 );
+                $this->assertEmpty( get_comment_meta( self::$comment_id, 'test_bad_auth', false ) );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_db_error() {
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( self::$editor_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_insert_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_insert_query' ) );
+                $wpdb->show_errors = true;
+        }
+
+        public function test_set_value_multiple() {
+                // Ensure no data exists currently.
+                $values = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 1, $meta );
+                $this->assertEquals( 'val1', $meta[0] );
+
+                // Add another value.
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1', 'val2' ),
+                        ),
+                );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 2, $meta );
+                $this->assertContains( 'val1', $meta );
+                $this->assertContains( 'val2', $meta );
+        }
+
+        /**
+         * Test removing only one item with duplicate items.
+         */
+        public function test_set_value_remove_one() {
+                add_comment_meta( self::$comment_id, 'test_multi', 'c' );
+                add_comment_meta( self::$comment_id, 'test_multi', 'n' );
+                add_comment_meta( self::$comment_id, 'test_multi', 'n' );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'c', 'n' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 2, $meta );
+                $this->assertContains( 'c', $meta );
+                $this->assertContains( 'n', $meta );
+        }
+
+        /**
+         * @depends test_set_value_multiple
+         */
+        public function test_set_value_multiple_unauthenticated() {
+                // Ensure no data exists currently.
+                $values = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( 0 );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit', $response, 401 );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertEmpty( $meta );
+        }
+
+        /**
+         * @depends test_set_value_multiple
+         */
+        public function test_set_value_multiple_blocked() {
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth_multi' => array( 'test_value' ),
+                        ),
+                );
+
+                wp_set_current_user( self::$editor_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 403 );
+                $this->assertEmpty( get_comment_meta( self::$comment_id, 'test_bad_auth_multi', false ) );
+        }
+
+        public function test_add_multi_value_db_error() {
+                // Ensure no data exists currently.
+                $values = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_insert_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_insert_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_remove_multi_value_db_error() {
+                add_comment_meta( self::$comment_id, 'test_multi', 'val1' );
+                $values = get_comment_meta( self::$comment_id, 'test_multi', false );
+                $this->assertEquals( array( 'val1' ), $values );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array(),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_delete_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_delete_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_delete_value() {
+                add_comment_meta( self::$comment_id, 'test_single', 'val1' );
+                $current = get_comment_meta( self::$comment_id, 'test_single', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_single', false );
+                $this->assertEmpty( $meta );
+        }
+
+        /**
+         * @depends test_delete_value
+         */
+        public function test_delete_value_blocked() {
+                add_comment_meta( self::$comment_id, 'test_bad_auth', 'val1' );
+                $current = get_comment_meta( self::$comment_id, 'test_bad_auth', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+
+                $meta = get_comment_meta( self::$comment_id, 'test_bad_auth', true );
+                $this->assertEquals( 'val1', $meta );
+        }
+
+        /**
+         * @depends test_delete_value
+         */
+        public function test_delete_value_db_error() {
+                add_comment_meta( self::$comment_id, 'test_single', 'val1' );
+                $current = get_comment_meta( self::$comment_id, 'test_single', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$editor_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $request->set_body_params( $data );
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_delete_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_delete_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_get_schema() {
+                $request = new WP_REST_Request( 'OPTIONS', sprintf( '/wp/v2/comments/%d', self::$comment_id ) );
+                $response = $this->server->dispatch( $request );
+
+                $data = $response->get_data();
+                $schema = $data['schema'];
+
+                $this->assertArrayHasKey( 'meta', $schema['properties'] );
+                $meta_schema = $schema['properties']['meta']['properties'];
+
+                $this->assertArrayHasKey( 'test_single', $meta_schema );
+                $this->assertEquals( 'string', $meta_schema['test_single']['type'] );
+
+                $this->assertArrayHasKey( 'test_multi', $meta_schema );
+                $this->assertEquals( 'array', $meta_schema['test_multi']['type'] );
+                $this->assertArrayHasKey( 'items', $meta_schema['test_multi'] );
+                $this->assertEquals( 'string', $meta_schema['test_multi']['items']['type'] );
+
+                $this->assertArrayHasKey( 'test_custom_schema', $meta_schema );
+                $this->assertEquals( 'number', $meta_schema['test_custom_schema']['type'] );
+
+                $this->assertArrayNotHasKey( 'test_no_rest', $meta_schema );
+                $this->assertArrayNotHasKey( 'test_rest_disabled', $meta_schema );
+                $this->assertArrayNotHasKey( 'test_invalid_type', $meta_schema );
+        }
+
+        /**
+         * Internal function used to disable an insert query which
+         * will trigger a wpdb error for testing purposes.
