read_post_meta should be a meta capability

[rmccue]

Right now, we have edit_post_meta, delete_post_meta, and add_post_meta. In order to be able to expose metadata publicly, we need to be able to check if we can access individual keys.

is_protected_meta only controls whether it's prefixed and should default to being protected (by default, prefixed with _). This isn't adequate to check for read permission on a key, because it's not filterable.

[rachelbaker]

Moving out of 4.2 milestone since this needs discussion and a patch.

[swissspidy]

@rmccue @rachelbaker I suppose this was asked regarding the REST API? How is this currently handled there?

Having a read_post_meta capability seems legit to me.