fix: scope large-batch dismiss by rule, not just object (PRO-1264)

dismiss_issue()'s largeBatch path selected and updated every row
matching only siteid+object, so a global/large-batch dismiss on one
rule violation also silently dismissed unrelated rule violations that
happened to share the same object. Fetch the representative issue's
rule alongside its object and filter the batch query by both, matching
the scoping the pro plugin's global-ignore lookup already uses.

Also fixes two existing largeBatch tests whose fixtures used different
rules per row within a single "batch" object — that setup encoded the
same assumption behind the bug, so those rows would no longer be
recognized as belonging to the same batch under the corrected query.

Author: pattonwebz

includes/classes/class-rest-api.php

@@ -1230,9 +1230,11 @@ public function dismiss_issue( $request ) {
 		// If largeBatch is set, verify edit permission for all matching rows,
 		// then perform a single object-based update.
 		if ( $large_batch ) {
-			// Get the 'object' from the issue id.
+			// Get the 'rule' and 'object' from the issue id so the batch is scoped to both.
 			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Need fresh data.
-			$object = $wpdb->get_var( $wpdb->prepare( 'SELECT object FROM %i WHERE id = %d', $table_name, $issue_id ) );
+			$representative_row = $wpdb->get_row( $wpdb->prepare( 'SELECT rule, object FROM %i WHERE id = %d', $table_name, $issue_id ), ARRAY_A );
+			$rule               = $representative_row['rule'] ?? '';
+			$object             = $representative_row['object'] ?? '';
 
 			if ( ! $object ) {
 				return new \WP_Error(
@@ -1247,10 +1249,11 @@ public function dismiss_issue( $request ) {
 			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Need current rows for permission validation.
 			$issue_rows = $wpdb->get_results(
 				$wpdb->prepare(
-					'SELECT id, postid FROM %i WHERE siteid = %d AND object = %s',
+					'SELECT id, postid FROM %i WHERE siteid = %d AND object = %s AND rule = %s',
 					$table_name,
 					$site_id,
-					$object
+					$object,
+					$rule
 				),
 				ARRAY_A
 			);

tests/phpunit/includes/classes/RestApiEndpointsTest.php

@@ -692,7 +692,7 @@ public function test_large_batch_dismiss_authorized_on_all() {
 		$batch_object = 'batch-all-authorized-test-' . wp_generate_uuid4();
 
 		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
-		// Create multiple issues with the same object (batch).
+		// Create multiple issues sharing the same rule AND object (batch).
 		$issue_ids = [];
 		for ( $i = 1; $i <= 3; $i++ ) {
 			$post_id = ( $i <= 2 ) ? $post_1 : $post_2;
@@ -702,7 +702,7 @@ public function test_large_batch_dismiss_authorized_on_all() {
 					'postid'       => $post_id,
 					'siteid'       => $site_id,
 					'type'         => 'error',
-					'rule'         => 'batch-auth-test-' . $i,
+					'rule'         => 'batch-auth-test',
 					'ruletype'     => 'error',
 					'object'       => $batch_object,
 					'recordcheck'  => 1,
@@ -930,13 +930,14 @@ public function test_large_batch_dismiss_authorized_on_some() {
 
 		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
 		// Create first issue on limited_id's post (limited user CAN edit).
+		// Both rows share the same rule AND object so they land in the same batch.
 		$wpdb->insert(
 			$table_name,
 			[
 				'postid'       => $limited_post,
 				'siteid'       => $site_id,
 				'type'         => 'error',
-				'rule'         => 'batch-partial-1',
+				'rule'         => 'batch-partial-test',
 				'ruletype'     => 'error',
 				'object'       => $batch_object,
 				'recordcheck'  => 1,
@@ -955,7 +956,7 @@ public function test_large_batch_dismiss_authorized_on_some() {
 				'postid'       => $admin_post,
 				'siteid'       => $site_id,
 				'type'         => 'error',
-				'rule'         => 'batch-partial-2',
+				'rule'         => 'batch-partial-test',
 				'ruletype'     => 'error',
 				'object'       => $batch_object,
 				'recordcheck'  => 1,