String value found, but an array is required

[thefrosty]

Running a curl on my local WordPress install:

curl --location --request GET 'https://local.test/wp-json/wp/v2/posts' \
--header 'Authorization: Basic SomeAweseomKey' \
--header 'Cookie: PHPSESSID=ba5ea78b3f9eeddf3cd064674e1381c2'

Returns:

{
    "code": "rest_invalid_param",
    "message": "Invalid parameter(s): status",
    "data": {
        "status": 400,
        "params": {
            "status": "String value found, but an array is required"
        }
    }
}

I could send the OPTIONS request since I do see status listed twice, but they are both core fields. 🤔 Curious if it's a core issue or something else.

[TimothyBJacobs]

Hm, is there anything else on the install? The problem is that the default value for the status parameter doesn't pass strict type checking. But the Middleware is supposed to only validate the passed parameters, not the default values.

wp-rest-api-schema-validator/src/Middleware.php

Line 347 in c5452e3

protected function get_params_to_validate( $request, $method ) {

TBH though, I've never used this with wp/v2 as the namespace, since the Core REST API schemas and endpoints aren't 100% compatible with JSON Schema. I've just used this for endpoints that I have complete control over.

[thefrosty]

In the Schema it's a string, but in the endpoints GET args, it's an array. Which seems fine buy the Middleware is blocking the request above, with nothing being passed.

[thefrosty]

TBH though, I've never used this with wp/v2 as the namespace, since the Core REST API schemas and endpoints aren't 100% compatible with JSON Schema. I've just used this for endpoints that I have complete control over.

Thanks, just thought I would drop a note. I will continue to look into it and see if I can come up with a solution (until we move out of the wp/v2 namespace)

[TimothyBJacobs]

In the Schema it's a string, but in the endpoints GET args, it's an array. Which seems fine buy the Middleware is blocking the request above, with nothing being passed.

Right, but it's the default value in the collection params that is a string. https://github.com/WordPress/wordpress-develop/blob/953e1c5f8313a89d4d3b99ab5996b4660045c976/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php#L2847

Really, we should make that [ 'publish' ].

[thefrosty]

https://core.trac.wordpress.org/ticket/53622#ticket

[thefrosty]

Quick fix:

<?php
$post_types = \get_post_types();
$fixQueryParams = static function (array $query_params): array {
    if (
        isset($query_params['status']) &&
        (isset($query_params['status']['type']) && \strcasecmp($query_params['status']['type'], 'array') === 0) &&
        (isset($query_params['status']['default']) && \gettype($query_params['status']['default']) !== 'array')
    ) {
        $query_params['status']['default'] = (array)$query_params['status']['default'];
    }

    return $query_params;
};
\array_walk(
    $post_types,
    fn(string $post_type): bool => \add_filter("rest_{$post_type}_collection_params", $fixQueryParams)
);