Improve post permission handling in Content Intelligence REST endpoints

[acicovic]

Fixes #4525

Description

is_pch_feature_enabled_for_user() never passed a post ID to Permissions::current_user_can_use_pch_feature(), so the current_user_can( 'edit_post', $post_id ) check that method already performs was unreachable for every endpoint using the trait.

is_available_to_current_user() now collects the post IDs a request names — post_id and source_post_id — and authorizes each through the same check. Routing through current_user_can_use_pch_feature() keeps the wp_parsely_current_user_can_use_pch_feature filter in play, which now receives a real post ID on REST requests instead of false.

Traffic Boost's accept-suggestion, update-inbound and delete-inbound resolve their source post from a stored Smart Link, so it isn't in the request and the permission callback can't see it. Those handlers and generate-placement get an explicit guard.

The second commit filters the Traffic Boost link lists to source posts the user can act on. Kept separate as a distinct concern.

Motivation and context

The rule already existed and was already applied on the rendering path; only the REST chain omitted the argument.

Authors are the role affected in practice — Editors and Administrators hold edit_others_posts, so nothing changes for them. This does narrow Traffic Boost for Authors to posts they can edit; sites wanting the previous reach can scope the filter per post, which is now possible.

How has this been tested?

18 new integration tests across EndpointTrafficBoostAuthorizationTest and EndpointSmartLinkingAuthorizationTest, covering the permission callback, both Traffic Boost handlers, all post statuses plus pages, and the list filtering. Every denial test is paired with a positive case, so an over-broad check fails the suite. Confirmed they fail on develop and pass here.

Run single-site and with WP_MULTISITE=1, existing results unchanged. Unit suite, PHPCS --severity=1, PHPStan level 9 and composer lint pass. develop merged in.

[coderabbitai]

Warning

Review limit reached

@acicovic, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 27 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ea3ae5d-ece5-4413-a454-1cbd016e12af

📥 Commits

Reviewing files that changed from the base of the PR and between f503ce6 and 82bb9c3.

📒 Files selected for processing (4)

• src/rest-api/content-helper/class-endpoint-traffic-boost.php
• src/rest-api/content-helper/trait-content-helper-feature.php
• tests/Integration/RestAPI/ContentHelper/EndpointSmartLinkingAuthorizationTest.php
• tests/Integration/RestAPI/ContentHelper/EndpointTrafficBoostAuthorizationTest.php

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}