Core Data: Add support for fetching permissions of custom actions

docs/designers-developers/developers/data/data-core-editor.md

@@ -12,18 +12,6 @@ _Related_
 
 -   canInsertBlockType in core/block-editor store.
 
-<a name="canUserUseUnfilteredHTML" href="#canUserUseUnfilteredHTML">#</a> **canUserUseUnfilteredHTML**
-
-Returns whether or not the user has the unfiltered_html capability.
-
-_Parameters_
-
--   _state_ `Object`: Editor state.
-
-_Returns_
-
--   `boolean`: Whether the user can or can't post unfiltered HTML.
-
 <a name="didPostSaveRequestFail" href="#didPostSaveRequestFail">#</a> **didPostSaveRequestFail**
 
 Returns true if a previous post save was attempted but failed, or false

packages/core-data/src/resolvers.js

@@ -127,8 +127,8 @@ export function* hasUploadPermissions() {
  * Checks whether the current user can perform the given action on the given
  * REST resource.
  *
- * @param {string}  action   Action to check. One of: 'create', 'read', 'update',
- *                           'delete'.
+ * @param {string}  action   Action to check. One of 'create', 'read', 'update',
+ *                           'delete', or a JSON Hyper Schema targetSchema key.
  * @param {string}  resource REST resource to check, e.g. 'media' or 'posts'.
  * @param {?string} id       ID of the rest resource to check.
  */
@@ -140,43 +140,61 @@ export function* canUser( action, resource, id ) {
 		delete: 'DELETE',
 	};
 
-	const method = methods[ action ];
-	if ( ! method ) {
-		throw new Error( `'${ action }' is not a valid action.` );
+	const isCustomAction = ! methods.hasOwnProperty( action );
+
+	let path = '/wp/v2/' + resource;
+
+	if ( id ) {
+		path += '/' + id;
 	}
 
-	const path = id ? `/wp/v2/${ resource }/${ id }` : `/wp/v2/${ resource }`;
+	if ( isCustomAction ) {
+		path = addQueryArgs( path, { context: 'edit' } );
+	}
 
 	let response;
 	try {
 		response = yield apiFetch( {
 			path,
-			// Ideally this would always be an OPTIONS request, but unfortunately there's
-			// a bug in the REST API which causes the Allow header to not be sent on
-			// OPTIONS requests to /posts/:id routes.
-			// https://core.trac.wordpress.org/ticket/45753
-			method: id ? 'GET' : 'OPTIONS',
-			parse: false,
+			// Ideally, this should only be a GET request if requesting details
+			// of a custom action. Until required WordPress support reaches 5.3
+			// or newer, the `id` condition must be included, due to a previous
+			// bug in the REST API where the Allow header was not on OPTIONS
+			// requests to /posts/:id routes.
+			//
+			// See: https://core.trac.wordpress.org/ticket/45753
+			method: id || isCustomAction ? 'GET' : 'OPTIONS',
+
+			// Only parse response as JSON if requesting permissions of a custom
+			// actions. Non-custom actions derive permissions from the response
+			// headers, which aren't available on the parsed result.
+			parse: isCustomAction,
 		} );
 	} catch ( error ) {
 		// Do nothing if our OPTIONS request comes back with an API error (4xx or
 		// 5xx). The previously determined isAllowed value will remain in the store.
 		return;
 	}
 
-	let allowHeader;
-	if ( hasIn( response, [ 'headers', 'get' ] ) ) {
-		// If the request is fetched using the fetch api, the header can be
-		// retrieved using the 'get' method.
-		allowHeader = response.headers.get( 'allow' );
+	let isAllowed;
+	if ( isCustomAction ) {
+		isAllowed = hasIn( response, [ '_links', 'wp:action-' + action ] );
 	} else {
-		// If the request was preloaded server-side and is returned by the
-		// preloading middleware, the header will be a simple property.
-		allowHeader = get( response, [ 'headers', 'Allow' ], '' );
+		let allowHeader;
+		if ( hasIn( response, [ 'headers', 'get' ] ) ) {
+			// If the request is fetched using the fetch api, the header can be
+			// retrieved using the 'get' method.
+			allowHeader = response.headers.get( 'allow' );
+		} else {
+			// If the request was preloaded server-side and is returned by the
+			// preloading middleware, the header will be a simple property.
+			allowHeader = get( response, [ 'headers', 'Allow' ], '' );
+		}
+
+		isAllowed = includes( allowHeader, methods[ action ] );
 	}
 
 	const key = compact( [ action, resource, id ] ).join( '/' );
-	const isAllowed = includes( allowHeader, method );
 	yield receiveUserPermission( key, isAllowed );
 }
 

