Decode comment create responses with view context

CHANGELOG.md

@@ -49,6 +49,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Swift: Classify invalid-SSL failures from the failed handshake's `SecTrust` (`URLError.failureURLPeerTrust`), via `SecTrustCopyCertificateChain`, instead of reading the undocumented `NSErrorPeerCertificateChainKey` `userInfo` string that has no public constant. Behavior is unchanged on every platform: iOS/macOS/tvOS still surface the presented certificate as `certificateNotValidForName`, and watchOS — which exposes no peer trust — still degrades to `genericSslError`. ([#1510](https://github.com/Automattic/wordpress-rs/issues/1510))
 - `isSiteUnreachable` now returns the same answer for a refused connection — the host resolves, but nothing is listening (server down, wrong port) — on every executor. Previously it was `NonExistentSiteError` on Swift (so `isSiteUnreachable` was `true`) but the generic `HttpError` on Kotlin and reqwest (so it was `false`); a refused connection is now a `ConnectionError` everywhere, which `isSiteUnreachable` covers. `NonExistentSiteError` is reserved for a DNS-resolution failure.
 - Swift multipart form and media uploads no longer crash when a file becomes unreadable while its body is being serialized. `MultipartForm` fed a failed `InputStream.read` — a `-1` return, e.g. the file was deleted after the upload started or a mid-read I/O error on an external / file-provider / iCloud-evicted volume — straight into `Data(bytesNoCopy:count:deallocator:)`, whose negative count traps. The read failure now surfaces as a `RequestExecutionFailed` error carrying the underlying stream error instead of trapping the process.
+- **BREAKING:** The comment create endpoint now returns `CommentWithViewContext`, fixing a deserialization failure for users without `moderate_comments` (core returns them a view-context body). Callers that need edit-only fields off the create result must retrieve the comment with edit context instead.
 - Swift multipart serialization also throws `inaccessibleFile` when a field's `InputStream` fails to *open* — e.g. the backing file was deleted between the field's construction and serialization — not only when a `read` fails mid-body. A failed `open()` leaves the stream in `.error` with `hasBytesAvailable == false`, so the read loop never runs and the mid-read `-1` guard can't fire; without a post-loop `streamStatus == .error` check, serialization emitted the closing CRLF and handed back a well-formed-but-empty part. `multipart/form-data` carries no per-part length, so the server couldn't detect the truncation and a should-fail upload became a silently-wrong one. ([#1542](https://github.com/Automattic/wordpress-rs/issues/1542))
 
 ### Security

native/kotlin/api/kotlin/src/integrationTest/kotlin/CommentsEndpointTest.kt

@@ -70,7 +70,7 @@ class CommentsEndpointTest {
             requestBuilder.comments()
                 .create(CommentCreateParams(post = 1, content = "foo", status = CommentStatus.Hold))
         }.assertSuccessAndRetrieveData().data
-        assertEquals("foo", createdComment.content.raw)
+        assert(createdComment.content.rendered.contains("foo"))
         assertEquals(CommentStatus.Hold, createdComment.status)
         restoreTestServer()
     }

wp_api/src/request/endpoint/comments_endpoint.rs

@@ -8,7 +8,11 @@ enum CommentsRequest {
     List,
     #[contextual_get(url = "/comments/<comment_id>", params = &crate::comments::CommentRetrieveParams, output = crate::comments::SparseComment, filter_by = crate::comments::SparseCommentField)]
     Retrieve,
-    #[post(url = "/comments", params = &crate::comments::CommentCreateParams, output = crate::comments::CommentWithEditContext)]
+    // The output is a view-context type because core decides the create-response
+    // context by capability (`edit` only for users with `moderate_comments`,
+    // `view` otherwise) and ignores the request's `?context=`. Edit-context JSON
+    // is a superset of view-context JSON, so this parses for every role.
+    #[post(url = "/comments", params = &crate::comments::CommentCreateParams, output = crate::comments::CommentWithViewContext)]
     Create,
     #[delete(url = "/comments/<comment_id>", params = &crate::comments::CommentDeleteParams, output = crate::comments::CommentDeleteResponse)]
     Delete,

wp_api_integration_tests/tests/test_comments_mut.rs

@@ -1,7 +1,7 @@
 use macro_helper::generate_update_test;
 use wp_api::comments::{
     CommentCreateParams, CommentCreateParamsBuilder, CommentDeleteParams, CommentStatus,
-    CommentUpdateParams, CommentWithEditContext,
+    CommentUpdateParams, CommentWithEditContext, CommentWithViewContext,
 };
 use wp_api_integration_tests::prelude::*;
 use wp_cli::WpCliComment;
@@ -12,7 +12,7 @@ async fn create_comment_with_just_content() {
     test_create_comment(
         &CommentCreateParams::new(FIRST_POST_ID, "foo".to_string()),
         |created_comment, comment_from_wp_cli| {
-            assert_eq!(created_comment.content.raw, "foo");
+            assert!(created_comment.content.rendered.contains("foo"));
             assert_eq!(comment_from_wp_cli.content, "foo");
         },
     )
@@ -27,14 +27,30 @@ async fn create_comment_with_content_and_status() {
             .status(Some(CommentStatus::Hold))
             .build(),
         |created_comment, comment_from_wp_cli| {
-            assert_eq!(created_comment.content.raw, "foo");
+            assert!(created_comment.content.rendered.contains("foo"));
             assert_eq!(created_comment.status, CommentStatus::Hold);
             assert_eq!(comment_from_wp_cli.content, "foo");
         },
     )
     .await;
 }
 
+#[tokio::test]
+#[serial]
+async fn create_comment_as_subscriber() {
+    // Core returns a view-context response to users without `moderate_comments`,
+    // so the create response must parse for a subscriber as well.
+    let created_comment = api_client_as_subscriber()
+        .comments()
+        .create(&CommentCreateParams::new(FIRST_POST_ID, "foo".to_string()))
+        .await
+        .assert_response()
+        .data;
+    let created_comment_from_wp_cli = Backend::comment(&created_comment.id).await;
+    assert_eq!(created_comment_from_wp_cli.content, "foo");
+    RestoreServer::db().await;
+}
+
 #[tokio::test]
 #[serial]
 async fn delete_comment() {
@@ -211,7 +227,7 @@ generate_update_test!(
 
 async fn test_create_comment<F>(params: &CommentCreateParams, assert: F)
 where
-    F: Fn(CommentWithEditContext, WpCliComment),
+    F: Fn(CommentWithViewContext, WpCliComment),
 {
     let created_comment = api_client()
         .comments()