From 651dc62f471c85ad4c22f427a9d2a9ddf7e9380e Mon Sep 17 00:00:00 2001
From: William Patton <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 11:37:43 +0100
Subject: [PATCH 01/14] Pass flag for if user can edit the current post to the
 frontend highlighter

This is used alongside the other logged in check to determine if we show a button to rescan or clear issues to a given user
---
 includes/classes/class-enqueue-frontend.php | 1 +
 src/frontendHighlighterApp/index.js         | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/includes/classes/class-enqueue-frontend.php b/includes/classes/class-enqueue-frontend.php
index 60931d338..ce56415de 100644
--- a/includes/classes/class-enqueue-frontend.php
+++ b/includes/classes/class-enqueue-frontend.php
@@ -101,6 +101,7 @@ public static function maybe_enqueue_frontend_highlighter() {
 					'nonce'            => wp_create_nonce( 'ajax-nonce' ),
 					'restNonce'        => wp_create_nonce( 'wp_rest' ),
 					'userCanFix'       => current_user_can( apply_filters( 'edac_filter_settings_capability', 'manage_options' ) ),
+					'userCanEdit'      => current_user_can( 'edit_post', $post_id ),
 					'edacUrl'          => esc_url_raw( get_site_url() ),
 					'ajaxurl'          => admin_url( 'admin-ajax.php' ),
 					'loggedIn'         => is_user_logged_in(),
diff --git a/src/frontendHighlighterApp/index.js b/src/frontendHighlighterApp/index.js
index f4934c5ce..10795424e 100644
--- a/src/frontendHighlighterApp/index.js
+++ b/src/frontendHighlighterApp/index.js
@@ -394,12 +394,12 @@ class AccessibilityCheckerHighlight {
 	addHighlightPanel() {
 		const widgetPosition = edacFrontendHighlighterApp?.widgetPosition || 'right';
 
-		const isLoggedInUser = edacFrontendHighlighterApp && edacFrontendHighlighterApp?.loggedIn;
-		const clearButtonMarkup = isLoggedInUser
+		const userCanEdit = edacFrontendHighlighterApp && edacFrontendHighlighterApp?.userCanEdit && edacFrontendHighlighterApp?.loggedIn;
+		const clearButtonMarkup = userCanEdit
 			? `<button id="edac-highlight-clear-issues" class="edac-highlight-clear-issues">${ __( 'Clear Issues', 'accessibility-checker' ) }</button>`
 			: '';
 
-		const rescanButton = isLoggedInUser
+		const rescanButton = userCanEdit
 			? `<button id="edac-highlight-rescan" class="edac-highlight-rescan">${ __( 'Rescan This Page', 'accessibility-checker' ) }</button>`
 			: '';
 
@@ -416,7 +416,7 @@ class AccessibilityCheckerHighlight {
                                 <button id="edac-highlight-panel-controls-close" class="edac-highlight-panel-controls-close" aria-label="Close">×</button>
                                 <div class="edac-highlight-panel-controls-title">Accessibility Checker</div>
                                 <div class="edac-highlight-panel-controls-summary">Loading...</div>
-                                <div class="edac-highlight-panel-controls-buttons ${ ! isLoggedInUser ? ' single_button' : '' }">
+                                <div class="edac-highlight-panel-controls-buttons ${ ! userCanEdit ? ' single_button' : '' }">
                                         <div>
                                                 <button id="edac-highlight-previous" disabled="true"><span aria-hidden="true">« </span>Previous</button>
                                                 <button id="edac-highlight-next" disabled="true">Next<span aria-hidden="true"> »</span></button><br />

From e6e6eec988dffeefae24a6083d61837aa67dc9f9 Mon Sep 17 00:00:00 2001
From: William Patton <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 11:40:17 +0100
Subject: [PATCH 02/14] Add a helper for permission checking that checks if the
 user can edit the post in the id passed through request