+         */
+        public function error_insert_query( $query ) {
+                if ( strpos( $query, 'INSERT' ) === 0 ) {
+                        $query = '],';
+                }
+                return $query;
+        }
+
+        /**
+         * Internal function used to disable an insert query which
+         * will trigger a wpdb error for testing purposes.
+         */
+        public function error_delete_query( $query ) {
+                if ( strpos( $query, 'DELETE' ) === 0 ) {
+                        $query = '],';
+                }
+                return $query;
+        }
+}

new file tests/phpunit/tests/rest-api/rest-term-meta-fields.php

@@ +1 @@
+<?php
+/**
+ * Unit tests covering WP_REST_Taxonomies terms meta functionality.
+ *
+ * @package WordPress
+ * @subpackage REST API
+ */
+
+ /**
+  * @group restapi
+  */
+class WP_Test_REST_Term_Meta_Fields extends WP_Test_REST_TestCase {
+        protected static $administrator_id;
+        protected static $term_id;
+
+        public static function wpSetUpBeforeClass( $factory ) {
+                self::$administrator_id = $factory->user->create( array(
+                        'role' => 'administrator',
+                ) );
+
+                register_taxonomy( 'wptests_tax', 'post', array( 'show_in_rest' => true ) );
+                self::$term_id = $factory->term->create( array( 'taxonomy' => 'wptests_tax' ) );
+        }
+
+        public function setUp() {
+                parent::setUp();
+
+                register_meta( 'term', 'test_single', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                ) );
+                register_meta( 'term', 'test_multi', array(
+                        'show_in_rest' => true,
+                        'single' => false,
+                ) );
+                register_meta( 'term', 'test_bad_auth', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'auth_callback' => '__return_false',
+                ) );
+                register_meta( 'term', 'test_bad_auth_multi', array(
+                        'show_in_rest' => true,
+                        'single' => false,
+                        'auth_callback' => '__return_false',
+                ) );
+                register_meta( 'term', 'test_no_rest', array() );
+                register_meta( 'term', 'test_rest_disabled', array(
+                        'show_in_rest' => false,
+                ) );
+                register_meta( 'term', 'test_custom_schema', array(
+                        'single' => true,
+                        'type' => 'integer',
+                        'show_in_rest' => array(
+                                'schema' => array(
+                                        'type' => 'number',
+                                ),
+                        ),
+                ) );
+                register_meta( 'term', 'test_invalid_type', array(
+                        'single' => true,
+                        'type' => false,
+                        'show_in_rest' => true,
+                ) );
+
+                /** @var WP_REST_Server $wp_rest_server */
+                global $wp_rest_server;
+                $this->server = $wp_rest_server = new Spy_REST_Server;
+                do_action( 'rest_api_init' );
+
+                register_taxonomy( 'wptests_tax', 'post', array( 'show_in_rest' => true ) );
+                $controller = new WP_REST_Terms_Controller( 'wptests_tax' );
+                $controller->register_routes();
+        }
+
+        public function test_get_value() {
+                add_term_meta( self::$term_id, 'test_single', 'testvalue' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+
+                $response = $this->server->dispatch( $request );
+
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $this->assertArrayHasKey( 'meta', $data );
+
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'testvalue', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_multi_value() {
+                add_term_meta( self::$term_id, 'test_multi', 'value1' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_multi', $meta );
+                $this->assertInternalType( 'array', $meta['test_multi'] );
+                $this->assertContains( 'value1', $meta['test_multi'] );
+
+                // Check after an update.
