Route ability reads through the network option on network-activated multisite

E2E surfaced a read/write mismatch: update-settings and create-exclusion-rule
correctly wrote to wp_stream_network on network-activated installs, but
get-settings and get-exclusion-rules still read from $plugin->settings->options
(per-site, populated via Settings::get_options() which gates on
is_network_admin() and falls back to get_option() in REST). After a write,
the read endpoint returned the old per-site value instead of the just-
persisted network value.

Route both read abilities through Settings::get_all_setting_values() and
make sure the in-memory cache that update_all_setting_values() refreshes
also reads from the network option (Settings::get_options() can't be
trusted on network-activated REST because is_network_admin() is always
false there). Also return from update-settings via get_all_setting_values()
so the response reflects the authoritative store.

Author: PatelUtkarsh

abilities/class-ability-get-exclusion-rules.php

@@ -77,7 +77,12 @@ public function get_output_schema() {
 	public function execute( $input = null ) {
 		unset( $input );
 
-		$options = (array) $this->plugin->settings->options;
+		// Route through Settings::get_all_setting_values() so reads hit the
+		// network option on network-activated multisite (where create-
+		// exclusion-rule's writes land). A direct read of
+		// $plugin->settings->options would return the empty per-site option
+		// in REST contexts, so newly-created rules would not appear.
+		$options = $this->plugin->settings->get_all_setting_values();
 		$rules   = isset( $options['exclude_rules'] ) ? (array) $options['exclude_rules'] : array();
 
 		// Reuse Log's row pivot so output matches how Stream applies the rules internally.

abilities/class-ability-get-settings.php

@@ -9,6 +9,14 @@
 
 /**
  * Class - Ability_Get_Settings
+ *
+ * Unlike the other read abilities (get-records, get-record, get-alerts,
+ * get-connectors, get-exclusion-rules) which gate on `view_stream`, this
+ * one inherits the base permission_callback that requires
+ * `WP_STREAM_SETTINGS_CAPABILITY` (defaults to `manage_options`). The
+ * settings payload can include role allowlists and other configuration
+ * that's intentionally restricted to administrators, so the same cap that
+ * gates the wp-admin settings screen guards this ability too.
  */
 class Ability_Get_Settings extends Ability {
 
@@ -70,6 +78,13 @@ public function get_output_schema() {
 	public function execute( $input = null ) {
 		unset( $input );
 
-		return (array) $this->plugin->settings->options;
+		// Route through Settings::get_all_setting_values() so the network
+		// option is consulted on network-activated multisite. A direct read
+		// of $plugin->settings->options would return the (typically empty)
+		// per-site option in REST contexts (is_network_admin() is always
+		// false there), making get-settings disagree with update-settings,
+		// which routes writes to the network option via
+		// Settings::update_all_setting_values().
+		return $this->plugin->settings->get_all_setting_values();
 	}
 }

abilities/class-ability-update-settings.php

@@ -138,11 +138,14 @@ public function execute( $input = null ) {
 		$sanitized = $this->plugin->settings->sanitize_settings( $filtered );
 		$merged    = array_merge( $current, $sanitized );
 
-		// Settings::update_all_setting_values() also refreshes
-		// $plugin->settings->options so subsequent reads in the same request
-		// see the fully-populated array (defaults merged in).
+		// update_all_setting_values() persists to the correct store and
+		// refreshes $plugin->settings->options for callers in the same
+		// request. We still return via get_all_setting_values() so the
+		// response reflects the authoritative store on network-activated
+		// multisite (where $plugin->settings->options would be the per-site
+		// option and could disagree with what was just persisted).
 		$this->plugin->settings->update_all_setting_values( $merged );
 
-		return $this->plugin->settings->options;
+		return $this->plugin->settings->get_all_setting_values();
 	}
 }

classes/class-settings.php

@@ -514,19 +514,34 @@ public function get_all_setting_values() {
 	 * @return bool True on a successful write, false on no-op or failure.
 	 */
 	public function update_all_setting_values( array $options ) {
-		if (
+		$is_network = (
 			is_multisite()
 			&& isset( $this->plugin )
 			&& $this->plugin->is_network_activated()
-		) {
+		);
+
+		if ( $is_network ) {
 			$result = update_site_option( $this->network_options_key, $options );
 		} else {
 			$result = update_option( $this->option_key, $options );
 		}
 
 		// Refresh the in-memory copy so subsequent reads in the same request
-		// see the updated values.
-		$this->options = $this->get_options();
+		// see the updated values. On network-activated installs we re-read
+		// from the network option directly because Settings::get_options()
+		// gates on is_network_admin() and would return the (now-stale)
+		// per-site option in REST contexts. Merge defaults on top so callers
+		// reading $plugin->settings->options keep seeing a fully-populated
+		// array (matches get_options()'s historical contract).
+		if ( $is_network ) {
+			$defaults      = $this->get_defaults( $this->option_key );
+			$this->options = wp_parse_args(
+				(array) get_site_option( $this->network_options_key, array() ),
+				$defaults
+			);
+		} else {
+			$this->options = $this->get_options();
+		}
 
 		return (bool) $result;
 	}