fix: library IDs stay hidden without library access (ruling P13)

Outline, node-get, write outlines, the render summary and replace-text's
opaque-node match name no library ID unless the library group is visible
and the user has divi_library; read-only still names them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-09-27 15:00:39 +02:00
co-authored by Claude Opus 5.5
parent 06f13799de
commit c7ce924e5a
19 changed files with 351 additions and 28 deletions
@@ -80,6 +80,17 @@ class LibraryAccess
return $this->roles->refusal('divi_library');
}
/**
* Ruling P13: whether library IDs may be named to this connection at all – the library group
* is not disabled (P9; "nur lesen" still names them) and the user has the library right
* (canList). Otherwise outlines, node-get, write results, text search and the render summary
* say "global module" without the entry's ID, as if it were not stored.
*/
public function revealsIds(): bool
{
return ($this->visible === null || ($this->visible)()) && $this->canList() === null;
}
/** Reading one entry: canList() and edit_post on the entry. */
public function canRead(WP_Post $item): ?WP_Error
{