[chubes4]

Summary

Follow-up to a security advisory. datamachine/upsert-post was authorized by the chat action alone. Its execute path then wrote whatever post type, status, author, target post, meta and terms the caller supplied, without any WordPress object capability checks. This PR authorizes each write against WordPress capabilities for the acting principal.

datamachine/upsert-post

• Insert: needs the post type's create_posts. publish, future and private also need publish_posts, and so does creating parent stubs, because stubs are published. Unregistered post types are limited to principals with manage_options.
• Update: needs edit_post on the target, whether it comes from post_id, slug or identity meta. The check runs in the permission callback and again at write time against the post that was actually resolved. Only a shell allocated by the request's own identity reservation skips it. A status change to publish still needs publish_posts, and trashing needs delete_post.
• Other authors and protected meta: a post_author other than the acting user needs edit_others_posts. Protected (underscore-prefixed) meta_input keys and the identity_meta key need it too.
• Terms: assigning terms needs assign_terms on the taxonomy. Unknown terms are only created when the caller has edit_terms.
• Errors: refusals return upsert_post_forbidden (HTTP 403).

PermissionHelper::can_wp_capability()

New principal-aware helper for primitive and meta capabilities. It uses the same trusted contexts as can(): WP-CLI subject to datamachine_cli_bypass_permissions, Action Scheduler queue runs, and system context.

• Agent context: checks the agent owner's capabilities. An active capability ceiling must allow every primitive capability that the meta capability maps to. An agent acting for a user never gets more than that user's capabilities.
• No admin shortcut: unlike can(), manage_options is not treated as a blanket grant. WordPress capability mapping decides.

Sibling chat-gated abilities reviewed

Ability	Finding	Change
write-self-memory	Wrote any file with no editability check. Protected or capability-gated memory files, such as the shared site rules file, could be written.	Applies the same MemoryFileRegistry::is_editable() contract as the regular memory write path. The check uses the same filename normalization as the store, so variant spellings can't get around it.
sign-pending-action-resolution	Minted approve/reject URLs for any pending action ID. Signed URLs carry resolution authority on their own.	Only signs actions inside the caller's pending-action scope (PendingActionScope). Managers keep operator-wide reach.
create-agent	Non-admins are forced to be the owner and the per-user limit applies. Caller-supplied config only affects the caller's own agent, and its tool execution stays within the owner's capabilities.	None
submit/get/retry/cancel-delegated-operation	The permission callback only checks identity, by design. The action owner's mandatory authorize callback runs on every phase and receives the actor.	None

Compatibility

• Trusted contexts (CLI, Action Scheduler imports, system context) keep working unchanged.
• Callers acting as administrators keep working unchanged.
• Callers that relied on chat-only access for lower roles will now get 403s where WordPress would also deny.

Tests

• New UpsertPostPermissionTest (SQLite-safe), covering:
  • A subscriber with chat is denied insert, update and publish.
  • An author can create their own draft and publish. They can't edit someone else's post by ID or slug, can't set another author, and can't set protected meta.
  • An editor can edit others' posts.
  • A contributor can create pending posts but can't publish, schedule or make private, and can't publish their own pending post.
  • The agent token capability ceiling bounds the owner's capabilities.
  • System context still works.
  • Logged-out callers are denied.
• UpsertPostAbilityTest now runs as an administrator.
• Smoke coverage added for:
  • protected memory files refused by write-self-memory
  • out-of-scope signing refused, with the owner still able to sign
• Results:
  • SQLite PHPUnit full suite: OK (1776 tests, 55 skipped).
  • Filtered run (UpsertPostAbilityTest|UpsertPostPermissionTest|PermissionHelperTest|MultiAgentScoping|SelfServiceAgentCreation): 77/77.
  • UpsertPostAbilityTest normally runs only on MySQL, which wasn't available locally. Forced onto SQLite, it showed the same 20 SQLite-only failures on this branch as on main. CI will run it on MySQL.
  • Standalone smokes: email-multi-inbox-forward-smoke fails identically on main. All others pass.

AI assistance

This PR was written by an AI agent (Claude) via Extra Chill Bot.