From 3a6c45853ad5c8a981f9289ed3676039fa5b062d Mon Sep 17 00:00:00 2001
From: Yurii Pavlov <mailyurik@gmail.com>
Date: Tue, 11 Aug 2026 22:33:59 +0100
Subject: [PATCH] fix(security): accept edit_pages in REST whitelist bypass;
 remove ska/v1 from whitelist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- RestApiFilter::restApiWhitelistOnly() now bypasses the namespace whitelist
  for edit_pages holders too, not just edit_posts — needed by docs-publisher,
  which only has edit_pages (least-privilege), previously requiring an
  over-broad edit_posts grant as a workaround.
- 'ska/v1' removed from RestApiNamespaceWhitelist: nothing registers a
  public route under the addon's own namespace anymore now that
  serialize-blocks and the Stripe routes moved to the theme's SK_REST_API_NS
  (skt/v1), which is already auto-whitelisted.
- .gitignore: ignore machine-local Claude Code runtime artifacts.
---
 .gitignore                              | 13 +++++++++++++
 src/Handlers/Security/RestApiFilter.php |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index a748c3d3..db836621 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,3 +57,16 @@ vendor
 #=============================================================#
 assets/build/*
 blocks/**/build/*
+
+
+# ===================================#
+#          Claude Code               #
+# ===================================#
+# Keep shared AI instructions tracked (root CLAUDE.md, .claude/rules/, .claude/skills/);
+# ignore machine-local runtime artifacts.
+.claude/worktrees/
+.claude/plans/
+.claude/backlog/
+.claude/notes/
+.claude/settings.local.json
+CLAUDE.local.md
diff --git a/src/Handlers/Security/RestApiFilter.php b/src/Handlers/Security/RestApiFilter.php
index 8cc898e2..9869c247 100644
--- a/src/Handlers/Security/RestApiFilter.php
+++ b/src/Handlers/Security/RestApiFilter.php
@@ -41,7 +41,7 @@ public static function restApiWhitelistOnly(
         $route   = $request->get_route();
 
         // Allow access for editors and administrators only
-        if (current_user_can('edit_posts')) {
+        if (current_user_can('edit_posts') || current_user_can('edit_pages')) {
             return $result;
         }