@@ -636,9 +653,18 @@ function FeatureToggleWithSettings( {
onChange( { [ field.id ]: value } );
} }
/>
- { checked && isAdvancedSettingsEnabled && feature && (
-
- ) }
+ { checked &&
+ isAdvancedSettingsEnabled &&
+ feature &&
+ feature.settingsFields.length > 0 && (
+
+ ) }
+ { checked &&
+ isAccessControlMode &&
+ feature &&
+ canHaveAccessControl( feature ) && (
+
+ ) }
{ checked && isDeveloperMode && feature && (
+ { globalEnabled &&
+ checked &&
+ isAccessControlMode &&
+ feature &&
+ canHaveAccessControl( feature ) && (
+
+ ) }
{ globalEnabled && checked && isDeveloperMode && feature && (
( () => {
// Return the stable module-level reference when page data is available so
@@ -899,11 +935,13 @@ function AISettingsPage() {
} else {
const featureId = feature.id;
const featureCapability = feature.capability;
+ const featureCategory = feature.category;
baseField.Edit = ( props ) => (
);
}
@@ -1010,194 +1048,236 @@ function AISettingsPage() {
return (
- }
- title={ __( 'AI', 'ai' ) }
- subTitle={ __(
- 'Configure AI features and experiments for your WordPress site.',
- 'ai'
- ) }
- actions={
- <>
-
- {
- void handleChange( {
- [ GLOBAL_FIELD_ID ]: checked,
- } );
- } }
- disabled={ isLoading }
- />
-
-
-
- { __( 'Docs', 'ai' ) }
-
-
- { __( 'Contribute', 'ai' ) }
-
-
- { () => (
- <>
-
-
-
-
-
-
-
-
-
- ) }
-
- { /* Hidden file input for import */ }
-
- { pendingImport && (
- {
- void handleImportConfirm();
- } }
- onCancel={ handleImportCancel }
- isImporting={ isImporting }
- />
- ) }
-
- }
+
-
- { ! PAGE_DATA.hasValidCredentials && (
-
-
- { ! PAGE_DATA.hasCredentials
- ? __(
- 'The AI plugin requires a valid AI Connector to function properly. Verify you have one or more AI Connectors configured.',
- 'ai'
- )
- : __(
- 'The AI plugin requires a valid AI Connector to function properly. Please review the AI Connectors you have configured to ensure they are valid.',
- 'ai'
- ) }
-
- { PAGE_DATA.connectorsUrl && (
-
-
- { __( 'Manage Connectors', 'ai' ) }
-
-
- ) }
-
- ) }
- { isLoading ? (
+
+ }
+ title={ __( 'AI', 'ai' ) }
+ subTitle={ __(
+ 'Configure AI features and experiments for your WordPress site.',
+ 'ai'
+ ) }
+ actions={
+ <>
+
+ {
+ void handleChange( {
+ [ GLOBAL_FIELD_ID ]:
+ checked,
+ } );
+ } }
+ disabled={ isLoading }
+ />
+
+
+
+ { __( 'Docs', 'ai' ) }
+
+
+ { __( 'Contribute', 'ai' ) }
+
+
+ { () => (
+ <>
+
+
+
+
+
+
+
+
+
+
+ ) }
+
+ { /* Hidden file input for import */ }
+
+ { pendingImport && (
+ {
+ void handleImportConfirm();
+ } }
+ onCancel={ handleImportCancel }
+ isImporting={ isImporting }
+ />
+ ) }
+
+ }
+ >
-
+ { ! PAGE_DATA.hasValidCredentials && (
+
+
+ { ! PAGE_DATA.hasCredentials
+ ? __(
+ 'The AI plugin requires a valid AI Connector to function properly. Verify you have one or more AI Connectors configured.',
+ 'ai'
+ )
+ : __(
+ 'The AI plugin requires a valid AI Connector to function properly. Please review the AI Connectors you have configured to ensure they are valid.',
+ 'ai'
+ ) }
+
+ { PAGE_DATA.connectorsUrl && (
+
+
+ { __(
+ 'Manage Connectors',
+ 'ai'
+ ) }
+
+
+ ) }
+
+ ) }
+ { isLoading ? (
+
+
+
+ ) : (
+
+ data={ data }
+ fields={ fields }
+ form={ form }
+ onChange={ handleChange }
+ />
+ ) }
- ) : (
-
- data={ data }
- fields={ fields }
- form={ form }
- onChange={ handleChange }
- />
- ) }
-
-
+
+
+
);
diff --git a/routes/ai-home/style.scss b/routes/ai-home/style.scss
index dbc7f1d5a..ce46280c1 100644
--- a/routes/ai-home/style.scss
+++ b/routes/ai-home/style.scss
@@ -90,6 +90,45 @@ body:has(.ai-settings-page) .components-popover {
}
}
+.ai-access-control-mode-fields {
+ margin-top: var(--wpds-dimension-gap-md, 12px);
+
+ &__fieldset {
+ border: none;
+ margin: 0;
+ padding: 0;
+ }
+
+ &__legend {
+ font-size: 11px;
+ font-weight: 500;
+ text-transform: uppercase;
+ letter-spacing: 0.5px;
+ margin-bottom: 8px;
+ }
+
+ &__roles-grid {
+ display: grid;
+ grid-template-columns: repeat(3, 1fr);
+ gap: 12px;
+ }
+
+ &__user-search-wrapper {
+ position: relative;
+ }
+
+ &__user-search-input {
+ flex: 1;
+ }
+
+ &__user-search-spinner {
+ margin-top: 4px;
+ position: absolute;
+ inset-inline-end: 0;
+ top: 20px;
+ }
+}
+
/**
* Snackbar notifications are rendered full-width by the route shell and, by
* default, centered over the (centered) settings content, where they obscure
diff --git a/tests/Integration/Includes/Admin/Site_HealthTest.php b/tests/Integration/Includes/Admin/Site_HealthTest.php
index 9a592524d..d74aab397 100644
--- a/tests/Integration/Includes/Admin/Site_HealthTest.php
+++ b/tests/Integration/Includes/Admin/Site_HealthTest.php
@@ -267,4 +267,3 @@ public function test_credentials_test_badge_label_is_ai(): void {
$this->assertSame( 'AI', $result['badge']['label'] );
}
}
-
diff --git a/tests/Integration/Includes/HelpersTest.php b/tests/Integration/Includes/HelpersTest.php
index f6b2ea841..63aa13d4b 100644
--- a/tests/Integration/Includes/HelpersTest.php
+++ b/tests/Integration/Includes/HelpersTest.php
@@ -2218,4 +2218,67 @@ public function test_deprecated_get_post_details_ability_still_executes(): void
$this->assertSame( array( 'title' => 'Deprecated Title' ), $result, 'The deprecated ability should still return post details.' );
}
+
+ /**
+ * Tests current_user_can_access_feature() evaluates user restrictions.
