[adamsilverstein]

What?

Follow up to #76767. Tightens who can remove a note reaction, and keeps the reaction tooltip's names in step with its count.

Why?

These came up as Copilot findings on #83538 and also apply to trunk now that #76767 has landed:

• Deleting a reaction fell through to core's generic comment check, so an editor or administrator (anyone with moderate_comments or edit_comment) could remove another user's reaction.
• Creating a reaction on a resolved thread is already rejected, but removing one was not, so a stale tab could still change a resolved thread.
• The pill tooltip fetched reactions with status: 'all', while reaction_summary only counts approved rows.

How?

• Override delete_item_permissions_check() in the 7.2 comments controller: after core's check passes, a reaction can only be deleted by its author, and not while its thread is resolved. Both return rest_cannot_delete.
• Move the thread-root walk out of create_item() into an is_in_resolved_thread() helper so create and delete share it.
• Query status: 'approve' for the tooltip names.

Testing Instructions

PHPUnit covers the new rules in phpunit/experimental/class-wp-rest-comments-controller-gutenberg-test.php:

• test_can_delete_own_reaction
• test_cannot_delete_another_users_reaction (administrator and editor)
• test_cannot_delete_reaction_on_resolved_thread (root note and reply)

The tests landed in their own first commit; the Unit Tests run on that commit alone fails them, and they pass with the fix.

Manual check:

1. As user A, add a note to a post and react to it with ❤️.
2. As an administrator (user B), try to delete A's reaction: wp.apiFetch( { path: '/wp/v2/comments/<reaction id>?force=true', method: 'DELETE' } ). Expect a 403 rest_cannot_delete.
3. As A, resolve the thread, then try to remove your own reaction the same way. Expect a 403.
4. Reopen the thread; removing your reaction works again.

AI Use

Claude Code wrote the code and this description, with me pointing it at the review findings. I will review and test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LvpAdxaahosj8kTQtm3NXW

[github-actions]

🤖 PR meta 🤖

🎉 Props

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: adamsilverstein <adamsilverstein@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>
Co-authored-by: ramonjd <ramonopoly@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

Updated as activity occurs, without notifying anyone named here. Add the props-bot label to refresh.

📦 Bundle size

Size Change: +3 B (0%)

Total Size: 8.58 MB

📦 View Changed

Filename	Size	Change
build/scripts/editor/index.min.js	559 kB	+3 B (0%)

_{6febc53 Run}

⚡ Performance

Show the results

Client side metrics exclude the server response time.

front-end-block-theme

Metric	015fed1	trunk	% Change
timeToFirstByte	35.65 ms +21.32% -3.79%	34.7 ms +4.61% -2.31%	2.74%
largestContentfulPaint	64 ms +6.25% -6.25%	62 ms +3.23% -3.23%	3.23%
lcpMinusTtfb	25.7 ms +11.67% -4.09%	25.75 ms +13.98% -4.85%	-0.19%
wpBeforeTemplate	18.68 ms +24.04% -3.1%	18.11 ms +7.07% -2.15%	3.15%
wpTemplate	13.65 ms +18.17% -2.27%	13.43 ms +4.32% -3.72%	1.64%
wpTotal	32.42 ms +22.05% -3.39%	31.61 ms +5.06% -2.28%	2.56%
wpMemoryUsage	7.71 MB +0% -0%	7.67 MB +0% -0%	0.45%
wpDbQueries	16 +0% -0%	16 +0% -0%	0%

front-end-classic-theme

Metric	015fed1	trunk	% Change
timeToFirstByte	30.4 ms +8.88% -2.96%	27.05 ms +9.24% -4.44%	12.38%
largestContentfulPaint	68 ms +5.88% -0%	60 ms +6.67% -0%	13.33%
lcpMinusTtfb	38.1 ms +2.89% -1.31%	32.75 ms +7.18% -2.75%	16.34%
wpBeforeTemplate	16.57 ms +11.23% -3.5%	16.6 ms +12.11% -3.67%	-0.18%
wpTemplate	11.18 ms +2.86% -7.42%	7.84 ms +8.16% -6.89%	42.6%
wpTotal	27.84 ms +8.87% -3.41%	24.52 ms +10.32% -4.32%	13.54%
wpMemoryUsage	6.40 MB +0% -0%	6.25 MB +0% -0%	2.35%
wpDbQueries	13 +0% -0%	9 +0% -0%	44.44%