---
 includes/classes/class-rest-api.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 0186c850d..b368f8b7a 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -203,6 +203,24 @@ function () use ( $ns, $version ) {
 		);
 	}
 
+	/**
+	 * Check if the user can edit a post.
+	 *
+	 * This is a permission callback to replace several places where we check if the user can edit a post.
+	 *
+	 * @param int $request The request object passed from the REST call. This should contain the 'id' of the post to check permissions for.
+	 *
+	 * @return bool
+	 */
+	public function user_can_edit_passed_post_id( $request ) {
+		// Check if the user has permission to edit posts.
+		if ( ! isset( $request['id'] ) ) {
+			return new \WP_REST_Response( [ 'message' => 'A required parameter is missing.' ], 400 );
+		}
+		$post_id = (int) $request['id'];
+		return current_user_can( 'edit_post', $post_id ); // able to edit the post.
+	}
+
 	/**
 	 * REST handler to clear issues results for a given post ID.
 	 *

From a48215bfffe7dd47e8a55d86b92e2dde12de04a2 Mon Sep 17 00:00:00 2001
From: William Patton <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 11:49:06 +0100
Subject: [PATCH 03/14] Ensure user can edit the current post when calling
 endpoint saving issues or clearing issues

---
 includes/classes/class-rest-api.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index b368f8b7a..697fcc63d 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -84,8 +84,8 @@ function () use ( $ns, $version ) {
 								},
 							],
 						],
-						'permission_callback' => function () {
-							return current_user_can( 'edit_posts' );
+						'permission_callback' => function ( $request ) {
+							return $this->user_can_edit_passed_post_id( $request );
 						},
 					]
 				);
@@ -176,8 +176,8 @@ function () use ( $ns, $version ) {
 								},
 							],
 						],
-						'permission_callback' => function () {
-							return current_user_can( 'edit_posts' );
+						'permission_callback' => function ( $request ) {
+							return $this->user_can_edit_passed_post_id( $request );
 						},
 					]
 				);

From 525151bf67522f26e5f850634794010f279ba7c9 Mon Sep 17 00:00:00 2001
From: William Patton <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 13:32:39 +0100
Subject: [PATCH 04/14] Add REST API endpoints behavior tests for permissions
 on post scan results and issue clearing

---
 .../includes/classes/RestApiEndpointsTest.php | 163 ++++++++++++++++++
 1 file changed, 163 insertions(+)
 create mode 100644 tests/phpunit/includes/classes/RestApiEndpointsTest.php

