Feat/add role user access controls - #749

Infinite-Null · 2026-06-19T13:05:34Z

Closes: #736

Description

This PR introduces Feature-Level Access Controls exclusively for Editor Experiments, allowing site administrators to restrict access to individual AI-powered editor features based on specific WordPress roles or individual users.

Testing Instructions

Navigate to AI Settings and enable Enable AI.
Open the Developer Tools menu (three dots) and select Access controls.
Under the "Editor Experiments" section, verify that the Roles and Users configuration panel appears beneath the feature toggles.
Check a few roles (e.g., Editor, Author) for a specific feature and click Save. Verify the save is successful.
In the Users field, search for a specific user and select them from the dropdown. Click Save.
Refresh the page and verify that your selected roles and users persisted and display their correct names.
Turn off "Access controls" from the Developer Tools menu, and verify that all selections are cleared.
Verify Enforcements: Log in to the site as a user who does not possess the selected role and is not the selected user. Open the block editor and verify that the restricted experiment is not accessible or visible to them.
Log in as the specifically selected user or a user with the granted role, and verify the feature is fully accessible.
Turn off "Access controls" from the Developer Tools menu, and verify that all selections are cleared and the feature becomes globally available again.

Screencast

User: Ankit Shah | Role: Editor

Screen.Recording.2026-06-22.at.1.35.17.PM-compressed.mp4

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Sonnet 4.6
Used for: Validating bug, suggesting a fix.

Changelog Entry

Add - Role and User based access controls for experiments

…ntegration

…trolSettings to enable explicit saving

… update dependencies

…ion in AccessControlSettings

…ction tracking in AccessControlSettings

… and refresh lockfile

…pdate clear hook type definition

github-actions · 2026-06-19T13:05:47Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: Infinite-Null <ankitkumarshah@git.wordpress.org>
Co-authored-by: dkotter <dkotter@git.wordpress.org>
Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org>
Co-authored-by: henryperkins <htperkins@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

…ication logic in helper function

…er readability

…helper

…ic to reset access control settings upon toggle

…ponents

…rom suggestions in AccessControlSettings

…kfile

…me variables for consistent styling

…tings component

codecov · 2026-06-29T07:26:02Z

Codecov Report

❌ Patch coverage is 90.09901% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.53%. Comparing base (8c3606a) to head (2c1f94d).
⚠️ Report is 5 commits behind head on develop.

Files with missing lines	Patch %	Lines
...iments/Alt_Text_Generation/Alt_Text_Generation.php	50.00%	1 Missing ⚠️
.../Content_Classification/Content_Classification.php	50.00%	1 Missing ⚠️
.../Experiments/Content_Resizing/Content_Resizing.php	50.00%	1 Missing ⚠️
...es/Experiments/Editorial_Notes/Editorial_Notes.php	50.00%	1 Missing ⚠️
...xperiments/Editorial_Updates/Editorial_Updates.php	50.00%	1 Missing ⚠️
...eriments/Excerpt_Generation/Excerpt_Generation.php	50.00%	1 Missing ⚠️
.../Experiments/Meta_Description/Meta_Description.php	50.00%	1 Missing ⚠️
...cludes/Experiments/Summarization/Summarization.php	50.00%	1 Missing ⚠️
.../Experiments/Title_Generation/Title_Generation.php	50.00%	1 Missing ⚠️
includes/helpers.php	85.71%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop     #749      +/-   ##
=============================================
+ Coverage      78.40%   78.53%   +0.13%     
- Complexity      2454     2470      +16     
=============================================
  Files            104      105       +1     
  Lines           9918    10027     +109     
=============================================
+ Hits            7776     7875      +99     
- Misses          2142     2152      +10

Flag	Coverage Δ
unit	`78.53% <90.09%> (+0.13%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jeffpaul · 2026-07-13T19:08:30Z

@Infinite-Null FYI some merge conflicts to resolve to keep this moving along

Added - New "Advanced settings" option in Developer Tools to show/hide additional configuration options for features and experiments. Changed - Move all existing configuration options into a new "Advanced settings" section which is hidden by default. Co-authored-by: Infinite-Null <ankitkumarshah@git.wordpress.org> Co-authored-by: jeffpaul <jeffpaul@git.wordpress.org> Co-authored-by: dkotter <dkotter@git.wordpress.org>

Infinite-Null · 2026-07-14T13:41:10Z

Thanks for the heads up, @jeffpaul! I've resolved the merge conflicts now. Whenever you have a chance, could you please take another look? Thanks!

…oduce helper functions for managing access settings.

