Changeset 39092

Timestamp:

11/02/2016 06:52:30 AM (8 years ago)

Author:

rmccue

Message:

REST API: Add update and delete endpoints to /users/me

Now that /users/me is a standalone resource, it should have all the standard endpoints for a resource.

Props pento.
Fixes #38521 (hopefully).

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (8 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -96 +96 @@
 
         register_rest_route( $this->namespace, '/' . $this->rest_base . '/me', array(
-            'methods'  => WP_REST_Server::READABLE,
-            'callback' => array( $this, 'get_current_item' ),
-            'args'     => array(
-                'context' => array(),
+            array(
+                'methods'             => WP_REST_Server::READABLE,
+                'callback'            => array( $this, 'get_current_item' ),
+                'args'                => array(
+                    'context'          => array(),
+                ),
+            ),
+            array(
+                'methods'             => WP_REST_Server::EDITABLE,
+                'callback'            => array( $this, 'update_current_item' ),
+                'permission_callback' => array( $this, 'update_current_item_permissions_check' ),
+                'args'                => $this->get_endpoint_args_for_item_schema( WP_REST_Server::EDITABLE ),
+            ),
+            array(
+                'methods'             => WP_REST_Server::DELETABLE,
+                'callback'            => array( $this, 'delete_current_item' ),
+                'permission_callback' => array( $this, 'delete_current_item_permissions_check' ),
+                'args'                => array(
+                    'force'    => array(
+                        'default'     => false,
+                        'description' => __( 'Required to be true, as resource does not support trashing.' ),
+                    ),
+                    'reassign' => array(),
+                ),
             ),
             'schema' => array( $this, 'get_public_item_schema' ),
@@ -569 +589 @@
 
     /**
+     * Checks if a given request has access to update the current user.
+     *
+     * @since 4.7.0
+     * @access public
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return true|WP_Error True if the request has access to update the item, WP_Error object otherwise.
+     */
+    public function update_current_item_permissions_check( $request ) {
+        $request['id'] = get_current_user_id();
+
+        return $this->update_item_permissions_check( $request );
+    }
+
+    /**
+     * Updates the current user.
+     *
+     * @since 4.7.0
+     * @access public
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
+     */
+    function update_current_item( $request ) {
+        $request['id'] = get_current_user_id();
+
+        return $this->update_item( $request );
+    }
+
+    /**
      * Checks if a given request has access delete a user.
      *
@@ -644 +694 @@
 
         return $response;
+    }
+
+    /**
+     * Checks if a given request has access to delete the current user.
+     *
+     * @since 4.7.0
+     * @access public
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return true|WP_Error True if the request has access to delete the item, WP_Error object otherwise.
+     */
+    public function delete_current_item_permissions_check( $request ) {
+        $request['id'] = get_current_user_id();
+
+        return $this->delete_item_permissions_check( $request );
+    }
+
+    /**
+     * Deletes the current user.
+     *
+     * @since 4.7.0
+     * @access public
+     *
+     * @param WP_REST_Request $request Full details about the request.
+     * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
+     */
+    function delete_current_item( $request ) {
+        $request['id'] = get_current_user_id();
+
+        return $this->delete_item( $request );
     }
 

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -957 +957 @@
         $this->assertArrayHasKey( 'editor', $user->caps );
         $this->assertArrayNotHasKey( 'administrator', $user->caps );
+
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me' );
+        $request->set_param( 'roles', array( 'administrator' ) );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_cannot_edit_roles', $response, 403 );
+        $user = get_userdata( self::$editor );
+        $this->assertArrayHasKey( 'editor', $user->caps );
+        $this->assertArrayNotHasKey( 'administrator', $user->caps );
     }
 