diff --git a/tests/phpunit/includes/classes/RestApiEndpointsTest.php b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
new file mode 100644
index 000000000..8332f19cd
--- /dev/null
+++ b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
@@ -0,0 +1,163 @@
+<?php
+/**
+ * REST API endpoints behavior tests.
+ *
+ * @package Accessibility_Checker
+ */
+
+/**
+ * Test class for REST API endpoints.
+ *
+ * @group rest
+ */
+class RestApiEndpointsTest extends WP_UnitTestCase {
+	/**
+	 * Admin user ID.
+	 *
+	 * @var int
+	 */
+	protected static $admin_id;
+
+	/**
+	 * Limited user ID.
+	 *
+	 * @var int
+	 */
+	protected static $limited_id;
+
+	/**
+	 * Post ID used for tests.
+	 *
+	 * @var int
+	 */
+	protected static $post_id;
+
+	/**
+	 * REST server instance for dispatching requests.
+	 *
+	 * @var WP_REST_Server|null
+	 */
+	private $server;
+
+	/**
+	 * Set up before each test.
+	 *
+	 * @return void
+	 */
+	protected function setUp(): void {
+		parent::setUp();
+		// Initialize REST routes for each test.
+		do_action( 'init' );
+		do_action( 'rest_api_init' );
+		$this->server = rest_get_server();
+	}
+
+	/**
+	 * Clean up after each test.
+	 *
+	 * @return void
+	 */
+	protected function tearDown(): void {
+		// Reset current user between tests.
+		wp_set_current_user( 0 );
+		parent::tearDown();
+	}
+
+	/**
+	 * Create shared fixtures for this test class.
+	 *
+	 * @param WP_UnitTest_Factory $factory Factory instance.
+	 * @return void
+	 */
+	public static function wpSetUpBeforeClass( $factory ) {
+		// Ensure posts are scannable by plugin.
+		update_option( 'edac_post_types', [ 'post' ] );
+
+		// Ensure plugin DB table exists for tests (normally created via admin_init).
+		( new \EDAC\Admin\Update_Database() )->edac_update_database();
+
+		self::$admin_id   = $factory->user->create( [ 'role' => 'administrator' ] );
+		self::$limited_id = $factory->user->create( [ 'role' => 'subscriber' ] );
+		// Give limited user edit_posts but not edit_others_posts so they cannot edit this post.
+		$user = new WP_User( self::$limited_id );
+		$user->add_cap( 'edit_posts' );
+
+		self::$post_id = $factory->post->create(
+			[
+				'post_type'    => 'post',
+				'post_status'  => 'publish',
+				'post_author'  => self::$admin_id,
+				'post_title'   => 'EDAC PHPUnit Post',
+				'post_content' => '<main><h1>Title</h1><p>Img without alt <img src="/wp-includes/images/media/default.png"></p></main>',
+			]
+		);
+	}
+
+	/**
+	 * Verify permissions for saving post scan results.
+	 *
+	 * @return void
+	 */
+	public function test_rest_post_scan_results_permissions() {
+		$this->assertNotNull( $this->server );
+
+		// Minimal violations payload similar to scanner output.
+		$violations = [
+			[
+				'ruleId'   => 'image-alt',
+				'html'     => '<img src="/wp-includes/images/media/default.png">',
+				'impact'   => 'error',
+				'landmark' => null,
+			],
+		];
+
+		// Admin can POST results for the post.
+		wp_set_current_user( self::$admin_id );
+		$request = new WP_REST_Request( 'POST', '/accessibility-checker/v1/post-scan-results/' . self::$post_id );
+		$request->set_param( 'id', self::$post_id );
+		$request->set_param( 'violations', $violations );
+		$response = $this->server->dispatch( $request );
+		$this->assertSame( 200, $response->get_status(), 'Admin should be allowed to save scan results.' );
+		$data = $response->get_data();
+		$this->assertIsArray( $data );
+
+		// Limited user cannot POST results for the admin-owned post.
+		wp_set_current_user( self::$limited_id );
+		$request2 = new WP_REST_Request( 'POST', '/accessibility-checker/v1/post-scan-results/' . self::$post_id );
+		$request2->set_param( 'id', self::$post_id );
+		$request2->set_param( 'violations', $violations );
+		$response2 = $this->server->dispatch( $request2 );
+		$this->assertSame( 403, $response2->get_status(), 'Limited user must not be allowed to save scan results for another user\'s post.' );
+	}
+
+	/**
+	 * Verify permissions for clearing issues for a post.
+	 *
+	 * @return void
+	 */
+	public function test_rest_clear_issues_permissions() {
+		$this->assertNotNull( $this->server );
+
+		// Admin can clear issues.
+		wp_set_current_user( self::$admin_id );
+		$r1 = new WP_REST_Request( 'POST', '/accessibility-checker/v1/clear-issues/' . self::$post_id );
+		$r1->set_param( 'id', self::$post_id );
+		$r1->set_body( wp_json_encode( [ 'flush' => true ] ) );
+		$r1->set_header( 'Content-Type', 'application/json' );
+		$resp1 = $this->server->dispatch( $r1 );
+		$this->assertSame( 200, $resp1->get_status(), 'Admin should be allowed to clear issues.' );
+		$body1 = $resp1->get_data();
+		$this->assertIsArray( $body1 );
+		$this->assertArrayHasKey( 'success', $body1 );
+		$this->assertTrue( $body1['success'] );
+
+		// Limited user cannot clear issues for a post they cannot edit.
+		wp_set_current_user( self::$limited_id );
+		$r2 = new WP_REST_Request( 'POST', '/accessibility-checker/v1/clear-issues/' . self::$post_id );
+		$r2->set_param( 'id', self::$post_id );
+		$r2->set_body( wp_json_encode( [ 'flush' => true ] ) );
+		$r2->set_header( 'Content-Type', 'application/json' );
+		$resp2 = $this->server->dispatch( $r2 );
+		$this->assertSame( 403, $resp2->get_status(), 'Limited user must not be allowed to clear issues.' );
+	}
+}