…arization settings

henryperkins · 2026-07-18T05:51:53Z

Thanks for working on this. I maintain Flavor Agent, a third-party Abstract_Feature that uses the AI plugin’s feature framework while registering its editor assets, recommendation/apply abilities, and dedicated MCP server through separate bootstrap paths.

The current implementation appears to enforce access by calling ai_current_user_can_access_feature() inside each built-in Editor Experiment’s register() method. That handles those experiments, but I do not think it yet defines a complete contract for third-party features.

In Flavor Agent, for example, Abstract_Feature::register() owns the editor asset hook, while the feature’s Abilities and MCP server are registered elsewhere. An unauthorized user could therefore lose the editor UI while related programmatic surfaces remain registered unless the plugin independently knows which helper and option contract to call.

Would it make sense to:

Apply the access check centrally in the Feature Loader before invoking register().
Treat ai_current_user_can_access_feature( $feature_id ) as a documented, stable third-party API.
Add a test-only third-party Abstract_Feature fixture.
Document that separate Ability, REST, CLI, or MCP execution paths must use the same resolver in their permission boundary.
Include a test proving that an unauthorized direct Ability execution is denied rather than merely hidden from the settings/editor UI.

I can contribute the failing third-party integration test and the centralized enforcement change. The important acceptance criterion for me is that an unauthorized user receives neither the first-party feature surface nor an executable programmatic path, while existing WordPress capability checks remain in force.

dkotter · 2026-07-31T20:05:23Z

 	 * {@inheritDoc}
 	 */
 	public function register(): void {
+		if ( ! \WordPress\AI\ai_current_user_can_access_feature( $this->get_id() ) ) {


I don't love forcing each experiment to run this same code. Since all experiments extend Abstract_Feature, could a check like this live there so any experiment that extends that class automatically gets this behavior? Or maybe even better in our Loader class?

For example, this PR doesn't apply this to Image Generation or Type Ahead

The other issue to consider is that some features do other things in this register method beyond just loading the UI and the Ability. For instance, custom post meta is registered or caches are cleared. Those things will no longer run for certain users, if restriction is turned on, leading to weird edge cases that will be hard to debug. Ideally we figure out a way to prevent the actual experiment from running but still allow other pieces to function properly

dkotter · 2026-07-31T20:06:10Z

+/**
+ * Roles_Users_Controller test case.
+ *
+ * @since 0.9.0


All @since statements in this PR need to be set to x.x.x

dkotter · 2026-07-31T20:06:53Z

+
+	private const MAX_USERS = 10;
+
+	public function init(): void {


Any reason to not have docblocks on all methods and constants in this class?

dkotter · 2026-07-31T20:07:47Z

+		);
+
+		if ( '' !== $search ) {
+			$get_users_args['search']         = '*' . $search . '*';


Any escaping we should be applying here?

dkotter · 2026-07-31T20:08:17Z

+ * If no roles or users are explicitly configured for the feature, it allows access by default.
+ * If there are configured roles/users, the current user must match at least one role or be explicitly listed.
+ *
+ * @since 0.1.0


Suggested change

* @since 0.1.0

* @since x.x.x

dkotter · 2026-07-31T20:29:08Z

+
+	$current_user = wp_get_current_user();
+
+	if ( in_array( $current_user->ID, $users, true ) ) {


Suggested change

if ( in_array( $current_user->ID, $users, true ) ) {

if ( in_array( $current_user->ID, array_map( 'intval', (array) $users ), true ) ) {

dkotter · 2026-07-31T20:29:30Z

+	$roles = get_option( "wpai_feature_{$feature_id}_roles", array() );
+	$users = get_option( "wpai_feature_{$feature_id}_users", array() );
+
+	if ( empty( $roles ) && empty( $users ) ) {


Do we also need an is_array check here on these?

dkotter · 2026-07-31T20:30:40Z

 				)
 			);

+			register_setting(


Might want to add a sanitize_callback to both of these to ensure we only save real user roles and real user IDs

dkotter · 2026-07-31T20:31:55Z

+				</p>
+			) }
+			{ ! isLoading && ! fetchError && (
+				<>


Is this fragment necessary?

dkotter · 2026-07-31T20:32:43Z

+									accessibleWhenDisabled
+								>
+									{ isSaving ? (
+										<Spinner />


No need to display a spinner here, we can rely on isBusy

…mplementation across experimental modules.

jeffpaul · 2026-08-10T16:21:24Z

@Infinite-Null please let us know when you're updated from comments/code review feedback for us to test this out again, thanks!

