Ticket #43316: 43316.13.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

@@ -15 +15 @@
  * @see WP_REST_Controller
  */
 class WP_REST_Revisions_Controller extends WP_REST_Controller {
+        /**
+         * Post type.
+         *
+         * @since 5.0.0
+         * @var string
+         */
+        protected $post_type = 'revision';
 
         /**
          * Parent post type.
@@ -79 +86 @@
                                         'permission_callback' => array( $this, 'get_items_permissions_check' ),
                                         'args'                => $this->get_collection_params(),
                                 ),
+                                array(
+                                        'methods'             => WP_REST_Server::CREATABLE,
+                                        'callback'            => array( $this, 'create_item' ),
+                                        'permission_callback' => array( $this, 'create_item_permissions_check' ),
+                                        'args'                => $this->get_endpoint_args_for_item_schema( WP_REST_Server::CREATABLE ),
+                                ),
                                 'schema' => array( $this, 'get_public_item_schema' ),
                         )
                 );
@@ -103 +116 @@
                                                 'context' => $this->get_context_param( array( 'default' => 'view' ) ),
                                         ),
                                 ),
+                                array(
+                                        'methods'             => WP_REST_Server::EDITABLE,
+                                        'callback'            => array( $this, 'update_item' ),
+                                        'permission_callback' => array( $this, 'update_item_permissions_check' ),
+                                        'args'                => $this->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),
+                                ),
                                 array(
                                         'methods'             => WP_REST_Server::DELETABLE,
                                         'callback'            => array( $this, 'delete_item' ),
@@ -205 +224 @@
 
                 $response = array();
                 foreach ( $revisions as $revision ) {
+                        if ( wp_is_post_autosave( $revision->ID ) ) {
+                                if ( ! in_array( 'autosave', $request['revision_type'] ) ) {
+                                        continue;
+                                }
+                        } elseif ( ! in_array( 'revision', $request['revision_type'] ) ) {
+                                continue;
+                        }
+
                         $data       = $this->prepare_item_for_response( $revision, $request );
                         $response[] = $this->prepare_response_for_collection( $data );
                 }
@@ -246 +273 @@
                 return rest_ensure_response( $response );
         }
 