From edf9b50606697c8a4e0cb09395b3e861935c92e3 Mon Sep 17 00:00:00 2001
From: pattonwebz <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 14:40:31 +0100
Subject: [PATCH 05/14] Add test for limited user managing their own post

This test verifies that a limited user can save scan results and clear issues for their own post.

[PRO-165]
---
 .../includes/classes/RestApiEndpointsTest.php | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/tests/phpunit/includes/classes/RestApiEndpointsTest.php b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
index 8332f19cd..16e9f3f8b 100644
--- a/tests/phpunit/includes/classes/RestApiEndpointsTest.php
+++ b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
@@ -160,4 +160,43 @@ public function test_rest_clear_issues_permissions() {
 		$resp2 = $this->server->dispatch( $r2 );
 		$this->assertSame( 403, $resp2->get_status(), 'Limited user must not be allowed to clear issues.' );
 	}
+
+	/**
+	 * Verify that a limited user can manage their own post.
+	 *
+	 * @return void
+	 */
+	public function test_limited_user_can_manage_own_post() {
+		wp_set_current_user( self::$limited_id );
+		$own_post_id = self::factory()->post->create(
+			[
+				'post_type'   => 'post',
+				'post_status' => 'draft',
+				'post_author' => self::$limited_id,
+			] 
+		);
+
+		// Save scan results.
+		$req1 = new WP_REST_Request( 'POST', '/accessibility-checker/v1/post-scan-results/' . $own_post_id );
+		$req1->set_param( 'id', $own_post_id );
+		$req1->set_param(
+			'violations',
+			[
+				[
+					'ruleId' => 'image-alt',
+					'html'   => '<img>',
+				],
+			] 
+		);
+		$resp1 = $this->server->dispatch( $req1 );
+		$this->assertSame( 200, $resp1->get_status() );
+
+		// Clear issues.
+		$req2 = new WP_REST_Request( 'POST', '/accessibility-checker/v1/clear-issues/' . $own_post_id );
+		$req2->set_param( 'id', $own_post_id );
+		$req2->set_body( wp_json_encode( [ 'flush' => true ] ) );
+		$req2->set_header( 'Content-Type', 'application/json' );
+		$resp2 = $this->server->dispatch( $req2 );
+		$this->assertSame( 200, $resp2->get_status() );
+	}
 }

From 1f170c18407bb4514352633a7c4f4f2f6c2d5baf Mon Sep 17 00:00:00 2001
From: pattonwebz <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 14:41:03 +0100
Subject: [PATCH 06/14] Add required validation and sanitization for post ID
 arguments

Enhance the API by ensuring that the 'id' argument is required and properly sanitized.
---
 includes/classes/class-rest-api.php | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 697fcc63d..845887557 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -79,9 +79,10 @@ function () use ( $ns, $version ) {
 						'callback'            => [ $this, 'set_post_scan_results' ],
 						'args'                => [
 							'id' => [
+								'required'          => true,
 								'validate_callback' => function ( $param ) {
-									return is_numeric( $param );
-								},
+									return is_numeric( $param ); },
+								'sanitize_callback' => 'absint',
 							],
 						],
 						'permission_callback' => function ( $request ) {
@@ -171,9 +172,10 @@ function () use ( $ns, $version ) {
 						'callback'            => [ $this, 'clear_issues_for_post' ],
 						'args'                => [
 							'id' => [
+								'required'          => true,
 								'validate_callback' => function ( $param ) {
-									return is_numeric( $param );
-								},
+									return is_numeric( $param ); },
+								'sanitize_callback' => 'absint',
 							],
 						],
 						'permission_callback' => function ( $request ) {