+ *
+ * @since x.x.x
+ */
+ public function test_current_user_can_access_feature_evaluates_user_restrictions(): void {
+ $feature_id = 'test_user_access_feature';
+ $allowed_user = $this->factory->user->create( array( 'role' => 'editor' ) );
+ $unallowed_user = $this->factory->user->create( array( 'role' => 'editor' ) );
+
+ update_option( "wpai_feature_{$feature_id}_users", array( $allowed_user ) );
+
+ try {
+ wp_set_current_user( $allowed_user );
+ $this->assertTrue( \WordPress\AI\current_user_can_access_feature( $feature_id ) );
+
+ wp_set_current_user( $unallowed_user );
+ $this->assertFalse( \WordPress\AI\current_user_can_access_feature( $feature_id ) );
+ } finally {
+ delete_option( "wpai_feature_{$feature_id}_users" );
+ }
+ }
+
+ /**
+ * Tests current_user_can_access_feature() evaluates role restrictions.
+ *
+ * @since x.x.x
+ */
+ public function test_current_user_can_access_feature_evaluates_role_restrictions(): void {
+ $feature_id = 'test_role_access_feature';
+ $admin_id = $this->factory->user->create( array( 'role' => 'administrator' ) );
+ $subscriber_id = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+
+ update_option( "wpai_feature_{$feature_id}_roles", array( 'administrator' ) );
+
+ try {
+ wp_set_current_user( $admin_id );
+ $this->assertTrue( \WordPress\AI\current_user_can_access_feature( $feature_id ) );
+
+ wp_set_current_user( $subscriber_id );
+ $this->assertFalse( \WordPress\AI\current_user_can_access_feature( $feature_id ) );
+ } finally {
+ delete_option( "wpai_feature_{$feature_id}_roles" );
+ }
+ }
+
+ /**
+ * Tests current_user_can_access_feature() directly denies subscribers and contributors.
+ *
+ * @since x.x.x
+ */
+ public function test_current_user_can_access_feature_denies_subscribers_and_contributors(): void {
+ $feature_id = 'test_subscriber_contributor_access';
+ $subscriber_id = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+ $contributor_id = $this->factory->user->create( array( 'role' => 'contributor' ) );
+
+ wp_set_current_user( $subscriber_id );
+ $this->assertFalse( \WordPress\AI\current_user_can_access_feature( $feature_id ) );
+
+ wp_set_current_user( $contributor_id );
+ $this->assertFalse( \WordPress\AI\current_user_can_access_feature( $feature_id ) );
+ }
}
diff --git a/tests/Integration/Includes/REST/Roles_Users_ControllerTest.php b/tests/Integration/Includes/REST/Roles_Users_ControllerTest.php
new file mode 100644
index 000000000..e68d5213c
--- /dev/null
+++ b/tests/Integration/Includes/REST/Roles_Users_ControllerTest.php
@@ -0,0 +1,172 @@
+controller = new Roles_Users_Controller();
+ $this->controller->init();
+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Registering routes on core REST hook.
+ do_action( 'rest_api_init' );
+ }
+
+ /**
+ * Test that the route is registered correctly with GET method and search schema.
+ *
+ * @since x.x.x
+ */
+ public function test_route_registration_and_schema(): void {
+ $routes = rest_get_server()->get_routes();
+
+ $this->assertArrayHasKey( '/ai/v1/roles-users', $routes );
+ $route = $routes['/ai/v1/roles-users'][0];
+
+ $this->assertArrayHasKey( 'GET', $route['methods'] );
+ $this->assertArrayHasKey( 'search', $route['args'] );
+ $this->assertSame( 'string', $route['args']['search']['type'] );
+ $this->assertSame( 'sanitize_text_field', $route['args']['search']['sanitize_callback'] );
+ }
+
+ /**
+ * Test security permissions across unauthenticated and non-admin users.
+ *
+ * @since x.x.x
+ */
+ public function test_permission_checks(): void {
+ // 1. Unauthenticated request.
