Changeset 62399

Timestamp:

05/21/2026 10:18:57 AM (3 months ago)

Author:

gziolo

Message:

EST API: Preserve custom status for ability validation errors

he REST run controller for the Abilities API already preserves a custom
HTTP status returned by wp_ability_normalize_input filter errors. Apply
the same behavior to validation errors from wp_ability_validate_input:
a WP_Error is only defaulted to a 400 status when it does not already
include one.

The shared defaulting logic is extracted into a new private
ensure_error_status() helper and reused for both normalization and
validation errors.

Follow-up to [62398].
See #64311.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/wpRestAbilitiesV1RunController.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php

@@ -162 +162 @@
                 $input = $ability->normalize_input( $input );
                 if ( is_wp_error( $input ) ) {
-                        $error_data = $input->get_error_data();
-                        if ( ! is_array( $error_data ) || ! isset( $error_data['status'] ) ) {
-                                $input->add_data( array( 'status' => 400 ) );
-                        }
-
-                        return $input;
+                        return $this->ensure_error_status( $input, 400 );
                 }
 
                 $is_valid = $ability->validate_input( $input );
                 if ( is_wp_error( $is_valid ) ) {
-                        $is_valid->add_data( array( 'status' => 400 ) );
-                        return $is_valid;
+                        return $this->ensure_error_status( $is_valid, 400 );
                 }
 
@@ -190 +184 @@
 
                 return true;
+        }
+
+        /**
+         * Ensures a WP_Error object carries an HTTP status, adding a default when none is set.
+         *
+         * @since 7.1.0
+         *
+         * @param WP_Error $error  Error object to update.
+         * @param int      $status HTTP status code to add if not already present.
+         * @return WP_Error The error object, with a default status when needed.
+         */
+        private function ensure_error_status( WP_Error $error, int $status ): WP_Error {
+                $error_data = $error->get_error_data();
+                if ( ! is_array( $error_data ) || ! isset( $error_data['status'] ) ) {
+                        $error->add_data( array( 'status' => $status ) );
+                }
+
+                return $error;
         }
 

trunk/tests/phpunit/tests/rest-api/wpRestAbilitiesV1RunController.php

@@ -978 +978 @@
 
         /**
+         * Tests that a validation filter error defaults to a 400 REST response.
+         *
+         * @ticket 64311
+         */
+        public function test_validate_input_filter_error_defaults_to_bad_request_status(): void {
+                $filter = static function () {
+                        return new WP_Error( 'validate_rejected', 'Rejected input.' );
+                };
+
+                add_filter( 'wp_ability_validate_input', $filter );
+
+                $request = new WP_REST_Request( 'POST', '/wp-abilities/v1/abilities/test/calculator/run' );
+                $request->set_header( 'Content-Type', 'application/json' );
+                $request->set_body(
+                        wp_json_encode(
+                                array(
+                                        'input' => array(
+                                                'a' => 5,
+                                                'b' => 3,
+                                        ),
+                                )
+                        )
+                );
+
+                $response = $this->server->dispatch( $request );
+
+                remove_filter( 'wp_ability_validate_input', $filter );
+
+                $this->assertSame( 400, $response->get_status() );
+                $data = $response->get_data();
+                $this->assertSame( 'validate_rejected', $data['code'] );
+                $this->assertSame( 'Rejected input.', $data['message'] );
+        }
+
+        /**
+         * Tests that a validation filter error with custom status keeps that status.
+         *
+         * @ticket 64311
+         */
+        public function test_validate_input_filter_error_preserves_custom_status(): void {
+                $filter = static function () {
+                        return new WP_Error(
+                                'validate_unprocessable',
+                                'Input cannot be validated.',
+                                array( 'status' => 422 )
+                        );
+                };
+
+                add_filter( 'wp_ability_validate_input', $filter );
+
+                $request = new WP_REST_Request( 'POST', '/wp-abilities/v1/abilities/test/calculator/run' );
+                $request->set_header( 'Content-Type', 'application/json' );
+                $request->set_body(
+                        wp_json_encode(
+                                array(
+                                        'input' => array(
+                                                'a' => 5,
+                                                'b' => 3,
+                                        ),
+                                )
+                        )
+                );
+
+                $response = $this->server->dispatch( $request );
+
+                remove_filter( 'wp_ability_validate_input', $filter );
+
+                $this->assertSame( 422, $response->get_status() );
+                $data = $response->get_data();
+                $this->assertSame( 'validate_unprocessable', $data['code'] );
+                $this->assertSame( 'Input cannot be validated.', $data['message'] );
+        }
+
+        /**
          * Test ability without annotations defaults to POST method.
          *