REST API: Preserve client-side ability schema keywords

Author: gziolo

src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-list-controller.php

@@ -191,8 +191,9 @@ public function get_item_permissions_check( $request ) {
 	/**
 	 * Additional schema keywords to preserve in REST responses.
 	 *
-	 * These are not included in rest_get_allowed_schema_keywords(), but are
-	 * still recognized as schema traversal locations for ability schemas.
+	 * Ability schemas are exposed to clients as JSON Schema. Preserve additional
+	 * draft-04 keywords so clients can validate richer schemas, even when some
+	 * of those keywords are not enforced by the server-side REST schema validator.
 	 *
 	 * @since 7.1.0
 	 * @var string[]
@@ -201,6 +202,7 @@ public function get_item_permissions_check( $request ) {
 		'required',
 		'allOf',
 		'not',
+		'$ref',
 		'definitions',
 		'dependencies',
 		'additionalItems',

tests/phpunit/tests/rest-api/wpRestAbilitiesV1ListController.php

@@ -962,6 +962,7 @@ public function test_internal_schema_keywords_stripped_from_nested_sub_schemas()
 				'category'            => 'general',
 				'input_schema'        => array(
 					'type'                 => 'object',
+					'$ref'                 => '#/definitions/address',
 					'anyOf'                => array(
 						array(
 							'type'              => 'object',
@@ -1063,6 +1064,7 @@ public function test_internal_schema_keywords_stripped_from_nested_sub_schemas()
 		$data = $response->get_data();
 
 		// Verify internal keywords are stripped from anyOf sub-schemas.
+		$this->assertSame( '#/definitions/address', $data['input_schema']['$ref'] );
 		$this->assertArrayHasKey( 'anyOf', $data['input_schema'] );
 		$this->assertArrayNotHasKey( 'sanitize_callback', $data['input_schema']['anyOf'][0] );
 		$this->assertSame( 'object', $data['input_schema']['anyOf'][0]['type'] );