+ wp_set_current_user( 0 );
+ $request = new WP_REST_Request( 'GET', '/ai/v1/roles-users' );
+ $response = rest_get_server()->dispatch( $request );
+ $this->assertContains( $response->get_status(), array( 401, 403 ), 'Unauthenticated requests must be rejected.' );
+
+ // 2. Authenticated Subscriber.
+ $subscriber_id = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+ wp_set_current_user( $subscriber_id );
+ $response = rest_get_server()->dispatch( $request );
+ $this->assertSame( 403, $response->get_status(), 'Subscribers must be denied access.' );
+
+ // 3. Authenticated Editor.
+ $editor_id = $this->factory->user->create( array( 'role' => 'editor' ) );
+ wp_set_current_user( $editor_id );
+ $response = rest_get_server()->dispatch( $request );
+ $this->assertSame( 403, $response->get_status(), 'Editors without manage_options must be denied access.' );
+
+ // 4. Authenticated Administrator.
+ $admin_id = $this->factory->user->create( array( 'role' => 'administrator' ) );
+ wp_set_current_user( $admin_id );
+ $response = rest_get_server()->dispatch( $request );
+ $this->assertSame( 200, $response->get_status(), 'Administrators must be granted access.' );
+ }
+
+ /**
+ * Test that response structure contains all registered WordPress roles with correct schema.
+ *
+ * @since x.x.x
+ */
+ public function test_get_roles_users_response_structure_and_roles_data(): void {
+ $admin_id = $this->factory->user->create( array( 'role' => 'administrator' ) );
+ wp_set_current_user( $admin_id );
+
+ $request = new WP_REST_Request( 'GET', '/ai/v1/roles-users' );
+ $response = rest_get_server()->dispatch( $request );
+ $data = $response->get_data();
+
+ $this->assertSame( 200, $response->get_status() );
+ $this->assertArrayHasKey( 'roles', $data );
+ $this->assertArrayHasKey( 'users', $data );
+
+ $expected_roles = array_diff( array_keys( wp_roles()->roles ), array( 'subscriber', 'contributor' ) );
+ $returned_role_ids = array_column( $data['roles'], 'id' );
+
+ foreach ( $expected_roles as $role_id ) {
+ $this->assertContains( $role_id, $returned_role_ids, "Response should include registered role {$role_id}." );
+ }
+
+ $this->assertNotContains( 'subscriber', $returned_role_ids, 'Subscriber role should be excluded.' );
+ $this->assertNotContains( 'contributor', $returned_role_ids, 'Contributor role should be excluded.' );
+
+ foreach ( $data['roles'] as $role ) {
+ $this->assertArrayHasKey( 'id', $role );
+ $this->assertArrayHasKey( 'name', $role );
+ $this->assertIsString( $role['id'] );
+ $this->assertIsString( $role['name'] );
+ }
+ }
+
+ /**
+ * Test user listing, search filtering, and result capping (MAX_USERS = 10).
+ *
+ * @since x.x.x
+ */
+ public function test_get_roles_users_user_search_and_limits(): void {
+ $admin_id = $this->factory->user->create(
+ array(
+ 'role' => 'administrator',
+ 'display_name' => 'TargetAdminUser',
+ 'user_login' => 'targetadminuser',
+ )
+ );
+ wp_set_current_user( $admin_id );
+
+ // Create 11 extra users to verify the 10-user limit.
+ for ( $i = 1; $i <= 11; $i++ ) {
+ $this->factory->user->create(
+ array(
+ 'role' => 'subscriber',
+ 'display_name' => "BatchUser{$i}",
+ )
+ );
+ }
+
+ // 1. Unfiltered request should cap users at 10.
+ $request = new WP_REST_Request( 'GET', '/ai/v1/roles-users' );
+ $response = rest_get_server()->dispatch( $request );
+ $data = $response->get_data();
+
+ $this->assertSame( 200, $response->get_status() );
+ $this->assertCount( 10, $data['users'], 'Unfiltered user results must be capped at MAX_USERS (10).' );
+
+ foreach ( $data['users'] as $user ) {
+ $this->assertIsInt( $user['id'] );
+ $this->assertIsString( $user['name'] );
+ }
+
+ // 2. Search filtered request.
+ $request->set_param( 'search', 'TargetAdminUser' );
+ $response = rest_get_server()->dispatch( $request );
+ $data = $response->get_data();
+
+ $this->assertSame( 200, $response->get_status() );
+ $user_names = array_column( $data['users'], 'name' );
+ $this->assertContains( 'TargetAdminUser', $user_names );
+ $this->assertNotContains( 'BatchUser1', $user_names );
+ }
+}
diff --git a/tests/Integration/Includes/REST/Settings_IO_ControllerTest.php b/tests/Integration/Includes/REST/Settings_IO_ControllerTest.php
index 5ee2cef62..0d7184ce2 100644
--- a/tests/Integration/Includes/REST/Settings_IO_ControllerTest.php
+++ b/tests/Integration/Includes/REST/Settings_IO_ControllerTest.php
@@ -699,4 +699,3 @@ public function test_import_of_exported_default_setting_restores_default_state()
$this->assertFalse( (bool) get_option( 'wpai_features_enabled' ) );
}
}
-
diff --git a/tests/Integration/Includes/Settings/Settings_RegistrationTest.php b/tests/Integration/Includes/Settings/Settings_RegistrationTest.php
index 20244222e..1e0a74c9a 100644
--- a/tests/Integration/Includes/Settings/Settings_RegistrationTest.php
+++ b/tests/Integration/Includes/Settings/Settings_RegistrationTest.php
@@ -54,7 +54,11 @@ public function tearDown(): void {
unregister_setting( Settings_Registration::OPTION_GROUP, Settings_Registration::GLOBAL_OPTION );
unregister_setting( Settings_Registration::OPTION_GROUP, 'wpai_feature_settings-registration-test_enabled' );
unregister_setting( Settings_Registration::OPTION_GROUP, 'wpai_feature_settings-registration-test_field_developer' );
+ unregister_setting( Settings_Registration::OPTION_GROUP, 'wpai_feature_settings-registration-test_roles' );
+ unregister_setting( Settings_Registration::OPTION_GROUP, 'wpai_feature_settings-registration-test_users' );
delete_option( 'wpai_feature_settings-registration-test_field_developer' );
+ delete_option( 'wpai_feature_settings-registration-test_roles' );
+ delete_option( 'wpai_feature_settings-registration-test_users' );
parent::tearDown();
}
@@ -83,6 +87,32 @@ public function test_register_settings_registers_developer_model_setting(): void
);
}
+ /**
+ * Test that register_settings() registers roles and users settings.