media-processing

Metric	015fed1	trunk	% Change
mediaProcessingJpeg	224.8 ms +4.72% -1.29%	235.95 ms +0.98% -2.61%	-4.73%
mediaProcessingAvif	3663.76 ms +0.34% -0.41%	3746.08 ms +1.47% -1.75%	-2.2%
mediaProcessingJpegToAvif	2558.97 ms +0.3% -1.78%	2607.9 ms +3.48% -2.5%	-1.88%

media-upload

Metric	015fed1	trunk	% Change
jpegUploadProcessing	1421.64 ms +1.48% -0.67%	1407.72 ms +2.2% -0.91%	0.99%
pngUploadProcessing	184.34 ms +0.89% -5.54%	183.59 ms +5.11% -2.13%	0.41%
largeJpegUploadProcessing	1404.83 ms +0.43% -0.62%	1430.07 ms +0.65% -0.55%	-1.76%
multipleImageUploadProcessing	1470.76 ms +0.75% -0.54%	1443.92 ms +1.26% -0.42%	1.86%

post-editor

Metric	015fed1	trunk	% Change
serverResponse	413.09 ms +1.49% -5.52%	372.88 ms +10.15% -1.59%	10.78%
firstPaint	372.21 ms +7.71% -2.47%	336.71 ms +6.65% -9.17%	10.54%
domContentLoaded	840.07 ms +2.64% -1.71%	825.51 ms +1.68% -0.79%	1.76%
loaded	841 ms +2.63% -1.68%	826.71 ms +1.66% -0.81%	1.73%
firstContentfulPaint	482.02 ms +6.27% -1.38%	485.18 ms +1.23% -1.91%	-0.65%
firstBlock	2058.16 ms +1.14% -0.3%	2069.97 ms +1.59% -1.19%	-0.57%
type	17.55 ms +7.41% -6.38%	18.65 ms +3.43% -11.26%	-5.9%
typeWithoutInspector	18.61 ms +2.69% -7.52%	17.79 ms +5.85% -6.75%	4.61%
typeWithTopToolbar	24.37 ms +5.21% -5.95%	24.83 ms +6.77% -9.95%	-1.85%
typeContainer	7.95 ms +8.81% -3.65%	8.27 ms +8.34% -6.17%	-3.87%
focus	118.62 ms +1.84% -2.42%	114.81 ms +4.86% -6.81%	3.32%
firstFocus	261.07 ms +0% -0%	245.27 ms +0% -0%	6.44%
selectAll	332.19 ms +1.79% -3.05%	378.14 ms +3.85% -3.88%	-12.15%
undo	30 ms +8.87% -2.9%	30.11 ms +7.74% -2.36%	-0.37%
listViewOpen	74.53 ms +3.33% -10.26%	69.92 ms +6.31% -2.47%	6.59%
inserterOpen	43.53 ms +1.88% -9.9%	42.89 ms +4.59% -6.76%	1.49%
inserterHover	12.02 ms +5.41% -6.49%	11.48 ms +11.67% -4.88%	4.7%
inserterSearch	8.37 ms +11.71% -1.08%	9.02 ms +9.2% -9.2%	-7.21%
loadPatterns	668.45 ms +10% -1.15%	664.01 ms +49.02% -2.15%	0.67%
wpTotal	403.17 ms +1.27% -5.63%	362.92 ms +10.44% -1.6%	11.09%
wpMemoryUsage	14.75 MB +0% -0%	14.72 MB +0% -0%	0.25%
wpDbQueries	55 +0% -0%	55 +0% -0%	0%