packages/core-data/src/test/resolvers.js

@@ -158,6 +158,32 @@ describe( 'canUser', () => {
 		expect( received.done ).toBe( true );
 		expect( received.value ).toBeUndefined();
 	} );
+
+	it( 'receives custom actions', () => {
+		const generator = canUser( 'publish', 'posts' );
+
+		let received = generator.next();
+		expect( received.done ).toBe( false );
+		expect( received.value ).toEqual( apiFetch( {
+			path: '/wp/v2/posts?context=edit',
+			method: 'GET',
+			parse: true,
+		} ) );
+
+		received = generator.next( {
+			_links: {
+				'wp:action-publish': [
+					{ href: 'http://localhost:8888/wp-json/wp/v2/posts' },
+				],
+			},
+		} );
+		expect( received.done ).toBe( false );
+		expect( received.value ).toEqual( receiveUserPermission( 'publish/posts', true ) );
+
+		received = generator.next();
+		expect( received.done ).toBe( true );
+		expect( received.value ).toBeUndefined();
+	} );
 } );
 
 describe( 'getAutosaves', () => {

packages/edit-post/src/components/header/post-publish-button-or-toggle.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -76,11 +71,7 @@ export function PostPublishButtonOrToggle( {
 
 export default compose(
 	withSelect( ( select ) => ( {
-		hasPublishAction: get(
-			select( 'core/editor' ).getCurrentPost(),
-			[ '_links', 'wp:action-publish' ],
-			false
-		),
+		hasPublishAction: select( 'core' ).canUser( 'publish', 'posts', select( 'core/editor' ).getCurrentPostId() ),
 		isBeingScheduled: select( 'core/editor' ).isEditedPostBeingScheduled(),
 		isPending: select( 'core/editor' ).isCurrentPostPending(),
 		isPublished: select( 'core/editor' ).isCurrentPostPublished(),

packages/editor/src/components/post-author/check.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -24,9 +19,9 @@ export function PostAuthorCheck( { hasAssignAuthorAction, authors, children } )
 
 export default compose( [
 	withSelect( ( select ) => {
-		const post = select( 'core/editor' ).getCurrentPost();
+		const postId = select( 'core/editor' ).getCurrentPostId();
 		return {
-			hasAssignAuthorAction: get( post, [ '_links', 'wp:action-assign-author' ], false ),
+			hasAssignAuthorAction: select( 'core' ).canUser( 'assign-author', 'posts', postId ),
 			postType: select( 'core/editor' ).getCurrentPostType(),
 			authors: select( 'core' ).getAuthors(),
 		};

packages/editor/src/components/post-pending-status/check.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -19,9 +14,9 @@ export function PostPendingStatusCheck( { hasPublishAction, isPublished, childre
 
 export default compose(
 	withSelect( ( select ) => {
-		const { isCurrentPostPublished, getCurrentPostType, getCurrentPost } = select( 'core/editor' );
+		const { isCurrentPostPublished, getCurrentPostType, getCurrentPostId } = select( 'core/editor' );
 		return {
-			hasPublishAction: get( getCurrentPost(), [ '_links', 'wp:action-publish' ], false ),
+			hasPublishAction: select( 'core' ).canUser( 'publish', 'posts', getCurrentPostId() ),
 			isPublished: isCurrentPostPublished(),
 			postType: getCurrentPostType(),
 		};

packages/editor/src/components/post-publish-button/index.js

@@ -1,7 +1,7 @@
 /**
  * External dependencies
  */
-import { noop, get } from 'lodash';
+import { noop } from 'lodash';
 import classnames from 'classnames';
 import memoize from 'memize';
 import EquivalentKeyMap from 'equivalent-key-map';
@@ -201,11 +201,11 @@ export default compose( [
 			isEditedPostSaveable,
 			isEditedPostPublishable,
 			isPostSavingLocked,
-			getCurrentPost,
 			getCurrentPostType,
 			getCurrentPostId,
 			hasNonPostEntityChanges,
 		} = select( 'core/editor' );
+		const { canUser } = select( 'core' );
 		return {
 			isSaving: isSavingPost(),
 			isBeingScheduled: isEditedPostBeingScheduled(),
@@ -214,7 +214,7 @@ export default compose( [
 			isPostSavingLocked: isPostSavingLocked(),
 			isPublishable: isEditedPostPublishable(),
 			isPublished: isCurrentPostPublished(),
-			hasPublishAction: get( getCurrentPost(), [ '_links', 'wp:action-publish' ], false ),
+			hasPublishAction: canUser( 'publish', 'posts', getCurrentPostId() ),
 			postType: getCurrentPostType(),
 			postId: getCurrentPostId(),
 			hasNonPostEntityChanges: hasNonPostEntityChanges(),

packages/editor/src/components/post-publish-button/label.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -47,16 +42,17 @@ export default compose( [
 			isEditedPostBeingScheduled,
 			isSavingPost,
 			isPublishingPost,
-			getCurrentPost,
+			getCurrentPostId,
 			getCurrentPostType,
 			isAutosavingPost,
 		} = select( 'core/editor' );
+		const { canUser } = select( 'core' );
 		return {
 			isPublished: isCurrentPostPublished(),
 			isBeingScheduled: isEditedPostBeingScheduled(),
 			isSaving: forceIsSaving || isSavingPost(),
 			isPublishing: isPublishingPost(),
-			hasPublishAction: get( getCurrentPost(), [ '_links', 'wp:action-publish' ], false ),
+			hasPublishAction: canUser( 'publish', 'posts', getCurrentPostId() ),
 			postType: getCurrentPostType(),
 			isAutosaving: isAutosavingPost(),
 		};