+ *
+ * @since x.x.x
+ */
+ public function test_register_settings_registers_roles_and_users_settings(): void {
+ global $wp_registered_settings;
+
+ $registry = new Registry();
+ $registry->register_feature( new Settings_Registration_Test_Feature() );
+
+ $registration = new Settings_Registration( $registry );
+ $registration->register_settings();
+
+ $roles_setting = 'wpai_feature_settings-registration-test_roles';
+ $users_setting = 'wpai_feature_settings-registration-test_users';
+
+ $this->assertArrayHasKey( $roles_setting, $wp_registered_settings );
+ $this->assertSame( 'array', $wp_registered_settings[ $roles_setting ]['type'] );
+ $this->assertSame( array(), $wp_registered_settings[ $roles_setting ]['default'] );
+
+ $this->assertArrayHasKey( $users_setting, $wp_registered_settings );
+ $this->assertSame( 'array', $wp_registered_settings[ $users_setting ]['type'] );
+ $this->assertSame( array(), $wp_registered_settings[ $users_setting ]['default'] );
+ }
+
/**
* Test that init() registers the provider discovery REST route hook.
*
diff --git a/tests/e2e/specs/admin/settings.spec.js b/tests/e2e/specs/admin/settings.spec.js
index 00a33ce63..e0d7c6988 100644
--- a/tests/e2e/specs/admin/settings.spec.js
+++ b/tests/e2e/specs/admin/settings.spec.js
@@ -1,7 +1,11 @@
/**
* WordPress dependencies
*/
-const { test, expect } = require( '@wordpress/e2e-test-utils-playwright' );
+const {
+ test,
+ expect,
+ RequestUtils: WPRequestUtils,
+} = require( '@wordpress/e2e-test-utils-playwright' );
/**
* Internal dependencies
@@ -24,6 +28,9 @@ const {
disableAdvancedSettings,
enableModelSelection,
disableModelSelection,
+ enableAccessControls,
+ disableAccessControls,
+ clearFeatureAccessSettings,
} = require( '../../utils/helpers' );
const EXPERIMENT_GROUPS = {
@@ -746,4 +753,504 @@ test.describe( 'Plugin settings', () => {
await disableModelSelection( page );
await disableExperiment( admin, page, 'Image Generation and Editing' );
} );
+
+ test( 'Access controls: Editor role is blocked then granted access to Content Summarization', async ( {
+ admin,
+ editor,
+ page,
+ requestUtils,
+ } ) => {
+ await requestUtils.activatePlugin( 'e2e-testing' );
+ await seedCredentials( requestUtils );
+
+ // Create an editor-role user to use throughout this test.
+ const editorUsername = `ai-editor-${ Date.now() }`;
+ const editorPassword = 'password';
+
+ const createdEditorUser = await requestUtils.createUser( {
+ username: editorUsername,
+ email: `${ editorUsername }@example.com`,
+ password: editorPassword,
+ roles: [ 'editor' ],
+ } );
+
+ // Enable AI + Content Summarization.
+ await enableExperiments( admin, page );
+ await enableExperiment( admin, page, 'Content Summarization' );
+
+ // Enable Access Controls via Developer Tools.
+ await visitSettingsPage( admin );
+ await enableAccessControls( page );
+
+ // Scope to the Content Summarization section so we don't accidentally
+ // target another feature's (e.g. Editorial Notes) access-control row.
+ const contentSummarizationSection = page
+ .locator( '.dataforms-layouts-regular__field', {
+ has: page.getByText( 'Content Summarization', { exact: true } ),
+ } )
+ .first();
+ await expect( contentSummarizationSection ).toBeVisible( {
+ timeout: 10000,
+ } );
+
+ const contentSummarizationAccessForm =
+ contentSummarizationSection.locator(
+ '.ai-access-control-mode-fields.ai-feature-settings-form'
+ );
+
+ // The Editor checkbox must NOT be checked at the start of this test.
+ // A previous run may have left it checked, so uncheck it if needed.
+ const editorCheckboxInitial = contentSummarizationAccessForm.getByRole(
+ 'checkbox',
+ { name: 'Editor' }
+ );
+ await expect( editorCheckboxInitial ).toBeVisible( { timeout: 10000 } );
+ if ( await editorCheckboxInitial.isChecked() ) {
+ await editorCheckboxInitial.uncheck();
+ // Save the unchecked state before proceeding.
