WP REST API shows all metaboxes for all custom post types

[sparkdevelopment]

Versions

• CMB 2.4.2
• WP 4.9.8

Expected Behavior:

When registering metaboxes for two different custom post types to be visible in the REST API (using /wp/v2/{post_type}) the 'cmb2' object in REST response will only contain the metaboxes for that post type.

Actual Behavior:

The REST response for both post types contains all metaboxes, albeit the fields in the boxes not registered to that post type all have empty values

Steps to reproduce (I have confirmed I can reproduce this issue on the trunk branch):

1. Register two custom post types, each with show_in_rest => true
2. Create a CMB2 metabox for each post type, again with show_in_rest => true
3. Ensure they are initialised on the cmb2_init hook instead of cmb2_admin_init
4. Inspect the REST API response for either post type - they should show object for both metaboxes under the cmb2 key, the correct one will be populated with values, the other will not

CMB2 Field Registration Code:

// Metabox for 'office' CPT
add_action( 'cmb2_init', 'office_register_metabox' );
function office_register_metabox() {
	$cmb = new_cmb2_box( array(
		'id'           => 'office_description_metabox',
		'title'        => esc_html__( 'Office info', 'domain' ),
		'object_types' => 'office',
		'show_in_rest' => true,
	) );

	// Fields are irrelevant - they could be any fields
	$cmb->add_field( array(
		// Field Config...
	) );
}

// Metabox for 'country' CPT
add_action( 'cmb2_init', 'country_register_metabox' );
function country_register_metabox() {
	$cmb = new_cmb2_box( array(
		'id'           => 'country_description_metabox',
		'title'        => esc_html__( 'Country info', 'domain' ),
		'object_types' => 'country',
		'show_in_rest' => true,
	) );

	// Fields are irrelevant - they could be any fields
	$cmb->add_field( array(
		// Field Config...
	) );
}

[Mte90]

I can confirm this issue, I am working for a project to redo all the endpoint to avoid this problem.

[Mte90]

Seems that https://github.com/CMB2/CMB2/blob/develop/includes/rest-api/CMB2_REST.php#L404 rest_box include the right metabox but read_fields return all the fiedls also of other metabox

[Mte90]

And I did a pr with the bugfix #1238 :-)