Changeset 64346

Timestamp:

10/14/2026 06:47:16 PM (2 days ago)

Author:

jorgefilipecosta

Message:

Abilities API: Add the core/users-query ability.

Adds a read-only core/users-query ability that returns a page of users, optionally filtered by IDs, slugs, usernames, roles, or published-post authorship. Until now, the only user ability was core/get-user-info, which returns the current user's own profile. The code lives in the new private WP_Abilities_Users class.
The input has three members: where selects the users, fields the fields returned for each one, and pagination the page. The output always holds the users in items, ordered by username, and the totals in pagination.

Developed in ​https://github.com/WordPress/ai/pull/774, and ​https://github.com/WordPress/wordpress-develop/pull/10775.

Props jorgefilipecosta, gziolo, justlevine, peterwilsoncc, dkotter, jason_the_adams, ugyensupport, iamadisingh, sangu3105.
Fixes #64657.

Location:

trunk

Files:

• src/wp-includes/abilities.php (modified) (3 diffs)
• src/wp-includes/abilities/class-wp-abilities-settings.php (modified) (1 diff)
• src/wp-includes/abilities/class-wp-abilities-users.php (added)
• tests/phpunit/tests/abilities-api/wpRegisterCoreUsersAbility.php (added)
• tests/phpunit/tests/rest-api/wpRestAbilitiesUsersController.php (added)

trunk/src/wp-includes/abilities.php

@@ -11 +11 @@
 
 require_once __DIR__ . '/abilities/class-wp-abilities-settings.php';
+require_once __DIR__ . '/abilities/class-wp-abilities-users.php';
 
 /**
@@ -48 +49 @@
  *
  * @since 6.9.0
- * @since 7.2.0 Added the `core/settings-get` ability.
+ * @since 7.2.0 Added the `core/settings-get` and `core/users-query` abilities.
  *
  * @global wpdb $wpdb WordPress database abstraction object.
@@ -367 +368 @@
         // Register the settings abilities (currently the read-only `core/settings-get`).
         ( new WP_Abilities_Settings() )->register();
+
+        // Register the user abilities (currently the read-only `core/users-query`).
+        ( new WP_Abilities_Users() )->register();
 }

trunk/src/wp-includes/abilities/class-wp-abilities-settings.php

@@ -17 +17 @@
  * future write-oriented `core/settings-update` ability.
  *
- * Unlike the other core abilities, which are self-contained closures registered directly
- * in wp_register_core_abilities(), the settings abilities live in a dedicated class
+ * Unlike the core abilities registered directly in wp_register_core_abilities() as
+ * self-contained closures, the settings abilities live in a dedicated class
  * because they share state: the set of exposed settings is computed once at registration
  * and reused by the input schema, the output schema, and the execute callback, and the