+ const resetSaveButton = contentSummarizationAccessForm.getByRole(
+ 'button',
+ { name: 'Save' }
+ );
+ await expect( resetSaveButton ).toBeVisible( { timeout: 10000 } );
+ await resetSaveButton.click();
+ await expect( resetSaveButton ).not.toBeVisible( {
+ timeout: 10000,
+ } );
+ }
+ await expect( editorCheckboxInitial ).not.toBeChecked();
+
+ // Create a post.
+ await admin.createNewPost( {
+ postType: 'post',
+ title: 'Access Control Test Post',
+ content:
+ 'This is test content for the access control test. It needs to have enough characters to meet the minimum content length requirement for summarization to be enabled. The summarization feature requires a substantial amount of text before it will allow the user to generate a summary of the post content. Adding more text here.',
+ } );
+ await editor.saveDraft();
+
+ // Get the post URL.
+ const postUrl = page.url();
+
+ // Switch to editor session and verify button is NOT visible.
+ const editorRequestUtils = await WPRequestUtils.setup( {
+ user: { username: editorUsername, password: editorPassword },
+ } );
+ await editorRequestUtils.login();
+ await page
+ .context()
+ .addCookies(
+ ( await editorRequestUtils.request.storageState() ).cookies
+ );
+ await editorRequestUtils.request.dispose();
+
+ // Navigate to the post as the editor user.
+ await page.goto( postUrl );
+
+ // If the post-locked modal appears (another session still holds the lock),
+ // click "Take over" so the editor can access the post.
+ const takeOverLink = page.getByRole( 'link', { name: 'Take over' } );
+ if ( await takeOverLink.isVisible() ) {
+ await takeOverLink.click();
+ }
+
+ // Open the document sidebar.
+ const openSidebarButton = page.getByRole( 'button', {
+ name: 'Settings',
+ exact: true,
+ } );
+ if ( await openSidebarButton.isVisible() ) {
+ await openSidebarButton.click();
+ }
+
+ // The Generate Summary button must NOT be visible for the editor.
+ const generateSummaryButton = page.getByRole( 'button', {
+ name: 'Generate Summary',
+ exact: true,
+ } );
+ await expect( generateSummaryButton ).not.toBeVisible();
+
+ // Switch back to admin and grant the Editor role access.
+ const adminRequestUtils = await WPRequestUtils.setup( {
+ user: { username: 'admin', password: 'password' },
+ } );
+ await adminRequestUtils.login();
+ await page
+ .context()
+ .addCookies(
+ ( await adminRequestUtils.request.storageState() ).cookies
+ );
+ await adminRequestUtils.request.dispose();
+
+ // Navigate to the settings page as admin.
+ await visitSettingsPage( admin );
+
+ // Re-scope to Content Summarization's access-control form after page reload.
+ const contentSummarizationSectionAgain = page
+ .locator( '.dataforms-layouts-regular__field', {
+ has: page.getByText( 'Content Summarization', { exact: true } ),
+ } )
+ .first();
+ await expect( contentSummarizationSectionAgain ).toBeVisible( {
+ timeout: 10000,
+ } );
+
+ const contentSummarizationAccessFormAgain =
+ contentSummarizationSectionAgain.locator(
+ '.ai-access-control-mode-fields.ai-feature-settings-form'
+ );
+
+ // Check the Editor checkbox to grant access.
+ const editorCheckboxAgain =
+ contentSummarizationAccessFormAgain.getByRole( 'checkbox', {
+ name: 'Editor',
+ } );
+ await expect( editorCheckboxAgain ).toBeVisible( { timeout: 10000 } );
+ await editorCheckboxAgain.check();
+ await expect( editorCheckboxAgain ).toBeChecked();
+
+ // The access control form requires an explicit Save button click.
+ const saveButton = contentSummarizationAccessFormAgain.getByRole(
+ 'button',
+ { name: 'Save' }
+ );
+ await expect( saveButton ).toBeVisible( { timeout: 10000 } );
+ await saveButton.click();
+
+ // Wait for the success snackbar notice and for the Save button to disappear.
+ await expect(
+ page.getByTestId( 'snackbar' ).filter( {
+ hasText: 'Access control settings saved.',
+ } )
+ ).toBeVisible();
+ await expect( saveButton ).not.toBeVisible( { timeout: 10000 } );
+
+ const editorRequestUtils2 = await WPRequestUtils.setup( {
+ user: { username: editorUsername, password: editorPassword },
+ } );
+ await editorRequestUtils2.login();
+ await page
+ .context()
+ .addCookies(
+ ( await editorRequestUtils2.request.storageState() ).cookies
+ );
+ await editorRequestUtils2.request.dispose();
+
+ // Navigate back to the post as the editor user.
+ await page.goto( postUrl );
+
+ // Dismiss post-locked modal if present.
+ if ( await takeOverLink.isVisible() ) {
+ await takeOverLink.click();
+ }
+
+ // Open the document sidebar.
+ if ( await openSidebarButton.isVisible() ) {
+ await openSidebarButton.click();
+ }
+
+ // Dismiss the "Welcome to the editor" guide modal if it appears.
+ const welcomeModal = page.getByRole( 'dialog', {
+ name: 'Welcome to the editor',
+ } );
+ if ( await welcomeModal.isVisible() ) {
+ await page.keyboard.press( 'Escape' );
+ }
+
+ // The Generate Summary button must now be visible for the editor.
