Fix: Require publishing capability for Bluesky comment replies#198
Merged
Conversation
Registered Subscribers and comment-only accounts are no longer treated as authorized to publish through the site-connected Bluesky account. Eligibility now follows the comment author's current publish_posts capability, including at cron execution time. Fixes #196.
github-actions
Bot
added
[Feature] Transformer
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a privilege escalation path where comments from Subscriber accounts (or other comment-only users) could be cross-posted as Bluesky replies via the site-connected account. It tightens outbound comment eligibility by requiring the comment author to have the publish_posts capability at both scheduling time and WP-Cron execution time, while keeping the existing atmosphere_should_publish_comment filter override.
Changes:
- Gate outbound comment publishing on
\user_can( $comment->user_id, 'publish_posts' )(in addition to requiring a registered user ID). - Add regression tests covering Subscriber exclusion and cron-time capability rechecks after a role downgrade.
- Update user-facing and developer documentation to reflect the new “publishing-capable users only” behavior.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| includes/class-atmosphere.php | Adds an author capability check (publish_posts) to the core outbound comment eligibility gate. |
| tests/phpunit/tests/class-test-atmosphere.php | Updates comment-fixture user creation to use an Author role; adds tests for Subscriber exclusion and cron-time recheck after role downgrade. |
| includes/transformer/class-comment.php | Updates transformer docblock to match the new eligibility rule. |
| readme.txt | Updates public readme language to clarify only publishing-capable users’ comments are mirrored to Bluesky. |
| docs/developer-docs.md | Clarifies the atmosphere_should_publish_comment filter applies to comments from users allowed to publish posts. |
| .github/changelog/fix-comment-publishing-capability | Adds a changelog entry describing the behavior change. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jeherve
approved these changes
Jul 15, 2026
jeherve
left a comment
jeherve
left a comment
Member
There was a problem hiding this comment.
This looks good to me, let's merge!
jeherve
added a commit
that referenced
this pull request
Jul 15, 2026
Brings in #199 (controls for publishing WordPress comments to Bluesky) and #198 (require publishing capability for comment replies). Resolve the docs/developer-docs.md hooks-table conflict (keep the connection-only/settings-page rows, take trunk's updated atmosphere_should_publish_comment wording) and extend connection-only mode to the newly merged outgoing lane: is_comment_publishing_enabled() is now forced off in connection-only mode, with its atmosphere_should_publish_comments filter still the final say. Because #199 already re-checks that helper at every layer (direct Publisher calls, the publish-comment cron, on_before_delete cleanup, chunked delete_post_by_tids), the single force-off closes the outgoing-comment gap everywhere. Adds regression tests and updates the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #196
Proposed changes:
publish_postscapability before scheduling or executing an outbound reply. This uses the stored author ID so the check remains valid in WP-Cron.Other information:
Testing instructions:
composer lint.npm run env-test.npm run env-test -- --filter="test_(eligible_author|subscriber_comment|publish_comment_cron_rechecks_author_capability)".Changelog entry
Changelog Entry Details
Significance
Type
Message
A manual changelog entry is included in
.github/changelog/fix-comment-publishing-capability.