Clarify expectations and impact of the 'show_in_json` Post Type flag

[rachelbaker]

@WP-API/amigos

I brought this up in Slack yesterday (https://wordpress.slack.com/archives/core-restapi/p1418160531000324) but wanted to bring the conversation to open up for more timezone friendly discussions.

If a post_type was registered as "show_in_json" => false, does that mean:

1. The post_type cannot be read by anyone, but authenticated users (with the appropriate $post_type capabilities) can still edit or update objects? Current Behavior
2. The post_type cannot be read/edited/created by anyone, no matter the authentication level?
3. Or somewhere in-between?

It seems to me that show_in_json is a post_type level flag that applies to all users no matter their authentication level much like the other post_type registration flags such as:

        'show_ui'
        'show_in_menu' 
        'show_in_nav_menus' 
        'show_in_admin_bar' 

My vote is for the behavior of the 2nd option above.

If you are leaning toward the 1st option, riddle me this: what do we provide as a response if an authenticated user edits a Post when the post_type is set to false? Should we provide the Post object in the response, even though the post_type has show_in_json set to false?

[joehoyle]

@rachelbaker I agree on option 2

[danielbachhuber]

I like option 2, and would rename to access_in_json instead of show_in_json

[rachelbaker]

Option 2 was implemented in 0188656 with the check_is_post_type_allowed method. @WP-API/amigos I believe we landed against renaming the show_in_json parameter. Yes? If so, we can close this issue.

[danielbachhuber]

show_in_json communicates showing, whereas access_in_json communicates accessing. I think we need to rename.

[danielbachhuber]

So show_in_json but we perform the checks for all operations?

[rachelbaker]

@danielbachhuber I closed this because you already had #769 and #820 and looked like you were running with renaming the json flag.

[danielbachhuber]

Oh. Let's keep it open until we have a final decision. I'm ambivalent on the naming, but I don't think we should allow access to any post type operations if false.

[danielbachhuber]

Sticking with show_in_rest: https://wordpress.slack.com/archives/core-restapi/p1449531186001314

The endpoints will only be registered if it's set to true for the post type