+ await expect(
+ page.getByRole( 'button', {
+ name: 'Generate Summary',
+ exact: true,
+ } )
+ ).toBeVisible( { timeout: 10000 } );
+
+ // Restore admin session.
+ const adminRequestUtils2 = await WPRequestUtils.setup( {
+ user: { username: 'admin', password: 'password' },
+ } );
+ await adminRequestUtils2.login();
+ await page
+ .context()
+ .addCookies(
+ ( await adminRequestUtils2.request.storageState() ).cookies
+ );
+ await adminRequestUtils2.request.dispose();
+
+ // Disable Access Controls.
+ await visitSettingsPage( admin );
+ // Clear the stored roles/users before disabling the UI so that stale
+ // access control options do not block the admin in subsequent tests.
+ await clearFeatureAccessSettings( requestUtils, 'summarization' );
+ await disableAccessControls( page );
+
+ // Disable the Content Summarization experiment.
+ await disableExperiment( admin, page, 'Content Summarization' );
+
+ // Delete the test user.
+ await requestUtils.rest( {
+ method: 'DELETE',
+ path: `/wp/v2/users/${ createdEditorUser.id }`,
+ params: { force: true, reassign: 1 },
+ } );
+ } );
+
+ test( 'Access controls: specific user is blocked then granted access to Content Summarization via Users field', async ( {
+ admin,
+ editor,
+ page,
+ requestUtils,
+ } ) => {
+ await requestUtils.activatePlugin( 'e2e-testing' );
+ await seedCredentials( requestUtils );
+
+ // Create a user with the editor role to use throughout this test.
+ const editorUsername = `ai-editor-${ Date.now() }`;
+ const editorPassword = 'password';
+
+ const createdEditorUser = await requestUtils.createUser( {
+ username: editorUsername,
+ email: `${ editorUsername }@example.com`,
+ password: editorPassword,
+ roles: [ 'editor' ],
+ } );
+
+ // Enable AI + Content Summarization.
+ await enableExperiments( admin, page );
+ await enableExperiment( admin, page, 'Content Summarization' );
+
+ // Enable Access Controls via Developer Tools.
+ await visitSettingsPage( admin );
+ await enableAccessControls( page );
+
+ // Scope to the Content Summarization section.
+ const contentSummarizationSection = page
+ .locator( '.dataforms-layouts-regular__field', {
+ has: page.getByText( 'Content Summarization', { exact: true } ),
+ } )
+ .first();
+ await expect( contentSummarizationSection ).toBeVisible( {
+ timeout: 10000,
+ } );
+
+ const contentSummarizationAccessForm =
+ contentSummarizationSection.locator(
+ '.ai-access-control-mode-fields.ai-feature-settings-form'
+ );
+
+ // Ensure ALL role checkboxes are unchecked so access is driven only by
+ // the Users token field (not by role membership).
+ const roleCheckboxes = contentSummarizationAccessForm.locator(
+ '.components-checkbox-control__input'
+ );
+ const roleCount = await roleCheckboxes.count();
+ for ( let i = 0; i < roleCount; i++ ) {
+ const checkbox = roleCheckboxes.nth( i );
+ if ( await checkbox.isChecked() ) {
+ await checkbox.uncheck();
+ }
+ }
+
+ // If any role was unchecked, a Save button will appear — click it.
+ const roleSaveButton = contentSummarizationAccessForm.getByRole(
+ 'button',
+ { name: 'Save' }
+ );
+ if ( await roleSaveButton.isVisible() ) {
+ await roleSaveButton.click();
+ await expect( roleSaveButton ).not.toBeVisible( {
+ timeout: 10000,
+ } );
+ }
+
+ // Create a post as admin so the editor can open it.
+ await admin.createNewPost( {
+ postType: 'post',
+ title: 'User Access Control Test Post',
+ content:
+ 'This is test content for the user access control test. It needs to have enough characters to meet the minimum content length requirement for summarization to be enabled. The summarization feature requires a substantial amount of text before it will allow the user to generate a summary of the post content. Adding more text here.',
+ } );
+ await editor.saveDraft();
+
+ // Get the post URL.
+ const postUrl = page.url();
+
+ // Switch to editor session and verify button is NOT visible.
+ const editorRequestUtils = await WPRequestUtils.setup( {
+ user: { username: editorUsername, password: editorPassword },
+ } );
+ await editorRequestUtils.login();
+ await page
+ .context()
+ .addCookies(
+ ( await editorRequestUtils.request.storageState() ).cookies
+ );
+ await editorRequestUtils.request.dispose();
+
+ // Navigate to the post as the editor user.
+ await page.goto( postUrl );
+
+ // If the post-locked modal appears, take over.
+ const takeOverLink = page.getByRole( 'link', { name: 'Take over' } );
+ if ( await takeOverLink.isVisible() ) {
+ await takeOverLink.click();
+ }
+
+ // Open the document sidebar.
+ const openSidebarButton = page.getByRole( 'button', {
+ name: 'Settings',
+ exact: true,
+ } );
+ if ( await openSidebarButton.isVisible() ) {
+ await openSidebarButton.click();
+ }
+
+ // The Generate Summary button must NOT be visible — no role or user access.
+ await expect(
+ page.getByRole( 'button', {
+ name: 'Generate Summary',
+ exact: true,
+ } )
+ ).not.toBeVisible();
+
+ // Switch back to admin and grant access via the Users token field.