+                add_term_meta( self::$term_id, 'test_multi', 'value2' );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertContains( 'value1', $meta['test_multi'] );
+                $this->assertContains( 'value2', $meta['test_multi'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_unregistered() {
+                add_term_meta( self::$term_id, 'test_unregistered', 'value1' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_unregistered', $meta );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_no_api_access() {
+                add_term_meta( self::$term_id, 'test_no_rest', 'for_the_wicked' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_no_rest', $meta );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_api_disabled() {
+                add_term_meta( self::$term_id, 'test_rest_disabled', 'sleepless_nights' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_rest_disabled', $meta );
+        }
+
+        public function test_get_value_types() {
+                register_meta( 'term', 'test_string', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'string',
+                ));
+                register_meta( 'term', 'test_number', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'number',
+                ));
+                register_meta( 'term', 'test_bool', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'boolean',
+                ));
+
+                /** @var WP_REST_Server $wp_rest_server */
+                global $wp_rest_server;
+                $this->server = $wp_rest_server = new Spy_REST_Server;
+                do_action( 'rest_api_init' );
+
+                add_term_meta( self::$term_id, 'test_string', 42 );
+                add_term_meta( self::$term_id, 'test_number', '42' );
+                add_term_meta( self::$term_id, 'test_bool', 1 );
+
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+
+                $this->assertArrayHasKey( 'test_string', $meta );
+                $this->assertInternalType( 'string', $meta['test_string'] );
+                $this->assertSame( '42', $meta['test_string'] );
+
+                $this->assertArrayHasKey( 'test_number', $meta );
+                $this->assertInternalType( 'float', $meta['test_number'] );
+                $this->assertSame( 42.0, $meta['test_number'] );
+
+                $this->assertArrayHasKey( 'test_bool', $meta );
+                $this->assertInternalType( 'boolean', $meta['test_bool'] );
+                $this->assertSame( true, $meta['test_bool'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_set_value() {
+                // Ensure no data exists currently.
+                $values = get_term_meta( self::$term_id, 'test_single', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_term_meta( self::$term_id, 'test_single', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 1, $meta );
+                $this->assertEquals( 'test_value', $meta[0] );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'test_value', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_set_duplicate_single_value() {
+                // Start with an existing metakey and value.
+                $values = update_term_meta( self::$term_id, 'test_single', 'test_value' );
+                $this->assertEquals( 'test_value', get_term_meta( self::$term_id, 'test_single', true ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_term_meta( self::$term_id, 'test_single', true );
+                $this->assertNotEmpty( $meta );
+                $this->assertEquals( 'test_value', $meta );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'test_value', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_unauthenticated() {
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( 0 );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 401 );
+
+                // Check that the value wasn't actually updated.
+                $this->assertEmpty( get_term_meta( self::$term_id, 'test_single', false ) );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_blocked() {
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 403 );
+                $this->assertEmpty( get_term_meta( self::$term_id, 'test_bad_auth', false ) );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_db_error() {
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_insert_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_insert_query' ) );
+                $wpdb->show_errors = true;
+        }
+
+        public function test_set_value_multiple() {
+                // Ensure no data exists currently.
+                $values = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 1, $meta );
+                $this->assertEquals( 'val1', $meta[0] );
+
+                // Add another value.
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1', 'val2' ),
+                        ),
+                );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 2, $meta );
+                $this->assertContains( 'val1', $meta );
+                $this->assertContains( 'val2', $meta );
+        }
+
+        /**
+         * Test removing only one item with duplicate items.
+         */
+        public function test_set_value_remove_one() {
+                add_term_meta( self::$term_id, 'test_multi', 'c' );
+                add_term_meta( self::$term_id, 'test_multi', 'n' );
+                add_term_meta( self::$term_id, 'test_multi', 'n' );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'c', 'n' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 2, $meta );
+                $this->assertContains( 'c', $meta );
+                $this->assertContains( 'n', $meta );
+        }
+
+        /**
+         * @depends test_set_value_multiple
+         */
+        public function test_set_value_multiple_unauthenticated() {
+                // Ensure no data exists currently.
+                $values = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( 0 );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 401 );
+
+                $meta = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertEmpty( $meta );
+        }
+
+        /**
+         * @depends test_set_value_multiple
+         */
+        public function test_set_value_multiple_blocked() {
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth_multi' => array( 'test_value' ),
+                        ),
+                );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 403 );
+                $this->assertEmpty( get_term_meta( self::$term_id, 'test_bad_auth_multi', false ) );
+        }
+
+        public function test_add_multi_value_db_error() {
+                // Ensure no data exists currently.
