![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 5 months ago
Last modified 9 days ago
#64657 assigned enhancement
Add `core/read-users` ability
| Reported by: | jorgefilipecosta | Owned by: | jorgefilipecosta |
|---|---|---|---|
| Priority: | normal | Milestone: | 7.1 |
| Component: | Abilities API | Version: | |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description (last modified by )
Introduce a new Abilities API ability, core/read-users, to retrieve profile data for a specific user or a collection of users.
Core currently has core/get-user-info for the current authenticated user only. Agent/workflows use cases need to be able to look up any user when permissions allow it.
References
Change History (15)
This ticket was mentioned in PR #11434 on WordPress/wordpress-develop by @iamadisingh.
3 months ago
#2
- Keywords has-patch added
This ticket was mentioned in Slack in #core-ai by aditya_singh. View the logs.
3 months ago
This ticket was mentioned in PR #11525 on WordPress/wordpress-develop by @sangu3105.
3 months ago
#4
Ticket: 64657
Link: https://core.trac.wordpress.org/ticket/64657
Registered a new Ability of Get User info and Show_in_rest is true.
#5
@
3 months ago
- Component AI → Abilities API
Moving tickets related to the Abilities API to a new sub-component.
#7
@
8 weeks ago
Removing trunk version as this is not going to be shipped with WP 7.0 but in the next releases.
#8
@
7 weeks ago
- Keywords abilities removed
Removing abilities and abilities-api custom keywords. This is now indicated by the Abilities API component.
#9
@
7 weeks ago
- Keywords abilities added
- Version trunk
Since this is an enhancement, there's no first version of WordPress this can be reproduced in. Removing trunk version.
#10
@
7 weeks ago
- Milestone Future Release → 7.1
#65234 added several enhancements to core/get-user-info like more supported fields (most of these listed in the description of this ticket), a way to filter which fields get returned. For me, it looks like the best past forward is to extend the existing ability by allowing passing the user identifier as proposed here:
Require one of: id (integer), username (string), or email (string).
In practice, they would all be optional, and only one could be provided in a single call.
Following the user permission validation:
- User must be logged in.
- Users can view their own record.
- Viewing other users requires
list_users.
Two firsts conditions are implemented, so it all boils down to the third condition when viewing other user profiles.
@mukesh27 commented on PR #11434:
4 weeks ago
#12
Closing in favour on #11525
#13
@
10 days ago
- Description modified (diff)
- Summary Add `core/get-user` ability → Add `core/read-users` ability
This ticket was mentioned in PR #10775 on WordPress/wordpress-develop by @jorgefilipecosta.
10 days ago
#14
- Keywords has-unit-tests added
## What?
- Adds a read-only
core/usersability registered from Core ability registration. - Supports single-user lookup by
id,user_email,user_login, oruser_nicename. - Supports collection mode with optional
roles,has_published_posts,page,per_page, andfields; omitted REST input defaults to empty collection mode. - Uses WP_User-shaped field names, including
user_login,user_email,user_nicename,user_url, anduser_registered, to align with Core’s existingcore/get-user-infoability. - Aligns access checks with the REST users controller: non-list users only see public authors in collection mode, role filtering requires
list_users, user email/login lookup for another user requireslist_usersoredit_user, and inaccessible fields are omitted per user. - Excludes capabilities, extra capabilities, and meta;
avatar_urlsis available only whenget_option( 'show_avatars' )is enabled.
Ticket: https://core.trac.wordpress.org/ticket/64657
## Testing
php -l src/wp-includes/abilities/class-wp-users-abilities.phpphp -l src/wp-includes/abilities.phpphp -l tests/phpunit/tests/abilities-api/wpRegisterCoreUsersAbility.phpphp ./vendor/bin/phpcs --standard=phpcs.xml.dist --warning-severity=0 src/wp-includes/abilities.php src/wp-includes/abilities/class-wp-users-abilities.php tests/phpunit/tests/abilities-api/wpRegisterCoreUsersAbility.phpphp ./vendor/bin/phpunit --filter Tests_Abilities_API_WpRegisterCoreUsersAbility --group abilities-apiphp ./vendor/bin/phpunit --group abilities-apigit diff --check
#15
@
9 days ago
- Description modified (diff)
- Keywords abilities removed
Core currently has core/get-user-info for the current authenticated user only (and not exposed in REST).
I updated that part, as all core abilities are now exposed through the REST API. I didn't find any evidence that an exception should be kept for core/get-user-info.
Adds a new
core/get-userability to the Abilities API that retrieves profile data for a specific user byid,username, oremail. User must be logged in. Users can view their own record. Viewing other users requireslist_users.Trac ticket: https://core.trac.wordpress.org/ticket/64657
## Use of AI Tools