From f4b27d61950e7f7ad1df01849b69b04ba2c6d215 Mon Sep 17 00:00:00 2001
From: pattonwebz <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 14:42:16 +0100
Subject: [PATCH 07/14] Handle correct passed param types and return types

---
 includes/classes/class-rest-api.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 845887557..44515a93a 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -210,14 +210,15 @@ function () use ( $ns, $version ) {
 	 *
 	 * This is a permission callback to replace several places where we check if the user can edit a post.
 	 *
-	 * @param int $request The request object passed from the REST call. This should contain the 'id' of the post to check permissions for.
+	 * @since 1.31.0
 	 *
-	 * @return bool
+	 * @param \WP_REST_Request $request The request object passed from the REST call. This should contain the 'id' of the post to check permissions for.
+	 *
+	 * @return bool|\WP_Error
 	 */
 	public function user_can_edit_passed_post_id( $request ) {
-		// Check if the user has permission to edit posts.
 		if ( ! isset( $request['id'] ) ) {
-			return new \WP_REST_Response( [ 'message' => 'A required parameter is missing.' ], 400 );
+			return new \WP_Error( 'rest_post_invalid_id', __( 'A required parameter is missing.', 'accessibility-checker' ), [ 'status' => 400 ] );
 		}
 		$post_id = (int) $request['id'];
 		return current_user_can( 'edit_post', $post_id ); // able to edit the post.
@@ -226,7 +227,7 @@ public function user_can_edit_passed_post_id( $request ) {
 	/**
 	 * REST handler to clear issues results for a given post ID.
 	 *
-	 * @param WP_REST_Request $request  The request passed from the REST call.
+	 * @param \WP_REST_Request $request  The request passed from the REST call.
 	 *
 	 * @return \WP_REST_Response
 	 */

From 2b10940e1c32c2c261f249e13033ed19b27bb4f9 Mon Sep 17 00:00:00 2001
From: pattonwebz <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 14:54:03 +0100
Subject: [PATCH 08/14] Fix code formatting for numeric validation callbacks

Ensure consistent code style by aligning closing braces for validation callbacks in the REST API.
---
 includes/classes/class-rest-api.php                     | 6 ++++--
 tests/phpunit/includes/classes/RestApiEndpointsTest.php | 4 ++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 44515a93a..849096d2d 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -81,7 +81,8 @@ function () use ( $ns, $version ) {
 							'id' => [
 								'required'          => true,
 								'validate_callback' => function ( $param ) {
-									return is_numeric( $param ); },
+									return is_numeric( $param );
+								},
 								'sanitize_callback' => 'absint',
 							],
 						],
@@ -174,7 +175,8 @@ function () use ( $ns, $version ) {
 							'id' => [
 								'required'          => true,
 								'validate_callback' => function ( $param ) {
-									return is_numeric( $param ); },
+									return is_numeric( $param );
+								},
 								'sanitize_callback' => 'absint',
 							],
 						],
diff --git a/tests/phpunit/includes/classes/RestApiEndpointsTest.php b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
index 16e9f3f8b..6c42e390c 100644
--- a/tests/phpunit/includes/classes/RestApiEndpointsTest.php
+++ b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
@@ -173,7 +173,7 @@ public function test_limited_user_can_manage_own_post() {
 				'post_type'   => 'post',
 				'post_status' => 'draft',
 				'post_author' => self::$limited_id,
-			] 
+			]
 		);
 