+                $values = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_insert_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_insert_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_remove_multi_value_db_error() {
+                add_term_meta( self::$term_id, 'test_multi', 'val1' );
+                $values = get_term_meta( self::$term_id, 'test_multi', false );
+                $this->assertEquals( array( 'val1' ), $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array(),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_delete_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_delete_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_delete_value() {
+                add_term_meta( self::$term_id, 'test_single', 'val1' );
+                $current = get_term_meta( self::$term_id, 'test_single', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_term_meta( self::$term_id, 'test_single', false );
+                $this->assertEmpty( $meta );
+        }
+
+        /**
+         * @depends test_delete_value
+         */
+        public function test_delete_value_blocked() {
+                add_term_meta( self::$term_id, 'test_bad_auth', 'val1' );
+                $current = get_term_meta( self::$term_id, 'test_bad_auth', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+
+                $meta = get_term_meta( self::$term_id, 'test_bad_auth', true );
+                $this->assertEquals( 'val1', $meta );
+        }
+
+        /**
+         * @depends test_delete_value
+         */
+        public function test_delete_value_db_error() {
+                add_term_meta( self::$term_id, 'test_single', 'val1' );
+                $current = get_term_meta( self::$term_id, 'test_single', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $request->set_body_params( $data );
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_delete_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_delete_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_get_schema() {
+                $request = new WP_REST_Request( 'OPTIONS', sprintf( '/wp/v2/wptests_tax/%d', self::$term_id ) );
+                $response = $this->server->dispatch( $request );
+
+                $data = $response->get_data();
+                $schema = $data['schema'];
+
+                $this->assertArrayHasKey( 'meta', $schema['properties'] );
+                $meta_schema = $schema['properties']['meta']['properties'];
+
+                $this->assertArrayHasKey( 'test_single', $meta_schema );
+                $this->assertEquals( 'string', $meta_schema['test_single']['type'] );
+
+                $this->assertArrayHasKey( 'test_multi', $meta_schema );
+                $this->assertEquals( 'array', $meta_schema['test_multi']['type'] );
+                $this->assertArrayHasKey( 'items', $meta_schema['test_multi'] );
+                $this->assertEquals( 'string', $meta_schema['test_multi']['items']['type'] );
+
+                $this->assertArrayHasKey( 'test_custom_schema', $meta_schema );
+                $this->assertEquals( 'number', $meta_schema['test_custom_schema']['type'] );
+
+                $this->assertArrayNotHasKey( 'test_no_rest', $meta_schema );
+                $this->assertArrayNotHasKey( 'test_rest_disabled', $meta_schema );
+                $this->assertArrayNotHasKey( 'test_invalid_type', $meta_schema );
+        }
+
+        /**
+         * Internal function used to disable an insert query which
+         * will trigger a wpdb error for testing purposes.
+         */
+        public function error_insert_query( $query ) {
+                if ( strpos( $query, 'INSERT' ) === 0 ) {
+                        $query = '],';
+                }
+                return $query;
+        }
+
+        /**
+         * Internal function used to disable an insert query which
+         * will trigger a wpdb error for testing purposes.
+         */
+        public function error_delete_query( $query ) {
+                if ( strpos( $query, 'DELETE' ) === 0 ) {
+                        $query = '],';
+                }
+                return $query;
+        }
+}

new file tests/phpunit/tests/rest-api/rest-user-meta-fields.php

@@ +1 @@
+<?php
+/**
+ * Unit tests covering WP_REST_Users meta functionality.
+ *
+ * @package WordPress
+ * @subpackage REST API
+ */
+
+ /**
+  * @group restapi
+  */
+class WP_Test_REST_User_Meta_Fields extends WP_Test_REST_TestCase {
+        protected static $administrator_id;
+        protected static $user;
+
+        public static function wpSetUpBeforeClass( $factory ) {
+                self::$administrator_id = $factory->user->create( array(
+                        'role' => 'administrator',
+                ) );
+                self::$user = $factory->user->create( array(
+                        'role' => 'author',
+                ) );
+        }
+
+        public static function wpTearDownAfterClass() {
+                wp_delete_user( self::$administrator_id );
+                wp_delete_user( self::$user );
+        }
+
+        public function setUp() {
+                parent::setUp();
+
+                // Editing users requires 'manage_network_users' on multisite.