+ const adminRequestUtils = await WPRequestUtils.setup( {
+ user: { username: 'admin', password: 'password' },
+ } );
+ await adminRequestUtils.login();
+ await page
+ .context()
+ .addCookies(
+ ( await adminRequestUtils.request.storageState() ).cookies
+ );
+ await adminRequestUtils.request.dispose();
+
+ await visitSettingsPage( admin );
+
+ // Re-scope to Content Summarization after page reload.
+ const contentSummarizationSectionAgain = page
+ .locator( '.dataforms-layouts-regular__field', {
+ has: page.getByText( 'Content Summarization', { exact: true } ),
+ } )
+ .first();
+ await expect( contentSummarizationSectionAgain ).toBeVisible( {
+ timeout: 10000,
+ } );
+
+ const contentSummarizationAccessFormAgain =
+ contentSummarizationSectionAgain.locator(
+ '.ai-access-control-mode-fields.ai-feature-settings-form'
+ );
+
+ // Type the editor's username into the Users token field and select it.
+ const usersTokenInput = contentSummarizationAccessFormAgain.getByRole(
+ 'combobox',
+ { name: 'Users' }
+ );
+ await expect( usersTokenInput ).toBeVisible( { timeout: 10000 } );
+ await usersTokenInput.click();
+ await usersTokenInput.fill( editorUsername );
+
+ // Wait for and select the matching suggestion.
+ const suggestion = page.locator(
+ '.components-form-token-field__suggestion',
+ { hasText: editorUsername }
+ );
+ await expect( suggestion ).toBeVisible( { timeout: 10000 } );
+ await suggestion.click();
+
+ // Wait for the token chip to appear in the field, confirming the
+ // selection was registered before proceeding to Save.
+ const addedToken = contentSummarizationAccessFormAgain.locator(
+ '.components-form-token-field__token-text',
+ { hasText: editorUsername }
+ );
+ await expect( addedToken ).toBeVisible( { timeout: 10000 } );
+ await usersTokenInput.evaluate( ( el ) => el.blur() );
+
+ // Save the user access settings.
+ const userSaveButton = contentSummarizationAccessFormAgain.getByRole(
+ 'button',
+ { name: 'Save' }
+ );
+ await expect( userSaveButton ).toBeVisible( { timeout: 10000 } );
+ await userSaveButton.click();
+
+ // Wait for the success snackbar notice and for the Save button to disappear.
+ await expect(
+ page.getByTestId( 'snackbar' ).filter( {
+ hasText: 'Access control settings saved.',
+ } )
+ ).toBeVisible();
+
+ // Switch back to editor session and verify button IS now visible.
+ const editorRequestUtils2 = await WPRequestUtils.setup( {
+ user: { username: editorUsername, password: editorPassword },
+ } );
+ await editorRequestUtils2.login();
+ await page
+ .context()
+ .addCookies(
+ ( await editorRequestUtils2.request.storageState() ).cookies
+ );
+ await editorRequestUtils2.request.dispose();
+
+ // Navigate back to the post as the editor user.
+ await page.goto( postUrl );
+
+ // Dismiss post-locked modal if present.
+ if ( await takeOverLink.isVisible() ) {
+ await takeOverLink.click();
+ }
+
+ // Open the document sidebar.
+ if ( await openSidebarButton.isVisible() ) {
+ await openSidebarButton.click();
+ }
+
+ // Dismiss the "Welcome to the editor" guide modal if it appears.
+ const welcomeModal = page.getByRole( 'dialog', {
+ name: 'Welcome to the editor',
+ } );
+ if ( await welcomeModal.isVisible() ) {
+ await page.keyboard.press( 'Escape' );
+ }
+
+ // The Generate Summary button must now be visible for the editor.
+ await expect(
+ page.getByRole( 'button', {
+ name: 'Generate Summary',
+ exact: true,
+ } )
+ ).toBeVisible( { timeout: 10000 } );
+
+ // Restore admin session.
+ const adminRequestUtils2 = await WPRequestUtils.setup( {
+ user: { username: 'admin', password: 'password' },
+ } );
+ await adminRequestUtils2.login();
+ await page
+ .context()
+ .addCookies(
+ ( await adminRequestUtils2.request.storageState() ).cookies
+ );
+ await adminRequestUtils2.request.dispose();
+
+ // Disable Access Controls.
+ await visitSettingsPage( admin );
+ // Clear the stored roles/users before disabling the UI so that stale
+ // access control options do not block the admin in subsequent tests.
+ await clearFeatureAccessSettings( requestUtils, 'summarization' );
+ await disableAccessControls( page );
+
+ // Disable the Content Summarization experiment.
+ await disableExperiment( admin, page, 'Content Summarization' );
+
+ // Delete the test user.
+ await requestUtils.rest( {
+ method: 'DELETE',
+ path: `/wp/v2/users/${ createdEditorUser.id }`,
+ params: { force: true, reassign: 1 },
+ } );
+ } );
} );
diff --git a/tests/e2e/specs/experiments/bulk-content-summarization.spec.js b/tests/e2e/specs/experiments/bulk-content-summarization.spec.js
index 4678aa17f..9bc995a89 100644
--- a/tests/e2e/specs/experiments/bulk-content-summarization.spec.js
+++ b/tests/e2e/specs/experiments/bulk-content-summarization.spec.js
@@ -8,6 +8,7 @@ const { test, expect } = require( '@wordpress/e2e-test-utils-playwright' );
*/
const {
clearCredentials,
+ clearFeatureAccessSettings,
disableExperiment,
enableExperiment,
enableExperiments,
@@ -24,6 +25,13 @@ const LONG_CONTENT =
'Summaries are generated sequentially using the configured AI provider and stored as post meta.';
test.describe( 'Bulk Content Summarization', () => {
+ test.beforeAll( async ( { requestUtils } ) => {
+ // Clear any stale access control settings left by previous tests.