+        /**
+         * Checks if a given request has access to create an autosave revision.
+         *
+         * Autosave revisions inherit permissions from the parent post,
+         * check if the current user has permission to edit the post.
+         *
+         * @since 5.0.0
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return true|WP_Error True if the request has access to create the item, WP_Error object otherwise.
+         */
+        public function create_item_permissions_check( $request ) {
+                if ( empty( $request->get_param( 'parent' ) ) ) {
+                        return new WP_Error( 'rest_post_invalid_id', __( 'Invalid item ID.' ), array( 'status' => 404 ) );
+                }
+
+                // Set request ID for the permission check.
+                $dummy_request = clone $request;
+                $dummy_request['id'] = $request['parent'];
+
+                return $this->parent_controller->update_item_permissions_check( $dummy_request );
+        }
+
+        /**
+         * Creates, updates or deletes an autosave revision.
+         *
+         * @since 5.0.0
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
+         */
+        public function create_item( $request ) {
+                if ( ! defined( 'DOING_AUTOSAVE' ) ) {
+                        define( 'DOING_AUTOSAVE', true );
+                }
+
+                $post = get_post( $request->get_param( 'parent' ) );
+
+                if ( is_wp_error( $post ) ) {
+                        return $post;
+                }
+
+                $user_id      = get_current_user_id();
+                $old_autosave = wp_get_post_autosave( $post->ID, $user_id );
+                if ( $old_autosave ) {
+                        return new WP_Error(
+                                'rest_revision_existing_autosave',
+                                __( 'An autosave already exists for this user.' ),
+                                array(
+                                        'status' => WP_Http::CONFLICT,
+                                        'id'     => $old_autosave->ID,
+                                )
+                        );
+                }
+
+                $prepared_post     = $this->prepare_item_for_database( $request );
+                $prepared_post->ID = $post->ID;
+
+                if ( 'draft' === $post->post_status || 'auto-draft' === $post->post_status ) {
+                        return new WP_Error(
+                                'rest_cannot_create_for_draft',
+                                __( 'Draft posts may not have autosaves.' ),
+                                array(
+                                        'status' => WP_Http::BAD_REQUEST,
+                                )
+                        );
+                }
+
+                // Non-draft posts: create or update the post autosave.
+                $autosave_id = _wp_put_post_revision( (array) $prepared_post, true );
+                if ( is_wp_error( $autosave_id ) ) {
+                        return $autosave_id;
+                }
+
+                $autosave      = get_post( $autosave_id );
+                $fields_update = $this->update_additional_fields_for_object( $autosave, $request );
+
+                if ( is_wp_error( $fields_update ) ) {
+                        return $fields_update;
+                }
+
+                $request->set_param( 'context', 'edit' );
+
+                $response = $this->prepare_item_for_response( $autosave, $request );
+                $response = rest_ensure_response( $response );
+
+                return $response;
+        }
+
+        /**
+         * Checks if a given request has access to create an autosave revision.
+         *
+         * Autosave revisions inherit permissions from the parent post,
+         * check if the current user has permission to edit the post.
+         *
+         * @since 5.0.0
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return true|WP_Error True if the request has access to create the item, WP_Error object otherwise.
+         */
+        public function update_item_permissions_check( $request ) {
+                if ( empty( $request->get_param( 'parent' ) ) ) {
+                        return new WP_Error( 'rest_post_invalid_id', __( 'Invalid item ID.' ), array( 'status' => 404 ) );
+                }
+
+                $autosave = $this->get_revision( $request['id'] );
+                if ( is_wp_error( $revision ) ) {
+                        return $revision;
+                }
+
+                if ( ! wp_is_post_autosave( $autosave ) ) {
+                        return new WP_Error(
+                                'rest_revision_cannot_update',
+                                __( 'Only autosave revisions may be updated.' ),
+                                array( 'status' => WP_Http::BAD_REQUEST )
+                        );
+                }
+
+                // Set request ID for the permission check.
+                $dummy_request = clone $request;
+                $dummy_request['id'] = $request['parent'];
+
+                return $this->parent_controller->update_item_permissions_check( $dummy_request );
+        }
+
+        /**
+         * Updates a single revision.
+         *
+         * Only allows updating autosave revisions.
+         *
+         * @since 4.7.0
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
+         */
+        public function update_item( $request ) {
+                $valid_check = $this->get_parent( $request['parent'] );
+                if ( is_wp_error( $valid_check ) ) {
+                        return $valid_check;
+                }
+
+                $post = $this->prepare_item_for_database( $request );
+
+                if ( is_wp_error( $post ) ) {
+                        return $post;
+                }
+
+                // convert the post object to an array, otherwise wp_update_post will expect non-escaped input.
+                $post_id = wp_update_post( wp_slash( (array) $post ), true );
+
+                if ( is_wp_error( $post_id ) ) {
+                        if ( 'db_update_error' === $post_id->get_error_code() ) {
+                                $post_id->add_data( array( 'status' => 500 ) );
+                        } else {
+                                $post_id->add_data( array( 'status' => 400 ) );
+                        }
+                        return $post_id;
+                }
+
+                $post = get_post( $post_id );
+
+                /** This action is documented in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php */
+                do_action( "rest_insert_{$this->post_type}", $post, $request, false );
+
+                $schema = $this->get_item_schema();
+
+                $post          = get_post( $post_id );
+                $fields_update = $this->update_additional_fields_for_object( $post, $request );
+
+                if ( is_wp_error( $fields_update ) ) {
+                        return $fields_update;
+                }
+
+                $request->set_param( 'context', 'edit' );
+
+                $response = $this->prepare_item_for_response( $post, $request );
+
+                return rest_ensure_response( $response );
+        }
+
         /**
          * Checks if a given request has access to delete a revision.
          *
@@ -326 +533 @@
                 return $response;
         }
 
+        /**
+         * Prepares a single post for create or update.
+         *
+         * @since 4.7.0
+         *
+         * @param WP_REST_Request $request Request object.
+         * @return stdClass|WP_Error Post object or WP_Error.
+         */
+        protected function prepare_item_for_database( $request ) {
+                $prepared_post = new stdClass;
+
+                // Post ID.
+                if ( isset( $request['id'] ) ) {
+                        $existing_post = $this->get_revision( $request['id'] );
+                        if ( is_wp_error( $existing_post ) ) {
+                                return $existing_post;
+                        }
+
+                        $prepared_post->ID = $existing_post->ID;
+                }
+
+                $schema = $this->get_item_schema();
+
+                // Post title.
+                if ( ! empty( $schema['properties']['title'] ) && isset( $request['title'] ) ) {
+                        if ( is_string( $request['title'] ) ) {
+                                $prepared_post->post_title = $request['title'];
+                        } elseif ( ! empty( $request['title']['raw'] ) ) {
+                                $prepared_post->post_title = $request['title']['raw'];
+                        }
+                }
+
+                // Post content.
+                if ( ! empty( $schema['properties']['content'] ) && isset( $request['content'] ) ) {
+                        if ( is_string( $request['content'] ) ) {
+                                $prepared_post->post_content = $request['content'];
+                        } elseif ( isset( $request['content']['raw'] ) ) {
+                                $prepared_post->post_content = $request['content']['raw'];
+                        }
+                }
+
+                // Post excerpt.
+                if ( ! empty( $schema['properties']['excerpt'] ) && isset( $request['excerpt'] ) ) {
+                        if ( is_string( $request['excerpt'] ) ) {
+                                $prepared_post->post_excerpt = $request['excerpt'];
+                        } elseif ( isset( $request['excerpt']['raw'] ) ) {
+                                $prepared_post->post_excerpt = $request['excerpt']['raw'];
+                        }
+                }
+
+                /**
+                 * Filters a post before it is inserted via the REST API.
+                 *
+                 * The dynamic portion of the hook name, `$this->post_type`, refers to the post type slug.
+                 *
+                 * @since 4.7.0
+                 *
+                 * @param stdClass        $prepared_post An object representing a single post prepared
+                 *                                       for inserting or updating the database.
+                 * @param WP_REST_Request $request       Request object.
+                 */
+                return apply_filters( "rest_pre_insert_{$this->post_type}", $prepared_post, $request );
+
+        }
+
         /**
          * Prepares the revision for the REST response.
          *
@@ -372 +644 @@
                         $data['parent'] = (int) $post->post_parent;
                 }
 