+                if ( is_multisite() ) {
+                        add_filter( 'user_has_cap', array( $this, 'grant_manage_network_users_to_admin' ), 10, 4 );
+                }
+
+                register_meta( 'user', 'test_single', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                ) );
+                register_meta( 'user', 'test_multi', array(
+                        'show_in_rest' => true,
+                        'single' => false,
+                ) );
+                register_meta( 'user', 'test_bad_auth', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'auth_callback' => '__return_false',
+                ) );
+                register_meta( 'user', 'test_bad_auth_multi', array(
+                        'show_in_rest' => true,
+                        'single' => false,
+                        'auth_callback' => '__return_false',
+                ) );
+                register_meta( 'user', 'test_no_rest', array() );
+                register_meta( 'user', 'test_rest_disabled', array(
+                        'show_in_rest' => false,
+                ) );
+                register_meta( 'user', 'test_custom_schema', array(
+                        'single' => true,
+                        'type' => 'integer',
+                        'show_in_rest' => array(
+                                'schema' => array(
+                                        'type' => 'number',
+                                ),
+                        ),
+                ) );
+                register_meta( 'user', 'test_invalid_type', array(
+                        'single' => true,
+                        'type' => false,
+                        'show_in_rest' => true,
+                ) );
+
+                /** @var WP_REST_Server $wp_rest_server */
+                global $wp_rest_server;
+                $this->server = $wp_rest_server = new Spy_REST_Server;
+                do_action( 'rest_api_init' );
+        }
+
+        public function tearDown() {
+                if ( is_multisite() ) {
+                        remove_filter( 'user_has_cap', array( $this, 'grant_manage_network_users_to_admin' ), 10, 4 );
+                }
+        }
+
+        public function grant_manage_network_users_to_admin( $allcaps, $caps, $args, WP_User $user ) {
+                if ( array( 'manage_network_users' ) == $caps && self::$administrator_id === $user->ID ) {
+                        $allcaps['manage_network_users'] = 1;
+                }
+
+                return $allcaps;
+
+        }
+
+        public function test_get_value() {
+                add_user_meta( self::$user, 'test_single', 'testvalue' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', self::$user ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $response = $this->server->dispatch( $request );
+
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $this->assertArrayHasKey( 'meta', $data );
+
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'testvalue', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_multi_value() {
+                add_user_meta( self::$user, 'test_multi', 'value1' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', self::$user ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_multi', $meta );
+                $this->assertInternalType( 'array', $meta['test_multi'] );
+                $this->assertContains( 'value1', $meta['test_multi'] );
+
+                // Check after an update.
+                add_user_meta( self::$user, 'test_multi', 'value2' );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertContains( 'value1', $meta['test_multi'] );
+                $this->assertContains( 'value2', $meta['test_multi'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_unregistered() {
+                add_user_meta( self::$user, 'test_unregistered', 'value1' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', self::$user ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_unregistered', $meta );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_no_api_access() {
+                add_user_meta( self::$user, 'test_no_rest', 'for_the_wicked' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', self::$user ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_no_rest', $meta );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_api_disabled() {
+                add_user_meta( self::$user, 'test_rest_disabled', 'sleepless_nights' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', self::$user ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayNotHasKey( 'test_rest_disabled', $meta );
+        }
+
+        public function test_get_value_types() {
+                register_meta( 'user', 'test_string', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'string',
+                ));
+                register_meta( 'user', 'test_number', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'number',
+                ));
+                register_meta( 'user', 'test_bool', array(
+                        'show_in_rest' => true,
+                        'single' => true,
+                        'type' => 'boolean',
+                ));
+
+                /** @var WP_REST_Server $wp_rest_server */
+                global $wp_rest_server;
+                $this->server = $wp_rest_server = new Spy_REST_Server;
+                do_action( 'rest_api_init' );
+
+                add_user_meta( self::$user, 'test_string', 42 );
+                add_user_meta( self::$user, 'test_number', '42' );
+                add_user_meta( self::$user, 'test_bool', 1 );
+
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', self::$user ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+
+                $this->assertArrayHasKey( 'test_string', $meta );
+                $this->assertInternalType( 'string', $meta['test_string'] );
+                $this->assertSame( '42', $meta['test_string'] );
+
+                $this->assertArrayHasKey( 'test_number', $meta );
+                $this->assertInternalType( 'float', $meta['test_number'] );
+                $this->assertSame( 42.0, $meta['test_number'] );
+
+                $this->assertArrayHasKey( 'test_bool', $meta );
+                $this->assertInternalType( 'boolean', $meta['test_bool'] );
+                $this->assertSame( true, $meta['test_bool'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_set_value() {
+                // Ensure no data exists currently.
