Comments: Use the note permission check when deleting reactions

[ramonopoly]

Reactions (#64638) are stored as comments under a note and go through the /wp/v2/comments endpoint. When they were added in r64488, the intent was for reactions to be created and deleted using the same permission checks as notes: edit_post on the note's post.

Most of the controller already does this. WP_REST_Comments_Controller::check_edit_permission(), which decides who can delete a comment, sends notes through edit_comment (since r64875) but does not include reactions yet. A reaction therefore falls back to the permission rules for regular comments when it is deleted.

This patch adds reaction next to note in that check, so a reaction follows the same rules as the note it belongs to. Reactions already cannot be updated, so only deletion changes. Regular comments are not affected.

Includes a unit test.

cc @adamsilverstein

What

Deleting a reaction through /wp/v2/comments now uses the same permission check as the note it belongs to: edit access to the note's post.

Why

Reactions were added in r64488 to use the note permission checks, and most of the controller already does. check_edit_permission(), which decides who can delete a comment, sends notes through edit_comment since r64875 but doesn't include reactions yet. Deleting a reaction therefore falls back to the permission rules for regular comments. Reactions can't be updated, so deleting is the only action affected.

What changed

• WP_REST_Comments_Controller::check_edit_permission() treats reaction the same as note.
• New test: a user who can moderate comments but can't edit posts can't delete a reaction on a post they can't edit.

Manual testing

1. Give the Author role comment moderation: npm run env:cli -- cap add author moderate_comments.
2. As an Administrator, create a draft post and note its ID (POST). In the block editor console, add a note, then a reaction to it (NOTE is the note's ID):

wp.apiFetch( { path: '/wp/v2/comments', method: 'POST', data: { post: POST, type: 'note', content: 'Test note' } } ).then( console.log );
   wp.apiFetch( { path: '/wp/v2/comments', method: 'POST', data: { post: POST, parent: NOTE, type: 'reaction', content: '2764' } } ).then( console.log );

3. Log in as an Author, open the editor on a post of your own, and delete the reaction (REACTION is its ID). This should return 403 rest_cannot_delete. On trunk it returns 200.

wp.apiFetch( { path: '/wp/v2/comments/REACTION?force=true', method: 'DELETE' } ).then( console.log ).catch( console.log );

4. As the Administrator, run the same delete. It should return 200.
5. Undo step 1: npm run env:cli -- cap remove author moderate_comments.

Use of AI Tools

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See ​GitHub Pull Requests for Code Review in the Core Handbook for more details.

[kirasong]

Tested the patch and verified it fixes the issue as described + expected.

Tested on 7.2-beta3-64990 with real REST requests (cookie auth + nonce) and a Comment Moderator role that only has read and moderate_comments.

Before the patch the moderator gets a 200 and the reaction is deleted, even though the same user gets a 403 on the note it belongs to. With the patch it's a 403 and the reaction stays. Moderator on a regular comment, editor on their own and the admin's reaction, and contributor all behave the same before and after.

Full results on the ticket: https://core.trac.wordpress.org/ticket/66406

Thanks for testing, folks!

[ramonopoly]

In 65038:

Comments: Use the note permission check when deleting reactions

Deleting a reaction through /wp/v2/comments now uses the same permission check as the note it belongs to: edit access (edit_comment) to the note's post.

Follow-up to r64488.

Props kirasong, adamsilverstein, sadmansakibnadvi, talldan.

Fixes #66406.