 		// Save scan results.
@@ -186,7 +186,7 @@ public function test_limited_user_can_manage_own_post() {
 					'ruleId' => 'image-alt',
 					'html'   => '<img>',
 				],
-			] 
+			]
 		);
 		$resp1 = $this->server->dispatch( $req1 );
 		$this->assertSame( 200, $resp1->get_status() );

From b139ffb264ae28ea549ece9db6db7d2aa74010f6 Mon Sep 17 00:00:00 2001
From: pattonwebz <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 15:02:12 +0100
Subject: [PATCH 09/14] Enhance API response validation in tests

Added assertions to check for 'success', 'id', and 'flushed' keys in the API response data for various test cases.
---
 .../includes/classes/RestApiEndpointsTest.php    | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tests/phpunit/includes/classes/RestApiEndpointsTest.php b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
index 6c42e390c..cfb30d599 100644
--- a/tests/phpunit/includes/classes/RestApiEndpointsTest.php
+++ b/tests/phpunit/includes/classes/RestApiEndpointsTest.php
@@ -120,6 +120,10 @@ public function test_rest_post_scan_results_permissions() {
 		$this->assertSame( 200, $response->get_status(), 'Admin should be allowed to save scan results.' );
 		$data = $response->get_data();
 		$this->assertIsArray( $data );
+		$this->assertArrayHasKey( 'success', $data );
+		$this->assertTrue( $data['success'] );
+		$this->assertArrayHasKey( 'id', $data );
+		$this->assertSame( self::$post_id, $data['id'] );
 
 		// Limited user cannot POST results for the admin-owned post.
 		wp_set_current_user( self::$limited_id );
@@ -150,6 +154,10 @@ public function test_rest_clear_issues_permissions() {
 		$this->assertIsArray( $body1 );
 		$this->assertArrayHasKey( 'success', $body1 );
 		$this->assertTrue( $body1['success'] );
+		$this->assertArrayHasKey( 'id', $body1 );
+		$this->assertSame( self::$post_id, $body1['id'] );
+		$this->assertArrayHasKey( 'flushed', $body1 );
+		$this->assertTrue( $body1['flushed'] );
 
 		// Limited user cannot clear issues for a post they cannot edit.
 		wp_set_current_user( self::$limited_id );
@@ -190,6 +198,10 @@ public function test_limited_user_can_manage_own_post() {
 		);
 		$resp1 = $this->server->dispatch( $req1 );
 		$this->assertSame( 200, $resp1->get_status() );
+		$data1 = $resp1->get_data();
+		$this->assertIsArray( $data1 );
+		$this->assertArrayHasKey( 'success', $data1 );
+		$this->assertTrue( $data1['success'] );
 
 		// Clear issues.
 		$req2 = new WP_REST_Request( 'POST', '/accessibility-checker/v1/clear-issues/' . $own_post_id );
@@ -198,5 +210,9 @@ public function test_limited_user_can_manage_own_post() {
 		$req2->set_header( 'Content-Type', 'application/json' );
 		$resp2 = $this->server->dispatch( $req2 );
 		$this->assertSame( 200, $resp2->get_status() );
+		$data2 = $resp2->get_data();
+		$this->assertIsArray( $data2 );
+		$this->assertArrayHasKey( 'success', $data2 );
+		$this->assertTrue( $data2['success'] );
 	}
 }

From 7a20d435274aa9743bca3a602f5f38493dc17cc9 Mon Sep 17 00:00:00 2001
From: Steve Jones <steve@stevejonesdev.com>
Date: Tue, 19 Aug 2025 12:27:55 -0400
Subject: [PATCH 10/14] updated: permission callback to require 'edit_posts'
 capability for accessing scan stats

---
 includes/classes/class-rest-api.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 849096d2d..a82ccc5f7 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -104,7 +104,7 @@ function () use ( $ns, $version ) {
 						'methods'             => 'GET',
 						'callback'            => [ $this, 'get_scans_stats' ],
 						'permission_callback' => function () {
-							return current_user_can( 'read' ); // able to access the admin dashboard.
+							return current_user_can( 'edit_posts' ); // able to access the admin dashboard.
 						},
 					]
 				);