+                if ( ! empty( $schema['properties']['revision_type'] ) ) {
+                        $data['revision_type'] = wp_is_post_autosave( $post->ID ) ? 'autosave' : 'revision';
+                }
+
                 if ( ! empty( $schema['properties']['slug'] ) ) {
                         $data['slug'] = $post->post_name;
                 }
@@ -510 +786 @@
                                         'type'        => 'integer',
                                         'context'     => array( 'view', 'edit', 'embed' ),
                                 ),
+                                'revision_type' => array(
+                                        'description' => __( 'Type of revision.' ),
+                                        'type'        => 'string',
+                                        'enum'        => array(
+                                                'autosave',
+                                                'revision',
+                                        ),
+                                        'default'     => 'autosave',
+                                        'context'     => array( 'view', 'edit' ),
+                                        'arg_options' => array(
+                                                'sanitize_callback' => array( $this, 'sanitize_revision_type' ),
+                                        ),
+                                ),
                                 'slug'         => array(
                                         'description' => __( 'An alphanumeric identifier for the object unique to its type.' ),
                                         'type'        => 'string',
@@ -549 +838 @@
         public function get_collection_params() {
                 return array(
                         'context' => $this->get_context_param( array( 'default' => 'view' ) ),
+                        'revision_type' => array(
+                                'type'              => 'array',
+                                'items'             => array(
+                                        'enum' => array(
+                                                'autosave',
+                                                'revision',
+                                        ),
+                                        'type' => 'string',
+                                ),
+                                'default'           => array(
+                                        'autosave',
+                                        'revision',
+                                ),
+                                'sanitize_callback' => 'wp_parse_slug_list',
+                        ),
                 );
         }
 
+        /**
+         * Sanitizes and validates the revision type on creation.
+         *
+         * @since 5.0.0
+         *
+         * @param string $type Revision type.
+         */
+        public function sanitize_revision_type( $type ) {
+                if ( $type !== 'autosave' ) {
+                        return new WP_Error(
+                                'rest_revision_invalid_type',
+                                sprintf(
+                                        /* translators: %s: revision type */
+                                        __( 'Cannot create revisions of type %s' ),
+                                        $type
+                                ),
+                                array(
+                                        'status' => WP_Http::BAD_REQUEST
+                                )
+                        );
+                }
+
+                return $type;
+        }
+
         /**
          * Checks the post excerpt and prepare it for single post output.
          *

tests/phpunit/tests/rest-api/rest-schema-setup.php

@@ -159 +159 @@
                 $post_revisions   = array_values( wp_get_post_revisions( $post_id ) );
                 $post_revision_id = $post_revisions[ count( $post_revisions ) - 1 ]->ID;
 
+                // Create an autosave.
+                wp_create_post_autosave(
+                        array(
+                                'post_ID'      => $post_id,
+                                'post_content' => 'Autosave post content.',
+                                'post_type'    => 'post',
+                        )
+                );
+
                 $page_id = $this->factory->post->create(
                         array(
                                 'post_type'     => 'page',
@@ -180 +189 @@
                 $page_revisions   = array_values( wp_get_post_revisions( $page_id ) );
                 $page_revision_id = $page_revisions[ count( $page_revisions ) - 1 ]->ID;
 
+                // Create an autosave.
+                wp_create_post_autosave(
+                        array(
+                                'post_ID'      => $page_id,
+                                'post_content' => 'Autosave page content.',
+                                'post_type'    => 'page',
+                        )
+                );
+
                 $tag_id = $this->factory->tag->create(
                         array(
                                 'name'        => 'REST API Client Fixture: Tag',