@@ -977 +986 @@
         $this->assertArrayHasKey( 'administrator', $user->caps );
         $this->assertArrayNotHasKey( 'editor', $user->caps );
+
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me' );
+        $request->set_param( 'roles', array( 'editor' ) );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_user_invalid_role', $response, 403 );
+
+        $user = get_userdata( $user_id );
+        $this->assertArrayHasKey( 'administrator', $user->caps );
+        $this->assertArrayNotHasKey( 'editor', $user->caps );
     }
 
@@ -997 +1016 @@
         $this->assertEquals( 'editor', $new_data['roles'][0] );
         $this->assertNotEquals( 'administrator', $new_data['roles'][0] );
+
+        $user_id = $this->factory->user->create( array( 'role' => 'administrator' ) );
+
+        wp_set_current_user( $user_id );
+        $user = wp_get_current_user();
+        update_site_option( 'site_admins', array( $user->user_login ) );
+
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me' );
+        $request->set_param( 'roles', array( 'editor' ) );
+        $response = $this->server->dispatch( $request );
+
+        $new_data = $response->get_data();
+        $this->assertEquals( 'editor', $new_data['roles'][0] );
+        $this->assertNotEquals( 'administrator', $new_data['roles'][0] );
     }
 
@@ -1005 +1038 @@
 
         $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/users/%d', self::$editor ) );
+        $request->set_param( 'roles', array( 'BeSharp' ) );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_user_invalid_role', $response, 400 );
+
+        $user = get_userdata( self::$editor );
+        $this->assertArrayHasKey( 'editor', $user->caps );
+        $this->assertArrayNotHasKey( 'BeSharp', $user->caps );
+
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me' );
         $request->set_param( 'roles', array( 'BeSharp' ) );
         $response = $this->server->dispatch( $request );
@@ -1030 +1073 @@
 
         $this->assertErrorResponse( 'rest_cannot_edit', $response, 403 );
+
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me' );
+        $request->add_header( 'content-type', 'application/x-www-form-urlencoded' );
+        $request->set_body_params( $params );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_user_invalid_argument', $response, 400 );
     }
 
@@ -1067 +1117 @@
     }
 
+    public function test_delete_current_item() {
+        $user_id = $this->factory->user->create( array( 'role' => 'administrator', 'display_name' => 'Deleted User' ) );
+
+        wp_set_current_user( $user_id );
+        $user = wp_get_current_user();
+        update_site_option( 'site_admins', array( $user->user_login ) );
+
+        $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
+        $request['force'] = true;
+        $response = $this->server->dispatch( $request );
+
+        $this->assertEquals( 200, $response->get_status() );
+        $data = $response->get_data();
+        $this->assertEquals( 'Deleted User', $data['name'] );
+    }
+
     public function test_delete_item_no_trash() {
         $user_id = $this->factory->user->create( array( 'display_name' => 'Deleted User' ) );
@@ -1083 +1149 @@
     }
 
+    public function test_delete_current_item_no_trash() {
+        $user_id = $this->factory->user->create( array( 'role' => 'administrator' ) );
+
+        wp_set_current_user( $user_id );
+        $user = wp_get_current_user();
+        update_site_option( 'site_admins', array( $user->user_login ) );
+
+        $userdata = get_userdata( $user_id ); // cache for later
+        $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
+        $response = $this->server->dispatch( $request );
+        $this->assertErrorResponse( 'rest_trash_not_supported', $response, 501 );
+
+        // Ensure the user still exists
+        $user = get_user_by( 'id', $user_id );
+        $this->assertNotEmpty( $user );
+    }
+
     public function test_delete_user_without_permission() {
         $user_id = $this->factory->user->create();
@@ -1090 +1173 @@
 
         $request = new WP_REST_Request( 'DELETE', sprintf( '/wp/v2/users/%d', $user_id ) );
+        $request['force'] = true;
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_user_cannot_delete', $response, 403 );
+
+        $request = new WP_REST_Request( 'DELETE', '/wp/v2/users/me' );
         $request['force'] = true;
         $response = $this->server->dispatch( $request );