site-editor

Metric	015fed1	trunk	% Change
serverResponse	464.03 ms +2.02% -6.2%	468.55 ms +0.4% -7.94%	-0.96%
firstPaint	328.08 ms +12.68% -18.78%	360.46 ms +3.16% -7.95%	-8.98%
domContentLoaded	859.17 ms +2.11% -1.8%	846.24 ms +1.5% -0.32%	1.53%
loaded	860.29 ms +2.07% -1.8%	847.23 ms +1.5% -0.34%	1.54%
firstContentfulPaint	492.72 ms +2.07% -3.76%	490.05 ms +1.41% -1.38%	0.54%
firstBlock	2527.76 ms +0.54% -2.01%	2515.91 ms +0.96% -0.67%	0.47%
type	17.56 ms +5.3% -8.14%	17.26 ms +8.81% -5.91%	1.74%
navigate	110.68 ms +4.03% -2.38%	115.28 ms +7.06% -3.9%	-3.99%
loadPatterns	1222.15 ms +4.92% -10.82%	1097.97 ms +7.31% -2.1%	11.31%
loadPages	1027.7 ms +4.82% -3.27%	1001.31 ms +2.22% -3.84%	2.64%
wpTotal	454.63 ms +2.04% -6.31%	459.08 ms +0.41% -8.08%	-0.97%
wpMemoryUsage	12.77 MB +0% -0%	12.73 MB +0% -0%	0.28%
wpDbQueries	45 +0% -0%	45 +0% -0%	0%

_{6febc53 Run}

🏁 Flaky tests

Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

a navigation superseded by the traversal discharges to idle in /test/e2e/specs/interactivity/router-navigation-lifecycle.spec.ts, passed after 1 failed attempt.

SyntaxError: Unexpected token 'o', "not hydrated" is not valid JSON
    at readLog (/home/runner/work/gutenberg/gutenberg/test/e2e/specs/interactivity/router-navigation-lifecycle.spec.ts:28:14)
    at /home/runner/work/gutenberg/gutenberg/test/e2e/specs/interactivity/router-navigation-lifecycle.spec.ts:47:24
    at waitForLogLength (/home/runner/work/gutenberg/gutenberg/test/e2e/specs/interactivity/router-navigation-lifecycle.spec.ts:46:2)
    at /home/runner/work/gutenberg/gutenberg/test/e2e/specs/interactivity/router-navigation-lifecycle.spec.ts:693:5

does not select blocks in the canvas preview when editing from the sidebar (Site Editor v2) in /test/e2e/specs/site-editor/navigation-sidebar-list-view.spec.js, passed after 1 failed attempt.

Error: expect(locator).toBeFocused() failed

Locator: getByRole('combobox', { name: 'Search or type URL' })
Expected: focused
Timeout: 5000ms
Error: element(s) not found

Call log:
  - Expect "toBeFocused" getByRole('combobox', { name: 'Search or type URL' }) with timeout 5000ms
  - waiting for getByRole('combobox', { name: 'Search or type URL' })

    at LinkControl.useLinkControlSearch (/home/runner/work/gutenberg/gutenberg/test/e2e/specs/site-editor/navigation-sidebar-list-view.spec.js:416:47)
    at /home/runner/work/gutenberg/gutenberg/test/e2e/specs/site-editor/navigation-sidebar-list-view.spec.js:179:21

_{6febc53 Run}

[ramonjd]

Tested and can reproduce on trunk (user B can delete user A's reactions and user A can delete user A's resolved note reactions)

On this branch, 403 for both.

Code LGTM

[Mamaduka]

Pushed a small follow-up:

• Renamed is_in_resolved_thread() to is_thread_resolved() to match isThreadResolved on the JS side.
• test_cannot_delete_another_users_reaction now tests a post author deleting someone else’s reaction. Edit access to the post was enough before this fix, and the admin and editor rows both hit that same check.

@adamsilverstein, do we have a core sync PR for this?

[adamsilverstein]

Core backport is up in WordPress/wordpress-develop#15383, and I moved the backport changelog entry to match in 6febc53.

[github-actions]

I just cherry-picked this PR to the wp/7.2 branch to get it included in the next release: b49b3d6