From ab4599b76d4bd67e20095ddda900a6dac35d70f2 Mon Sep 17 00:00:00 2001
From: Steve Jones <steve@stevejonesdev.com>
Date: Tue, 19 Aug 2025 12:34:26 -0400
Subject: [PATCH 11/14] updated: permission callbacks to require 'edit_posts'
 capability for accessing scan stats

---
 includes/classes/class-rest-api.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index a82ccc5f7..8195c6763 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -104,7 +104,7 @@ function () use ( $ns, $version ) {
 						'methods'             => 'GET',
 						'callback'            => [ $this, 'get_scans_stats' ],
 						'permission_callback' => function () {
-							return current_user_can( 'edit_posts' ); // able to access the admin dashboard.
+							return current_user_can( 'edit_posts' );
 						},
 					]
 				);
@@ -121,7 +121,7 @@ function () use ( $ns, $version ) {
 						'methods'             => 'POST',
 						'callback'            => [ $this, 'clear_cached_scans_stats' ],
 						'permission_callback' => function () {
-							return current_user_can( 'read' ); // able to access the admin dashboard.
+							return current_user_can( 'edit_posts' );
 						},
 					]
 				);

From 9889dd90b77d55c09c135692d9091e62923d7c7f Mon Sep 17 00:00:00 2001
From: Steve Jones <steve@stevejonesdev.com>
Date: Tue, 19 Aug 2025 12:35:39 -0400
Subject: [PATCH 12/14] updated: permission callbacks to require 'edit_posts'
 capability for accessing scan stats

---
 includes/classes/class-rest-api.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 8195c6763..e65ba534a 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -138,7 +138,7 @@ function () use ( $ns, $version ) {
 						'methods'             => 'GET',
 						'callback'            => [ $this, 'get_scans_stats_by_post_type' ],
 						'permission_callback' => function () {
-							return current_user_can( 'read' ); // able to access the admin dashboard.
+							return current_user_can( 'edit_posts' );
 						},
 					]
 				);
@@ -155,7 +155,7 @@ function () use ( $ns, $version ) {
 						'methods'             => 'GET',
 						'callback'            => [ $this, 'get_scans_stats_by_post_types' ],
 						'permission_callback' => function () {
-							return current_user_can( 'read' ); // able to access the admin dashboard.
+							return current_user_can( 'edit_posts' );
 						},
 					]
 				);

From 0bf343fbb8c29a77c9866b047548d4dbe98fa720 Mon Sep 17 00:00:00 2001
From: Steve Jones <steve@stevejonesdev.com>
Date: Tue, 19 Aug 2025 13:05:56 -0400
Subject: [PATCH 13/14] updated: permission callback to require 'publish_posts'
 capability for clearing cached scan stats

---
 admin/class-welcome-page.php        | 8 +++++---
 includes/classes/class-rest-api.php | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/admin/class-welcome-page.php b/admin/class-welcome-page.php
index 4679a90d6..6f541b603 100644
--- a/admin/class-welcome-page.php
+++ b/admin/class-welcome-page.php
@@ -40,9 +40,11 @@ public static function render_summary() {
 						</div>
 
 						<p class="edac-cols-right">
-							<button class="button" id="edac_clear_cached_stats">
-								<?php esc_html_e( 'Update Counts', 'accessibility-checker' ); ?>
-							</button>
+							<?php if ( current_user_can( 'publish_posts' ) ) : ?>
+								<button class="button" id="edac_clear_cached_stats">
+									<?php esc_html_e( 'Update Counts', 'accessibility-checker' ); ?>
+								</button>
+							<?php endif; ?>
 