+                $values = get_user_meta( self::$user, 'test_single', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_user_meta( self::$user, 'test_single', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 1, $meta );
+                $this->assertEquals( 'test_value', $meta[0] );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'test_value', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_get_value
+         */
+        public function test_set_duplicate_single_value() {
+                // Start with an existing metakey and value.
+                $values = update_user_meta( self::$user, 'test_single', 'test_value' );
+                $this->assertEquals( 'test_value', get_user_meta( self::$user, 'test_single', true ) );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_user_meta( self::$user, 'test_single', true );
+                $this->assertNotEmpty( $meta );
+                $this->assertEquals( 'test_value', $meta );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_single', $meta );
+                $this->assertEquals( 'test_value', $meta['test_single'] );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_unauthenticated() {
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( 0 );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit', $response, 401 );
+
+                // Check that the value wasn't actually updated.
+                $this->assertEmpty( get_user_meta( self::$user, 'test_single', false ) );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_blocked() {
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 403 );
+                $this->assertEmpty( get_user_meta( self::$user, 'test_bad_auth', false ) );
+        }
+
+        /**
+         * @depends test_set_value
+         */
+        public function test_set_value_db_error() {
+                $data = array(
+                        'meta' => array(
+                                'test_single' => 'test_value',
+                        ),
+                );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_insert_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_insert_query' ) );
+                $wpdb->show_errors = true;
+        }
+
+        public function test_set_value_multiple() {
+                // Ensure no data exists currently.
+                $values = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 1, $meta );
+                $this->assertEquals( 'val1', $meta[0] );
+
+                // Add another value.
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1', 'val2' ),
+                        ),
+                );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 2, $meta );
+                $this->assertContains( 'val1', $meta );
+                $this->assertContains( 'val2', $meta );
+        }
+
+        /**
+         * Test removing only one item with duplicate items.
+         */
+        public function test_set_value_remove_one() {
+                add_user_meta( self::$user, 'test_multi', 'c' );
+                add_user_meta( self::$user, 'test_multi', 'n' );
+                add_user_meta( self::$user, 'test_multi', 'n' );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'c', 'n' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertNotEmpty( $meta );
+                $this->assertCount( 2, $meta );
+                $this->assertContains( 'c', $meta );
+                $this->assertContains( 'n', $meta );
+        }
+
+        /**
+         * @depends test_set_value_multiple
+         */
+        public function test_set_value_multiple_unauthenticated() {
+                // Ensure no data exists currently.
+                $values = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( 0 );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_edit', $response, 401 );
+
+                $meta = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertEmpty( $meta );
+        }
+
+        /**
+         * @depends test_set_value_multiple
+         */
+        public function test_set_value_multiple_blocked() {
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth_multi' => array( 'test_value' ),
+                        ),
+                );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_update', $response, 403 );
+                $this->assertEmpty( get_user_meta( self::$user, 'test_bad_auth_multi', false ) );
+        }
+
+        public function test_add_multi_value_db_error() {
+                // Ensure no data exists currently.
+                $values = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertEmpty( $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array( 'val1' ),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_insert_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_insert_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_remove_multi_value_db_error() {
+                add_user_meta( self::$user, 'test_multi', 'val1' );
+                $values = get_user_meta( self::$user, 'test_multi', false );
+                $this->assertEquals( array( 'val1' ), $values );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_multi' => array(),
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_delete_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_delete_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_delete_value() {
+                add_user_meta( self::$user, 'test_single', 'val1' );
+                $current = get_user_meta( self::$user, 'test_single', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $meta = get_user_meta( self::$user, 'test_single', false );
+                $this->assertEmpty( $meta );
+        }
+
+        /**
+         * @depends test_delete_value
+         */
+        public function test_delete_value_blocked() {
+                add_user_meta( self::$user, 'test_bad_auth', 'val1' );
+                $current = get_user_meta( self::$user, 'test_bad_auth', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_bad_auth' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+
+                $response = $this->server->dispatch( $request );
+                $this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+
+                $meta = get_user_meta( self::$user, 'test_bad_auth', true );
+                $this->assertEquals( 'val1', $meta );
+        }
+
+        /**
+         * @depends test_delete_value
+         */
+        public function test_delete_value_db_error() {
+                add_user_meta( self::$user, 'test_single', 'val1' );
+                $current = get_user_meta( self::$user, 'test_single', true );
+                $this->assertEquals( 'val1', $current );
+
+                wp_set_current_user( self::$administrator_id );
+
+                $data = array(
+                        'meta' => array(
+                                'test_single' => null,
+                        ),
+                );
+                $request = new WP_REST_Request( 'POST', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $request->set_body_params( $data );
+                /**
+                 * Disable showing error as the below is going to intentionally
+                 * trigger a DB error.