packages/editor/src/components/post-publish-panel/index.js

@@ -111,9 +111,9 @@ export class PostPublishPanel extends Component {
 
 export default compose( [
 	withSelect( ( select ) => {
-		const { getPostType } = select( 'core' );
+		const { canUser, getPostType } = select( 'core' );
 		const {
-			getCurrentPost,
+			getCurrentPostId,
 			getEditedPostAttribute,
 			isCurrentPostPublished,
 			isCurrentPostScheduled,
@@ -125,7 +125,7 @@ export default compose( [
 		const postType = getPostType( getEditedPostAttribute( 'type' ) );
 
 		return {
-			hasPublishAction: get( getCurrentPost(), [ '_links', 'wp:action-publish' ], false ),
+			hasPublishAction: canUser( 'publish', 'posts', getCurrentPostId() ),
 			isPostTypeViewable: get( postType, [ 'viewable' ], false ),
 			isBeingScheduled: isEditedPostBeingScheduled(),
 			isDirty: isEditedPostDirty(),

packages/editor/src/components/post-publish-panel/prepublish.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -68,11 +63,12 @@ function PostPublishPanelPrepublish( {
 export default withSelect(
 	( select ) => {
 		const {
-			getCurrentPost,
+			getCurrentPostId,
 			isEditedPostBeingScheduled,
 		} = select( 'core/editor' );
+		const { canUser } = select( 'core' );
 		return {
-			hasPublishAction: get( getCurrentPost(), [ '_links', 'wp:action-publish' ], false ),
+			hasPublishAction: canUser( 'publish', 'posts', getCurrentPostId() ),
 			isBeingScheduled: isEditedPostBeingScheduled(),
 		};
 	}

packages/editor/src/components/post-saved-state/index.js

@@ -2,7 +2,6 @@
  * External dependencies
  */
 import classnames from 'classnames';
-import { get } from 'lodash';
 
 /**
  * WordPress dependencies
@@ -44,7 +43,7 @@ export class PostSavedState extends Component {
 
 	render() {
 		const {
-			post,
+			hasPublishAction,
 			isNew,
 			isScheduled,
 			isPublished,
@@ -96,7 +95,6 @@ export class PostSavedState extends Component {
 
 		// Once the post has been submitted for review this button
 		// is not needed for the contributor role.
-		const hasPublishAction = get( post, [ '_links', 'wp:action-publish' ], false );
 		if ( ! hasPublishAction && isPending ) {
 			return null;
 		}
@@ -136,12 +134,13 @@ export default compose( [
 			isEditedPostDirty,
 			isSavingPost,
 			isEditedPostSaveable,
-			getCurrentPost,
+			getCurrentPostId,
 			isAutosavingPost,
 			getEditedPostAttribute,
 		} = select( 'core/editor' );
+		const { canUser } = select( 'core' );
 		return {
-			post: getCurrentPost(),
+			hasPublishAction: canUser( 'publish', 'posts', getCurrentPostId() ),
 			isNew: isEditedPostNew(),
 			isPublished: isCurrentPostPublished(),
 			isScheduled: isCurrentPostScheduled(),

packages/editor/src/components/post-schedule/check.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -19,9 +14,10 @@ export function PostScheduleCheck( { hasPublishAction, children } ) {
 
 export default compose( [
 	withSelect( ( select ) => {
-		const { getCurrentPost, getCurrentPostType } = select( 'core/editor' );
+		const { getCurrentPostId, getCurrentPostType } = select( 'core/editor' );
+		const { canUser } = select( 'core' );
 		return {
-			hasPublishAction: get( getCurrentPost(), [ '_links', 'wp:action-publish' ], false ),
+			hasPublishAction: canUser( 'publish', 'posts', getCurrentPostId() ),
 			postType: getCurrentPostType(),
 		};
 	} ),

packages/editor/src/components/post-sticky/check.js

@@ -1,8 +1,3 @@
-/**
- * External dependencies
- */
-import { get } from 'lodash';
-
 /**
  * WordPress dependencies
  */
@@ -22,10 +17,11 @@ export function PostStickyCheck( { hasStickyAction, postType, children } ) {
 
 export default compose( [
 	withSelect( ( select ) => {
-		const post = select( 'core/editor' ).getCurrentPost();
+		const { canUser } = select( 'core' );
+		const { getCurrentPostId, getCurrentPostType } = select( 'core/editor' );
 		return {
-			hasStickyAction: get( post, [ '_links', 'wp:action-sticky' ], false ),
-			postType: select( 'core/editor' ).getCurrentPostType(),
+			hasStickyAction: canUser( 'sticky', 'posts', getCurrentPostId() ),
+			postType: getCurrentPostType(),
 		};
 	} ),
 ] )( PostStickyCheck );