Skip to content

Core Data: Avoid duplicate id-less entity permission requests#78262

Merged
Mamaduka merged 1 commit into
WordPress:trunkfrom
chubes4:prove-canuser-options-duplicates
May 15, 2026
Merged

Core Data: Avoid duplicate id-less entity permission requests#78262
Mamaduka merged 1 commit into
WordPress:trunkfrom
chubes4:prove-canuser-options-duplicates

Conversation

@chubes4
Copy link
Copy Markdown
Contributor

@chubes4 chubes4 commented May 14, 2026

What?

Fixes duplicate permission resolution for id-less entity resources in useResourcePermissions() by normalizing the collection resource once and using that same resource for both create and id-less read checks.

Fixes #78260.

Why?

When callers pass an entity resource with id: undefined, create was resolved against the normalized collection resource while read was resolved against the original object. For entities like wp_navigation, both checks target the same REST route, but they used different resolver arguments, so core-data could issue duplicate OPTIONS /wp/v2/navigation requests.

Testing Instructions

  1. Run npm run test:unit -- --runTestsByPath packages/core-data/src/hooks/test/use-resource-permissions.js --runInBand.
  2. Run npm run lint:js -- packages/core-data/src/hooks/use-resource-permissions.ts packages/core-data/src/hooks/test/use-resource-permissions.js.

Evidence

  • Added a regression test covering an id-less wp_navigation entity resource with id: undefined.
  • Before the fix, the regression test failed because /wp/v2/navigation was requested twice.
  • After the fix, the targeted test file passes: 6 tests passed.
  • Local lint passed for both changed files.
  • Site Editor profiling with a built core-data patch removed the duplicate network OPTIONS /wp/v2/navigation request. Homeboy run: 2d3a992d-1326-4207-9d00-75aac9e8598f.

AI assistance

  • AI assistance: Yes
  • Tool(s): OpenCode (GPT-5.5)
  • Used for: Investigating the duplicate REST request, drafting the regression test and small core-data fix, and collecting local verification evidence for Chris to review.

@chubes4 chubes4 requested a review from nerrad as a code owner May 14, 2026 01:21
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 14, 2026 •
edited
Loading

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: chubes4 <extrachill@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@github-actions github-actions Bot added the [Package] Core data /packages/core-data label May 14, 2026
@chubes4 chubes4 force-pushed the prove-canuser-options-duplicates branch from 31ffddd to c924a31 Compare May 14, 2026 01:27
@chubes4
Copy link
Copy Markdown
Contributor Author

chubes4 commented May 14, 2026

Site Editor evidence

I also checked the change against the Site Editor preload scenario that exposed the duplicate request.

Environment:

  • Homeboy run: 2d3a992d-1326-4207-9d00-75aac9e8598f
  • Scenario: studio-site-editor-preload-comparison
  • Candidate setup: same PHP REST preloads as baseline, plus a built core-data patch equivalent to this PR.
  • Extra preload declaration used for the probe: OPTIONS /wp/v2/navigation.

Observed network behavior for OPTIONS /wp/v2/navigation:

Case OPTIONS /wp/v2/navigation preload check Network request
Baseline first check hit preload, later duplicate missed present
Candidate check hit preload absent

Representative captured rows:

baseline network rows:
OPTIONS /wp/v2/navigation?_locale=user 200
GET     /wp/v2/navigation?_locale=user&context=edit 200

candidate network rows:
GET     /wp/v2/navigation?_locale=user&context=edit 200

Aggregate run metrics:

Metric Baseline Candidate
Measured REST network requests 8.6 8.0
Removed REST network requests - 1.0
New REST network requests - 0.4

I would not read the timing from this run as a stable performance win, because it was collected with SCRIPT_DEBUG and a locally patched built asset. The useful signal is the request-shape change: the duplicate id-less entity permission probe no longer falls through to the network after the preload has already been consumed.

@chubes4 chubes4 force-pushed the prove-canuser-options-duplicates branch 2 times, most recently from dd5ad75 to 65856c0 Compare May 14, 2026 02:17
@Mamaduka Mamaduka added the [Type] Bug An existing feature does not function as intended label May 14, 2026
@Mamaduka
Copy link
Copy Markdown
Member

Mamaduka commented May 14, 2026

Thanks, @chubes4!

It looks like change is causing the test in packages/block-library/src/navigation/test/use-navigation-menu.js to fail.

P.S. IMO, introducing useResourcePermissions was a mistake 😅 I have a local task somewhere to refactor the Navigation block and use canUser directly and only when needed. I'll try to follow up when I have time.

@Mamaduka Mamaduka self-requested a review May 14, 2026 10:19
@chubes4 chubes4 force-pushed the prove-canuser-options-duplicates branch from 65856c0 to 3815658 Compare May 14, 2026 12:04
@github-actions github-actions Bot added the [Package] Block library /packages/block-library label May 14, 2026
@chubes4
Copy link
Copy Markdown
Contributor Author

chubes4 commented May 14, 2026

Thanks for catching that, @Mamaduka. I updated the Navigation unit test helper to resolve the same normalized id-less collection resource used by useResourcePermissions() after this change.

Verified locally:

npm run test:unit -- --runTestsByPath packages/block-library/src/navigation/test/use-navigation-menu.js packages/core-data/src/hooks/test/use-resource-permissions.js --runInBand
PASS packages/block-library/src/navigation/test/use-navigation-menu.js
PASS packages/core-data/src/hooks/test/use-resource-permissions.js

npm run lint:js -- packages/block-library/src/navigation/test/use-navigation-menu.js packages/core-data/src/hooks/use-resource-permissions.ts packages/core-data/src/hooks/test/use-resource-permissions.js
PASS

Mamaduka
Mamaduka approved these changes May 15, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@Mamaduka Mamaduka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @chubes4!

@Mamaduka Mamaduka merged commit 18021f2 into WordPress:trunk May 15, 2026
42 checks passed
@github-actions github-actions Bot added this to the Gutenberg 23.3 milestone May 15, 2026
@chubes4
Copy link
Copy Markdown
Contributor Author

chubes4 commented May 15, 2026

Thank you! 🦾

@chubes4 chubes4 mentioned this pull request May 15, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mamaduka Mamaduka Mamaduka approved these changes

@nerrad nerrad Awaiting requested review from nerrad nerrad is a code owner

@ajitbohra ajitbohra Awaiting requested review from ajitbohra ajitbohra is a code owner

@fabiankaegy fabiankaegy Awaiting requested review from fabiankaegy fabiankaegy is a code owner

Assignees

No one assigned

Labels

[Package] Block library /packages/block-library [Package] Core data /packages/core-data [Type] Bug An existing feature does not function as intended

Projects

None yet

Milestone

Gutenberg 23.3

Development

Successfully merging this pull request may close these issues.

core-data: id-less entity resources can duplicate canUser OPTIONS requests

2 participants

@chubes4 @Mamaduka