+                 */
+                global $wpdb;
+                $wpdb->suppress_errors = true;
+                add_filter( 'query', array( $this, 'error_delete_query' ) );
+
+                $response = $this->server->dispatch( $request );
+                remove_filter( 'query', array( $this, 'error_delete_query' ) );
+                $wpdb->show_errors = true;
+
+                $this->assertErrorResponse( 'rest_meta_database_error', $response, 500 );
+        }
+
+        public function test_get_schema() {
+                $request = new WP_REST_Request( 'OPTIONS', sprintf( '/wp/v2/users/%d', self::$user ) );
+                $response = $this->server->dispatch( $request );
+
+                $data = $response->get_data();
+                $schema = $data['schema'];
+
+                $this->assertArrayHasKey( 'meta', $schema['properties'] );
+                $meta_schema = $schema['properties']['meta']['properties'];
+
+                $this->assertArrayHasKey( 'test_single', $meta_schema );
+                $this->assertEquals( 'string', $meta_schema['test_single']['type'] );
+
+                $this->assertArrayHasKey( 'test_multi', $meta_schema );
+                $this->assertEquals( 'array', $meta_schema['test_multi']['type'] );
+                $this->assertArrayHasKey( 'items', $meta_schema['test_multi'] );
+                $this->assertEquals( 'string', $meta_schema['test_multi']['items']['type'] );
+
+                $this->assertArrayHasKey( 'test_custom_schema', $meta_schema );
+                $this->assertEquals( 'number', $meta_schema['test_custom_schema']['type'] );
+
+                $this->assertArrayNotHasKey( 'test_no_rest', $meta_schema );
+                $this->assertArrayNotHasKey( 'test_rest_disabled', $meta_schema );
+                $this->assertArrayNotHasKey( 'test_invalid_type', $meta_schema );
+        }
+
+        /**
+         * Internal function used to disable an insert query which
+         * will trigger a wpdb error for testing purposes.
+         */
+        public function error_insert_query( $query ) {
+                if ( strpos( $query, 'INSERT' ) === 0 ) {
+                        $query = '],';
+                }
+                return $query;
+        }
+
+        /**
+         * Internal function used to disable an insert query which
+         * will trigger a wpdb error for testing purposes.
+         */
+        public function error_delete_query( $query ) {
+                if ( strpos( $query, 'DELETE' ) === 0 ) {
+                        $query = '],';
+                }
+                return $query;
+        }
+}

new file tests/phpunit/tests/term/capabilities.php

@@ +1 @@
+<?php
+
+/**
+ * @group taxonomy
+ * @group capabilities
+ */
+
+class Tests_Term_Capabilities extends WP_UnitTestCase {
+        protected static $admin;
+        protected static $u1;
+        protected static $u2;
+        protected static $tag;
+
+        public static function wpSetUpBeforeClass( $factory ) {
+                self::$admin = $factory->user->create( array( 'role' => 'administrator' ) );
+                self::$u1 = $factory->user->create( array( 'role' => 'subscriber' ) );
+                self::$u2 = $factory->user->create( array( 'role' => 'subscriber' ) );
+
+                self::$tag = $factory->tag->create();
+        }
+
+        public static function wpTearDownAfterClass() {
+                self::delete_user( self::$admin );
+                self::delete_user( self::$u1 );
+                self::delete_user( self::$u2 );
+
+                wp_delete_term( self::$tag, 'post_tag' );
+        }
+
+        public function setUp() {
+                parent::setUp();
+                add_filter( 'user_has_cap', array( $this, 'grant_edit_term_to_u1' ), 10, 4 );
+        }
+
+        public function tearDown() {
+                parent::tearDown();
+                remove_filter( 'user_has_cap', array( $this, 'grant_edit_term_to_u1' ), 10, 4 );
+        }
+
+        public function grant_edit_term_to_u1( $allcaps, $caps, $args, WP_User $user ) {
+                if ( array( 'manage_categories' ) == $caps && self::$u1 === $user->ID ) {
+                        $allcaps['manage_categories'] = 1;
+                }
+
+                return $allcaps;
+        }
+
+        public function test_no_one_can_edit_term_meta_for_non_existent_term() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'edit_term_meta', 999999 ) );
+        }
+
+        public function test_user_can_edit_term_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'edit_term_meta', self::$tag, 'foo' ) );
+        }
+
+        public function test_user_cannot_edit_term_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'edit_term_meta', self::$tag, 'foo' ) );
+        }
+
