Ticket #42785: 42785.3.diff

src/wp-includes/class-wp-post-type.php

@@ -309 +309 @@
         /**
          * Whether this post type should appear in the REST API.
          *
-         * Default false. If true, standard endpoints will be registered with
-         * respect to $rest_base and $rest_controller_class.
+         * Default true for public post types, and for logged in users. If true, standard endpoints
+         * will be registered with respect to $rest_base and $rest_controller_class.
          *
          * @since 4.7.4
          * @var bool $show_in_rest
@@ -377 +377 @@
 
                 $has_edit_link = ! empty( $args['_edit_link'] );
 
+                $show_in_rest_default = false;
+
+                if ( ! empty( $args['public'] ) || ! empty( $args['publicly_queryable'] ) ) {
+                        $show_in_rest_default = true;
+                }
+
                 // Args prefixed with an underscore are reserved for internal use.
                 $defaults = array(
                         'labels'                => array(),
@@ -402 +408 @@
                         'query_var'             => true,
                         'can_export'            => true,
                         'delete_with_user'      => null,
-                        'show_in_rest'          => false,
+                        'show_in_rest'          => $show_in_rest_default,
                         'rest_base'             => false,
                         'rest_controller_class' => false,
                         '_builtin'              => false,
@@ -413 +419 @@
 
                 $args['name'] = $this->name;
 
+                // Logged in users will see endpoints for all post types.
+                if ( function_exists( 'is_user_logged_in' ) && is_user_logged_in() ) {
+                        $args['show_in_rest'] = true;
+                }
+
                 // If not set, default to the setting for public.
                 if ( null === $args['publicly_queryable'] ) {
                         $args['publicly_queryable'] = $args['public'];

src/wp-includes/meta.php

@@ -1049 +1049 @@
                 $args = (array) $args;
         }
 
+        // Logged in users can see meta keys.
+        if( is_user_logged_in() ) {
+                $args['show_in_rest'] = true;
+        }
+
         if ( is_callable( $deprecated ) ) {
                 $args['auth_callback'] = $deprecated;
                 $has_old_auth_cb       = true;

src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php

@@ -342 +342 @@
 
                 foreach ( get_registered_meta_keys( $this->get_meta_type() ) as $name => $args ) {
                         if ( empty( $args['show_in_rest'] ) ) {
-                                continue;
+                                if ( is_user_logged_in() ) {
+                                        $args['show_in_rest'] = true;
+                                } else {
+                                        continue;
+                                }
                         }
 
                         $rest_args = array();

tests/phpunit/tests/rest-api/rest-post-meta-fields.php

@@ -197 +197 @@
         /**
          * @depends test_get_value
          */
-        public function test_get_registered_no_api_access() {
+        public function test_get_registered_no_api_access_logged_out() {
+                wp_set_current_user( 0 );
                 add_post_meta( self::$post_id, 'test_no_rest', 'for_the_wicked' );
                 $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
 
@@ -210 +211 @@
         }
 
         /**
+         * @depends test_get_value
+         */
+        public function test_get_registered_no_api_access_logged_in() {
+                $this->grant_write_permission();
+
+                add_post_meta( self::$post_id, 'test_no_rest', 'for_the_wicked' );
+                $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+
+                $data = $response->get_data();
+                $meta = (array) $data['meta'];
+                $this->assertArrayHasKey( 'test_no_rest', $meta );
+        }
+
+        /**
          * @depends test_get_value
          */
         public function test_get_registered_api_disabled() {