Allow view access of template rest endpoint to anyone with the edit_post capability

[fabiankaegy]

What?

Part of #60316 as requested in #58301 (comment)

Modify the template / template part rest endpoint to allow any user role with the edit_post capability to view entities.

Why?

In order to render the block template in the locked template preview inside the post editor we need to be able to fetch the contents of any block templates / template parts for any user role that can edit a post.

How?

Overwriting the get_items_permissions_check and get_item_permissions_check methods of the rest_controller_class of the wp_template post type to check whether the current user can edit_posts.

Testing Instructions

Try making an authenticated rest request to the template rest endpoint with any user role that has the edit_post capability. -> The template should get returned
Try making an unauthenticated request and still get an unauthorized error

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: fabiankaegy <fabiankaegy@git.wordpress.org>
Co-authored-by: TimothyBJacobs <timothyblynjacobs@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[TimothyBJacobs]

You need to make a more thorough check here, right now this won't account for users who have the ability not to edit posts, but other CPTs that use the block editor. See WP_REST_Block_Types_Controller::check_read_permission for an example.

[fabiankaegy]

@TimothyBJacobs Thanks for much for your review :) I've updated the code to essentially match the example you've provided.

[ellatrix]

@fabiankaegy Could you handle small-typo-change in your backport PR?

[fabiankaegy]

I added a backport in WordPress/wordpress-develop#6494 (Track Ticket)

[t-hamano]

This change appears to have caused an unintended regression.

Currently, Gutenberg uses the following code to determine whether the site editor can be accessed, mainly using the command palette, and switches the link destination based on the result.

wp.data.select('core').canUser( 'read', 'templates' )

With this PR, this code now returns true even for non-administrator users, which causes links that they are not allowed to access to be displayed in commands, etc.

See #61419

[fabiankaegy]

Dev Note Draft:

Allow view access of the template REST API endpoint to anyone with the edit_post capability

Before WordPress 6.6 the templates and template-parts REST API endpoints were restricted to only be viewed/edited by anyone with the edit_theme_options capability (Administrators). WordPress 6.6 changes the permission checks to allow any user role with the edit_post capability to view these endpoints. Editing is still restricted to the edit_theme_options capability.

This change is because the post editor now includes the ability to preview a post's template while editing the post. In WordPress 6.5, this option was limited to administrators only. However, WordPress 6.6 now supports previewing the template for all user roles.