← All changes | includes/class-rest-manager.php +86 -8 1.0.7 → 1.4.0 View file →

		@@ -30,16 +30,25 @@
30	30	/**
31	31	* Register every route a module declared, prefixed with its slug.
32	32	*/
33	33	public static function register_module( Module $module ): void {
34		- $routes = $module->rest_routes();
35		- if ( empty( $routes ) ) {
36		- return;
37		- }
38		-
	34	+ // rest_routes() is resolved INSIDE the callback, not here.
	35	+ //
	36	+ // This method runs at plugins_loaded, before `init`. Calling
	37	+ // rest_routes() there makes a module build its settings schema, and
	38	+ // those schemas carry __() labels — so WordPress emitted a
	39	+ // _load_textdomain_just_in_time notice for every module, on every
	40	+ // request including the front end (135 per page load with WP_DEBUG on).
	41	+ // The eager call existed only to skip add_action() for modules with no
	42	+ // routes; deferring costs one no-op hook each and moves all translation
	43	+ // work to where it belongs. (QA, 9 Aug 2026)
39	44	add_action(
40	45	'rest_api_init',
41		- static function () use ( $module, $routes ) {
	46	+ static function () use ( $module ) {
	47	+ $routes = $module->rest_routes();
	48	+ if ( empty( $routes ) ) {
	49	+ return;
	50	+ }
42	51	$slug = $module->slug();
43	52	foreach ( $routes as $route ) {
44	53	$path = '/' . trim( $slug, '/' ) . '/' . ltrim( $route['path'] ?? '', '/' );
45	54	$path = rtrim( $path, '/' );
		@@ -151,18 +160,87 @@
151	160	return $result;
152	161	}
153	162
154	163	/**
	164	+ * Values that are shaped like a capability but cannot be one.
	165	+ *
	166	+ * WordPress's `__return_*` helpers are function names. Passed where a
	167	+ * capability belongs they are simply an unknown capability, and an unknown
	168	+ * capability is denied — so they close a route rather than open it. Listed
	169	+ * literally: the check has to be certain, because a capability that merely
	170	+ * happens to share a name with some function is legitimate.
	171	+ */
	172	+ private const NOT_A_CAPABILITY = array(
	173	+ '__return_true',
	174	+ '__return_false',
	175	+ '__return_zero',
	176	+ '__return_null',
	177	+ '__return_empty_array',
	178	+ '__return_empty_string',
	179	+ );
	180	+
	181	+ /** Whether a declared capability is one `current_user_can()` could grant. */
	182	+ private static function is_capability( $capability ): bool {
	183	+ return is_string( $capability )
	184	+ && '' !== $capability
	185	+ && ! in_array( $capability, self::NOT_A_CAPABILITY, true );
	186	+ }
	187	+
	188	+ /**
155	189	* Wrap permission_callback with the always-on cap check. A module may
156	190	* declare its own permission_callback for an extra-strict gate; both
157	191	* must pass.
	192	+ *
	193	+ * A route may opt out of the capability check with
	194	+ * `'allow_unauthenticated' => true`. That is ONLY for endpoints designed to
	195	+ * be called by anonymous frontend visitors — the RUM beacon is the reason
	196	+ * this exists: it collects Core Web Vitals from real visitors, who by
	197	+ * definition are not logged in, so the default `manage_options` gate
	198	+ * rejected every sample with a 401 and the feature could never record
	199	+ * anything. (FBS-84070)
	200	+ *
	201	+ * Opting out drops ONLY the capability check. A route-declared
	202	+ * `permission_callback` still runs and still has to pass, so a module can
	203	+ * keep its own validation (nonce, rate limit, payload shape) on top.
158	204	*/
159	205	private static function wrap_permission( Module $module, array $route ): callable {
160	206	$declared = $route['permission_callback'] ?? null;
161	207	$capability = $route['capability'] ?? 'manage_options';
	208	+ $public = ! empty( $route['allow_unauthenticated'] );
162	209
163		- return static function ( \WP_REST_Request $request ) use ( $declared, $capability ) {
164		- if ( ! current_user_can( $capability ) ) {
	210	+ if ( ! $public && ! self::is_capability( $capability ) ) {
	211	+ /*
	212	+ * A route that reads as public and is closed to everyone.
	213	+ *
	214	+ * `'capability' => '__return_true'` is the shape this catches: a
	215	+ * function name, not a capability. `current_user_can()` denies an
	216	+ * unknown capability — for an anonymous caller AND for a logged-in
	217	+ * administrator — so the route answers 401 to every request while
	218	+ * looking, to the next person who reads it, like it lets everyone
	219	+ * through. One shipped that way, and what found it was a customer's
	220	+ * 401 rather than any test.
	221	+ *
	222	+ * It stays DENIED. Reading "public" out of a value that cannot be a
	223	+ * capability would turn a typo into an authentication bypass, which
	224	+ * is a far worse failure than the one being reported. The fix is to
	225	+ * say `'allow_unauthenticated' => true`, which is the only thing
	226	+ * that opens a route here, and this says so.
	227	+ */
	228	+ _doing_it_wrong(
	229	+ __METHOD__,
	230	+ esc_html(
	231	+ sprintf(
	232	+ 'Route "%s" declares "%s" as its capability. That is not a capability, so current_user_can() denies every caller, including administrators. Use \'allow_unauthenticated\' => true for a route that is meant to be public.',
	233	+ $module->slug() . ( $route['path'] ?? '' ),
	234	+ is_scalar( $capability ) ? (string) $capability : gettype( $capability )
	235	+ )
	236	+ ),
	237	+ 'xspeed 1.2.5'
	238	+ );
	239	+ }
	240	+
	241	+ return static function ( \WP_REST_Request $request ) use ( $declared, $capability, $public ) {
	242	+ if ( ! $public && ! current_user_can( $capability ) ) {
165	243	return false;
166	244	}
167	245	if ( is_callable( $declared ) ) {
168	246	$result = call_user_func( $declared, $request );