Media: Skip the edit root link when links are not requested.

A response limited with `_fields` carries no `_links` member unless the
request asks for `_links` or `_embedded`, because the posts controller
builds no links at all in that case. The edit root link was added outside
that check and keyed off the response field, so `_fields=id,edit_root`
came back with a `_links` member holding this one link alone, and
`_fields=id,_links` came back without it while every other link was there.

The link is now gated on the same check the parent controller uses for its
own links, and reads the edit root itself rather than the prepared field,
so asking for links no longer depends on asking for the field.

Follows WordPress/gutenberg#81803. The plugin also
treats a bare `_embed` parameter as a request for links. Core does not:
`get_fields_for_response()` drops `_embedded` from a `_fields` list that
omits it, and core's own links stay out of that response too.

See #65987.

Author: ramonjd

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -1691,17 +1691,23 @@ public function prepare_item_for_response( $item, $request ) {
 		}
 
 		/*
-		 * Let clients fetch the edit root in the same request with `_embed`,
-		 * the way `featured_media` is paired with its own link. Added here rather than in
-		 * `prepare_links()` because that method cannot see the request, and this belongs
-		 * in the `edit` context only, alongside the field itself.
+		 * Embeddable link to the edit root, like `featured_media`. Added here rather than
+		 * in `prepare_links()`, which cannot see the request, and gated like the parent
+		 * controller's own links so a `_fields` request is not handed a stray `_links`.
 		 */
-		if ( ! empty( $data['edit_root'] ) ) {
-			$response->add_link(
-				'https://api.w.org/edit-root',
-				rest_url( rest_get_route_for_post( $data['edit_root'] ) ),
-				array( 'embeddable' => true )
-			);
+		if (
+			'edit' === $request['context'] &&
+			( rest_is_field_included( '_links', $fields ) || rest_is_field_included( '_embedded', $fields ) )
+		) {
+			$edit_root_id = wp_get_edit_root_attachment_id( $post->ID );
+
+			if ( $edit_root_id !== (int) $post->ID ) {
+				$response->add_link(
+					'https://api.w.org/edit-root',
+					rest_url( rest_get_route_for_post( $edit_root_id ) ),
+					array( 'embeddable' => true )
+				);
+			}
 		}
 
 		/**

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -6485,6 +6485,69 @@ public function test_edit_root_can_be_requested_on_its_own() {
 		$this->assertSame( $attachment, $data['edit_root'] );
 	}
 
+	/**
+	 * Core leaves `_links` out of a response limited with `_fields` by not building
+	 * its own links at all, so this link must not be the one thing that puts the
+	 * member back.
+	 *
+	 * @ticket 65987
+	 * @requires function imagejpeg
+	 */
+	public function test_field_limited_request_omits_the_edit_root_link() {
+		wp_set_current_user( self::$superadmin_id );
+		$attachment = self::factory()->attachment->create_upload_object( self::$test_file );
+
+		$edited = $this->edit_image_and_get_new_id( $attachment );
+
+		$request = new WP_REST_Request( 'GET', "/wp/v2/media/{$edited}" );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id' );
+		$links = rest_do_request( $request )->get_links();
+
+		$this->assertArrayNotHasKey( 'https://api.w.org/edit-root', $links );
+	}
+
+	/**
+	 * Asking for the field is not asking for links.
+	 *
+	 * @ticket 65987
+	 * @requires function imagejpeg
+	 */
+	public function test_requesting_the_edit_root_field_without_links_omits_the_link() {
+		wp_set_current_user( self::$superadmin_id );
+		$attachment = self::factory()->attachment->create_upload_object( self::$test_file );
+
+		$edited = $this->edit_image_and_get_new_id( $attachment );
+
+		$request = new WP_REST_Request( 'GET', "/wp/v2/media/{$edited}" );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,edit_root' );
+		$links = rest_do_request( $request )->get_links();
+
+		$this->assertArrayNotHasKey( 'https://api.w.org/edit-root', $links );
+	}
+
+	/**
+	 * A request that limits the fields but asks for links gets every link, this one
+	 * included, whether or not it asked for the field.
+	 *
+	 * @ticket 65987
+	 * @requires function imagejpeg
+	 */
+	public function test_field_limited_request_keeps_the_edit_root_link_when_links_are_requested() {
+		wp_set_current_user( self::$superadmin_id );
+		$attachment = self::factory()->attachment->create_upload_object( self::$test_file );
+
+		$edited = $this->edit_image_and_get_new_id( $attachment );
+
+		$request = new WP_REST_Request( 'GET', "/wp/v2/media/{$edited}" );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,_links' );
+		$links = rest_do_request( $request )->get_links();
+
+		$this->assertArrayHasKey( 'https://api.w.org/edit-root', $links );
+	}
+
 	/**
 	 * An attachment recorded as its own edit root is a broken record, not a chain,
 	 * so it reports no edit root.