Changeset 64388

Timestamp:

10/16/2026 10:28:45 AM (29 hours ago)

Author:

jorgefilipecosta

Message:

Abilities API: Add the core/content-query ability.

Adds a read-only core/content-query ability that returns a page of the posts of one post type, optionally filtered by IDs, slugs, status, author, or parent. Until now, Core had no ability to read posts. The code lives in the new private WP_Abilities_Content class, and the ability is registered in a new content category.
Post types opt in with the new show_in_abilities argument of register_post_type(), which defaults to false. Only true exposes a post type, and the post and page post types set it.

Developed in ​https://github.com/WordPress/ai/pull/739 and ​https://github.com/WordPress/wordpress-develop/pull/12195.

Props jorgefilipecosta, gziolo, peterwilsoncc, ovidiu-galatan, justlevine, ugyensupport, dkotter, jason_the_adams, jasonbahl, jeffpaul.
Fixes #66268.

Location:

trunk

Files:

• src/wp-includes/abilities.php (modified) (5 diffs)
• src/wp-includes/abilities/class-wp-abilities-content.php (added)
• src/wp-includes/class-wp-post-type.php (modified) (3 diffs)
• src/wp-includes/post.php (modified) (4 diffs)
• tests/phpunit/tests/abilities-api/wpRegisterCoreContentAbility.php (added)
• tests/phpunit/tests/rest-api/wpRestAbilitiesContentController.php (added)

trunk/src/wp-includes/abilities.php

@@ -10 +10 @@
 declare( strict_types = 1 );
 
+require_once __DIR__ . '/abilities/class-wp-abilities-content.php';
 require_once __DIR__ . '/abilities/class-wp-abilities-settings.php';
 require_once __DIR__ . '/abilities/class-wp-abilities-users.php';
@@ -17 +18 @@
  *
  * @since 6.9.0
- * @since 7.2.0 Added the `uncategorized` category.
+ * @since 7.2.0 Added the `content` and `uncategorized` categories.
  */
 function wp_register_core_ability_categories(): void {
@@ -37 +38 @@
 
         wp_register_ability_category(
+                'content',
+                array(
+                        'label'       => __( 'Content' ),
+                        'description' => __( 'Abilities that retrieve or manage posts and other content.' ),
+                )
+        );
+
+        wp_register_ability_category(
                 'uncategorized',
                 array(
@@ -49 +58 @@
  *
  * @since 6.9.0
- * @since 7.2.0 Added the `core/settings-get` and `core/users-query` abilities.
+ * @since 7.2.0 Added the `core/content-query`, `core/settings-get`, and `core/users-query` abilities.
  *
  * @global wpdb $wpdb WordPress database abstraction object.
@@ -371 +380 @@
         // Register the user abilities (currently the read-only `core/users-query`).
         ( new WP_Abilities_Users() )->register();
+
+        // Register the content abilities (currently the read-only `core/content-query`).
+        ( new WP_Abilities_Content() )->register();
 }

trunk/src/wp-includes/class-wp-post-type.php

@@ -373 +373 @@
          */
         public $show_in_rest;
+
+        /**
+         * Whether this post type should be exposed through the Abilities API.
+         *
+         * Default false. If true, the core content abilities can access the post type's
+         * posts, subject to the current user's capabilities.
+         *
+         * @since 7.2.0
+         * @var bool $show_in_abilities
+         */
+        public $show_in_abilities;
 
         /**
@@ -554 +565 @@
                         'delete_with_user'                => null,
                         'show_in_rest'                    => false,
+                        'show_in_abilities'               => false,
                         'rest_base'                       => false,
                         'rest_namespace'                  => false,
@@ -583 +595 @@
                         $args['rest_namespace'] = 'wp/v2';
                 }
+
+                // Only `true` exposes the post type, so other values, such as arrays, can be given a meaning later.
+                $args['show_in_abilities'] = true === $args['show_in_abilities'];
 
                 // If not set, default to the setting for 'show_ui'.

trunk/src/wp-includes/post.php

@@ -51 +51 @@
                         ),
                         'show_in_rest'          => true,
+                        'show_in_abilities'     => true,
                         'rest_base'             => 'posts',
                         'rest_controller_class' => 'WP_REST_Posts_Controller',
@@ -85 +86 @@
                         ),
                         'show_in_rest'          => true,
+                        'show_in_abilities'     => true,
                         'rest_base'             => 'pages',
                         'rest_controller_class' => 'WP_REST_Posts_Controller',
@@ -1692 +1694 @@
  * @since 5.3.0 The `supports` argument will now accept an array of arguments for a feature.
  * @since 5.9.0 The `rest_namespace` argument was added.
+ * @since 7.2.0 The `show_in_abilities` argument was added.
  *
  * @global array $wp_post_types List of post types.
@@ -1737 +1740 @@
  *     @type bool         $show_in_rest                    Whether to include the post type in the REST API. Set this to true
  *                                                         for the post type to be available in the block editor.
+ *     @type bool         $show_in_abilities               Whether to expose this post type through the Abilities API, so the
+ *                                                         core content abilities can access its posts, subject to the current
+ *                                                         user's capabilities. Default false.
  *     @type string       $rest_base                       To change the base URL of REST API route. Default is $post_type.
  *     @type string       $rest_namespace                  To change the namespace URL of REST API route. Default is wp/v2.