+        public function test_no_one_can_delete_term_meta_for_non_existent_term() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'delete_term_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_delete_term_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'delete_term_meta', self::$tag, 'foo' ) );
+        }
+
+        public function test_user_cannot_delete_term_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'delete_term_meta', self::$tag, 'foo' ) );
+        }
+
+        public function test_no_one_can_add_term_meta_for_non_existent_term() {
+                wp_set_current_user( self::$admin );
+                $this->assertFalse( current_user_can( 'add_term_meta', 999999, 'foo' ) );
+        }
+
+        public function test_user_can_add_term_meta() {
+                wp_set_current_user( self::$u1 );
+                $this->assertTrue( current_user_can( 'add_term_meta', self::$tag, 'foo' ) );
+        }
+
+        public function test_user_cannot_add_term_meta() {
+                wp_set_current_user( self::$u2 );
+                $this->assertFalse( current_user_can( 'add_term_meta', self::$tag, 'foo' ) );
+        }
+}

tests/phpunit/tests/user/capabilities.php

@@ -431 +431 @@
                         $expected['delete_post_meta'],
                         $expected['add_post_meta'],
                         $expected['edit_comment'],
+                        $expected['edit_comment_meta'],
+                        $expected['delete_comment_meta'],
+                        $expected['add_comment_meta'],
                         $expected['edit_term'],
                         $expected['delete_term'],
                         $expected['assign_term'],
-                        $expected['delete_user']
+                        $expected['edit_term_meta'],
+                        $expected['delete_term_meta'],
+                        $expected['add_term_meta'],
+                        $expected['delete_user'],
+                        $expected['edit_user_meta'],
+                        $expected['delete_user_meta'],
+                        $expected['add_user_meta']
                 );
 
                 $expected = array_keys( $expected );
@@ -1663 +1672 @@
                 $wp_roles = new WP_Roles();
                 $wp_roles->reinit();
         }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_no_one_can_edit_user_meta_for_non_existent_term() {
+                wp_set_current_user( self::$super_admin->ID );
+                $this->assertFalse( current_user_can( 'edit_user_meta', 999999 ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_user_can_edit_user_meta() {
+                wp_set_current_user( self::$users['administrator']->ID );
+                if ( is_multisite() ) {
+                        grant_super_admin( self::$users['administrator']->ID );
+                }
+                $this->assertTrue( current_user_can( 'edit_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_user_cannot_edit_user_meta() {
+                wp_set_current_user( self::$users['editor']->ID );
+                $this->assertFalse( current_user_can( 'edit_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_no_one_can_delete_user_meta_for_non_existent_term() {
+                wp_set_current_user( self::$super_admin->ID );
+                $this->assertFalse( current_user_can( 'delete_user_meta', 999999, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_user_can_delete_user_meta() {
+                wp_set_current_user( self::$users['administrator']->ID );
+                if ( is_multisite() ) {
+                        grant_super_admin( self::$users['administrator']->ID );
+                }
+                $this->assertTrue( current_user_can( 'delete_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_user_cannot_delete_user_meta() {
+                wp_set_current_user( self::$users['editor']->ID );
+                $this->assertFalse( current_user_can( 'delete_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_no_one_can_add_user_meta_for_non_existent_term() {
+                wp_set_current_user( self::$super_admin->ID );
+                $this->assertFalse( current_user_can( 'add_user_meta', 999999, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_user_can_add_user_meta() {
+                wp_set_current_user( self::$users['administrator']->ID );
+                if ( is_multisite() ) {
+                        grant_super_admin( self::$users['administrator']->ID );
+                }
+                $this->assertTrue( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+        }
+
+        /**
+         * @ticket 38412
+         */
+        public function test_user_cannot_add_user_meta() {
+                wp_set_current_user( self::$users['editor']->ID );
+                $this->assertFalse( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) );
+        }
 }