Infinite-Null · 2026-08-10T16:30:13Z

@Infinite-Null please let us know when you're updated from comments/code review feedback for us to test this out again, thanks!

Hey @jeffpaul, I am out till 16th August due to personal commitments. I will update the comments/code review after then. Thank you for understanding.

Infinite-Null added 9 commits June 17, 2026 15:27

feat: add access control settings for features with REST API and UI i…

613527a

…ntegration

refactor: implement local state for role and user tokens in AccessCon…

1ca4935

…trolSettings to enable explicit saving

refactor: replace Stack with Flex layout in AccessControlSettings and…

013f157

… update dependencies

refactor: replace FormTokenField with CheckboxControl for role select…

c1f6160

…ion in AccessControlSettings

feat: implement debounced server-side user search and persistent sele…

c134007

…ction tracking in AccessControlSettings

Merge branch 'develop' into feat/add-role-user-access-controls

a0da3db

feat: update access control settings input to use 40px default sizing…

1e6c0ae

… and refresh lockfile

feat: enforce access control checks for experiment registration and u…

4832b12

…pdate clear hook type definition

feat: restrict access control settings to non-admin features

bd2ba2a

Infinite-Null marked this pull request as draft June 19, 2026 13:05

Infinite-Null added 8 commits June 19, 2026 19:09

refactor: add type hinting to REST controller and simplify role verif…

615d44b

…ication logic in helper function

refactor: format AccessControlSettings conditional rendering for bett…

25ba583

…er readability

refactor: improve Yoda condition readability in user search query logic

7f28d57

refactor: remove redundant user login check from access verification …

3f11239

…helper

refactor: clean up AccessControlSettings hook usage and implement log…

d6ad4d7

…ic to reset access control settings upon toggle

style: refactor code formatting and indentation in access control com…

c37c5bb

…ponents

fix: sync selected user display names and filter current selections f…

e26725c

…rom suggestions in AccessControlSettings

refactor: reformat loop block in AccessControlSettings and update loc…

993bb99

…kfile

Infinite-Null marked this pull request as ready for review June 22, 2026 08:12

Merge branch 'develop' into feat/add-role-user-access-controls

f1e5478

Infinite-Null mentioned this pull request Jun 22, 2026

Expose role/user access controls per feature/experiment #736

Open

jeffpaul added this to the 1.2.0 milestone Jun 26, 2026

Infinite-Null added 2 commits June 29, 2026 12:47

refactor: update AccessControlSettings layout to use CSS grid and the…

51fa6bf

…me variables for consistent styling

refactor: simplify gridTemplateColumns formatting in AccessControlSet…

30bf0fd

…tings component

jeffpaul mentioned this pull request Jul 13, 2026

Release version 1.2.0 #864

Closed

28 tasks

Merge branch 'develop' into feat/add-role-user-access-controls

e995019

Infinite-Null requested a review from a team as a code owner July 14, 2026 13:11

dkotter assigned Infinite-Null Jul 14, 2026

dkotter modified the milestones: 1.2.0, 1.3.0 Jul 14, 2026

Infinite-Null added 3 commits July 15, 2026 15:33

test: add e2e test for content summarization access controls and intr…

e94080d

…oduce helper functions for managing access settings.

test: add e2e test case for user-based access control in Content Summ…

e5c207c

…arization settings

test: add integration tests for the roles-users REST controller

2c1f94d

dkotter requested changes Jul 31, 2026

View reviewed changes

dkotter modified the milestones: 1.3.0, Future Release Jul 31, 2026

refactor: standardize PHP coding style and update AI access control i…

bd767b6

…mplementation across experimental modules.

jeffpaul modified the milestones: Future Release, 1.4.0 Aug 10, 2026


		$current_user = wp_get_current_user();

		if ( in_array( $current_user->ID, $users, true ) ) {

	if ( in_array( $current_user->ID, $users, true ) ) {
	if ( in_array( $current_user->ID, array_map( 'intval', (array) $users ), true ) ) {

Uh oh!

Conversation

Infinite-Null commented Jun 19, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing Instructions

Screencast

User: Ankit Shah | Role: Editor

Use of AI Tools

Changelog Entry

Uh oh!

github-actions Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jeffpaul commented Jul 13, 2026

Uh oh!

Infinite-Null commented Jul 14, 2026

Uh oh!

henryperkins commented Jul 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeffpaul commented Aug 10, 2026

Uh oh!

Infinite-Null commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Infinite-Null commented Jun 19, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jun 19, 2026 •

edited

Loading

codecov Bot commented Jun 29, 2026 •

edited

Loading