+ // Without this, the admin user can be blocked by role/user restrictions
+ // saved in a prior run of the access control tests in settings.spec.js.
+ await clearFeatureAccessSettings( requestUtils, 'summarization' );
+ } );
+
test( 'Bulk action appears in the posts list', async ( {
admin,
requestUtils,
diff --git a/tests/e2e/specs/experiments/content-summarization.spec.js b/tests/e2e/specs/experiments/content-summarization.spec.js
index 27e118fc3..8a5971352 100644
--- a/tests/e2e/specs/experiments/content-summarization.spec.js
+++ b/tests/e2e/specs/experiments/content-summarization.spec.js
@@ -11,9 +11,16 @@ const {
disableExperiments,
enableExperiment,
enableExperiments,
+ clearFeatureAccessSettings,
} = require( '../../utils/helpers' );
test.describe( 'Content Summarization Experiment', () => {
+ test.beforeAll( async ( { requestUtils } ) => {
+ // Clear any stale access control settings left by previous tests.
+ // Without this, the admin user can be blocked by role/user restrictions
+ // saved in a prior run of the access control tests in settings.spec.js.
+ await clearFeatureAccessSettings( requestUtils, 'summarization' );
+ } );
test( 'Can enable the content summarization experiment', async ( {
admin,
page,
diff --git a/tests/e2e/utils/helpers.ts b/tests/e2e/utils/helpers.ts
index 43899193f..c17497031 100644
--- a/tests/e2e/utils/helpers.ts
+++ b/tests/e2e/utils/helpers.ts
@@ -448,6 +448,35 @@ export const clearCredentials = async ( requestUtils: RequestUtils ) => {
} );
};
+/**
+ * Clears the access control settings (roles and users) for a specific feature.
+ *
+ * Resets `wpai_feature_{featureId}_roles` and `wpai_feature_{featureId}_users`
+ * back to empty arrays via the WordPress REST settings endpoint. This prevents
+ * stale access control options from leaking between tests and inadvertently
+ * blocking the admin user from accessing features like Content Summarization.
+ *
+ * @param requestUtils The requestUtils fixture from the test context.
+ * @param featureId The feature ID, e.g. 'summarization'.
+ */
+export const clearFeatureAccessSettings = async (
+ requestUtils: RequestUtils,
+ featureId: string
+) => {
+ await requestUtils.rest( {
+ path: '/wp/v2/settings',
+ method: 'POST',
+ data: {
+ [ `wpai_feature_${ featureId }_roles` ]: [
+ 'administrator',
+ 'editor',
+ 'author',
+ ],
+ [ `wpai_feature_${ featureId }_users` ]: [],
+ },
+ } );
+};
+
/**
* Enables the Model Selection feature via the Developer Tools menu.
*
@@ -590,3 +619,64 @@ export const disableAdvancedSettings = async ( page: Page ) => {
// Close the menu.
await page.keyboard.press( 'Escape' );
};
+
+/**
+ * Enables the Access Controls feature via the Developer Tools menu.
+ *
+ * Opens the Developer Tools menu, checks whether Access Controls is already
+ * enabled, and clicks it only when it is not. Closes the menu afterwards.
+ *
+ * @param page The page object.
+ */
+export const enableAccessControls = async ( page: Page ) => {
+ await page.getByRole( 'button', { name: 'Developer Tools' } ).click();
+
+ await expect( page.getByText( 'DEVELOPER TOOLS' ) ).toBeVisible();
+
+ const accessControls = page.getByRole( 'menuitemcheckbox', {
+ name: /Access controls/,
+ } );
+
+ await expect( accessControls ).toBeVisible();
+
+ if ( ( await accessControls.getAttribute( 'aria-checked' ) ) !== 'true' ) {
+ await accessControls.click();
+
+ // Verify the menu remains open after toggling the option.
+ await expect(
+ page.getByRole( 'menuitemcheckbox', { name: /Access controls/ } )
+ ).toBeVisible();
+ }
+
+ // Close the menu.
+ await page.keyboard.press( 'Escape' );
+};
+
+/**
+ * Disables the Access Controls feature via the Developer Tools menu.
+ *
+ * Opens the Developer Tools menu and clicks the Access Controls item to
+ * toggle it off, then closes the menu.
+ *
+ * @param page The page object.
+ */
+export const disableAccessControls = async ( page: Page ) => {
+ await page.getByRole( 'button', { name: 'Developer Tools' } ).click();
+
+ const accessControls = page.getByRole( 'menuitemcheckbox', {
+ name: /Access controls/,
+ } );
+
+ // Only click if it is currently enabled.
+ if ( ( await accessControls.getAttribute( 'aria-checked' ) ) === 'true' ) {
+ await accessControls.click();
+
+ // Verify the menu remains open after toggling the option.
+ await expect(
+ page.getByRole( 'menuitemcheckbox', { name: /Access controls/ } )
+ ).toBeVisible();
+ }
+
+ // Close the menu.
+ await page.keyboard.press( 'Escape' );
+};