💥 feat(routing): what declares nothing is for administrators (3.0)

[gfazioli]

For 3.0, on v3: what declares nothing is for administrators. This is the breaking half of audit S2, S3 and S9. 2.1.2 (#123) shipped the half that changes nothing.

💥 The defaults

What declares nothing	Up to 2.x	3.0
A page of config/routes.php or pages/ (no capability key, no capability() method)	opened for every logged-in user (read since 2.1.2)	needs manage_options
A menu of config/menus.php (no capability); its items inherit it	read	manage_options
A REST route with no permission_callback	public; with a notice since 2.1.2	refuses every request with WordPress's rest_forbidden (rest_authorization_required_code(): 401 for a visitor, 403 when logged in), and the notice says how to make it public

To keep something open, declare it:

• 'capability' => 'read' for a route page or a menu;
• a capability() returning 'read' for a pages/ class;
• 'permission_callback' => '__return_true' for a REST route.

The 14 boilerplates already declare all of these (checked by running the new report on them).

✨ php bones migrate:to-v3 lists them

The command now also lists every page, menu and REST route that declares nothing, one line each, with the file and, for a route, the line. It reads them from the tokens, because including the config files would need WordPress, and it rewrites nothing: who may open a page is the author's call.

Checked on scratch copies of four boilerplates:

• as shipped: Nothing to change;
• with every capability and __return_true stripped: every one is listed, and the route that has a callback of its own (/protected) is not.

Tests

• composer test: 307 tests and 824 assertions, against 287 and 765 on v3 (rebased on 2.1.3).
  • The route, page and REST tests now assert the 3.0 defaults.
  • New: AdminMenuProviderTest (it fails on v3's provider) and MigrateToV3AccessTest.
• Live, in WPKirk-Developing on wpbones.test, with v3-access-live-smoke.sh:
  • Setup: a subscriber, an administrator and a visitor, against a route, a pages/ class and a menu that declare nothing, and a REST route without a callback, each next to one that declares read or __return_true.
  • master (2.1.2): 7 ✗ of 18. A subscriber opens all three pages, and a visitor gets a 200 from the REST route, with the 2.x wording in the notice.
  • This branch: 18 ✓.

Review

• Copilot: the account's quota is exhausted.

• Codex (gpt-6-sol, high), round 1 (0cf2d5e), three P2s, all in the report:

  • it scanned api/ instead of the folder config/api.php names;
  • a config that returns a variable counted as empty;
  • the string permission_callback anywhere in a call counted as declared.

• Codex, round 2 (973b96b), two P2s: only custom.path names the folder, and only when its value is one whole literal.

• An independent review (a subagent with a clean context) found more, fixed in a779c5a. The report read some files wrong:

  • a constant or interpolated key;
  • an ABSPATH guard's return [];
  • 'capability' => null and 'permission_callback' => null;
  • an aliased, lower-case or nested Route;
  • capability() in a comment, protected, or with arguments.

  It also found two weak tests. The menu test's spy could not see add_menu_page()'s capability, and the REST status stub returned the value the code would hard-code.

• Rebased on v3 after 2.1.3: composer test gives 307 tests and 824 assertions, and v3-access-live-smoke.sh 18 ✓.