 							<a class="edac-ml-1 button" href="<?php echo esc_url( admin_url( 'admin.php?page=accessibility_checker_full_site_scan' ) ); ?>">
 								<?php esc_html_e( 'Start New Scan', 'accessibility-checker' ); ?>
diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index e65ba534a..38d5f7103 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -121,7 +121,7 @@ function () use ( $ns, $version ) {
 						'methods'             => 'POST',
 						'callback'            => [ $this, 'clear_cached_scans_stats' ],
 						'permission_callback' => function () {
-							return current_user_can( 'edit_posts' );
+							return current_user_can( 'publish_posts' );
 						},
 					]
 				);

From 3456ce5f5fe02b7f2e8238d1a7538a18d4f1366f Mon Sep 17 00:00:00 2001
From: pattonwebz <will@pattonwebz.com>
Date: Tue, 19 Aug 2025 19:12:28 +0100
Subject: [PATCH 14/14] Bump version to 1.30.1 and update changelog

Updated the plugin version in multiple files to reflect the new release and added improvements to the changelog.

[PRO-165]
---
 accessibility-checker.php           | 6 +++---
 includes/classes/class-rest-api.php | 2 +-
 package.json                        | 2 +-
 readme.txt                          | 6 +++++-
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/accessibility-checker.php b/accessibility-checker.php
index 0f1e31bf7..b7c745b88 100755
--- a/accessibility-checker.php
+++ b/accessibility-checker.php
@@ -10,7 +10,7 @@
  * Plugin Name:       Accessibility Checker
  * Plugin URI:        https://a11ychecker.com
  * Description:       Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.
- * Version:           1.30.0
+ * Version:           1.30.1
  * Requires PHP:      7.4
  * Author:            Equalize Digital
  * Author URI:        https://equalizedigital.com
@@ -36,7 +36,7 @@
 
 // Current plugin version.
 if ( ! defined( 'EDAC_VERSION' ) ) {
-	define( 'EDAC_VERSION', '1.30.0' );
+	define( 'EDAC_VERSION', '1.30.1' );
 }
 
 // Current database version.
@@ -122,7 +122,7 @@ function edac_register_rules() {
 
 	// Use the new class-based rules system.
 	$default_rules = \EqualizeDigital\AccessibilityChecker\Rules\RuleRegistry::load_rules();
-	
+
 	/**
 	 * Filter the default rules.
 	 *
diff --git a/includes/classes/class-rest-api.php b/includes/classes/class-rest-api.php
index 38d5f7103..d1f1a0c4d 100644
--- a/includes/classes/class-rest-api.php
+++ b/includes/classes/class-rest-api.php
@@ -212,7 +212,7 @@ function () use ( $ns, $version ) {
 	 *
 	 * This is a permission callback to replace several places where we check if the user can edit a post.
 	 *
-	 * @since 1.31.0
+	 * @since 1.30.1
 	 *
 	 * @param \WP_REST_Request $request The request object passed from the REST call. This should contain the 'id' of the post to check permissions for.
 	 *
diff --git a/package.json b/package.json
index de8ff35bd..c7a7ec7ac 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "accessibility-checker",
-  "version": "1.30.0",
+  "version": "1.30.1",
   "description": "Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.",
   "author": "Equalize Digital",
   "license": "GPL-2.0+",
diff --git a/readme.txt b/readme.txt
index 7098b2d1d..b552feb86 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,7 +3,7 @@ Contributors: equalizedigital, alh0319, stevejonesdev
 Tags: accessibility, accessible, wcag, ada, WP accessibility
 Requires at least: 6.6
 Tested up to: 6.8
-Stable tag: 1.30.0
+Stable tag: 1.30.1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -211,6 +211,10 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro
 
 == Changelog ==
 
+= 1.30.1 =
+* Improved: The rescan and clear buttons in the frontend highlighter are now only shown when they can be used.
+* Improved: Issue saving and clearing now has more robust capability checking.
+
 = 1.30.0 =
 * Added: Ability to clear issues on a post or page from the frontend highlighter.
 * Added: More accessibility checker details in the site health check.