Block Style Variations CSS not loaded for non-admins

kraftner commented 3 weeks ago

Description

The styles for block style variations are not visible in the editor for anyone without the edit_theme_options capability, so anyone but administrators.

They are loaded in the frontend but not in the backend.

Looking at the browser console one can see errors wit the REST API, but only in WP 6.6.1 without Gutenberg. With Gutenberg I don't see those errors, but the behavior and display of the blocks in the editor still has the same bug.

Step-by-step reproduction instructions

Create a user with any role that doesn't have edit_theme_options , e.g. editor.
Open a post and insert a button with a block style variation, e.g. core/button.
Apply a block style variation. You will not see the corresponding styles.
Save and open the post in the frontend and see the style.

Screenshots, screen recording, code snippet

Screenshot showing 2 button blocks in the backend, looking the same although one has the outline style applied

Screenshot showing the same post in the frontend where everything is right

a Video showing the whole flow with the difference between admin and editor

REST API errors in WP 6.6.1 without Gutenberg

Bildschirmfoto vom 2024-08-23 18-13-51

Environment info

WordPress 6.6.1
with and without Gutenberg 19.0.0
Twenty Twenty-Four theme

Please confirm that you have searched existing issues in the repo.

[X] Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

[X] Yes

aaronrobertshaw commented 2 weeks ago

Thanks for the detailed issue @kraftner 👍

I can replicate the issue.

For others looking into this issue, here's some additional context:

Until WP6.6, global styles data was only used in the site editor
Global styles data was restricted to users with edit_theme_options capabilities matching the restrictions on accessing the site editor
Features such as block style variations, and the currently underway style inheritance work, rely on being able to access data in the post editor
For the above features to work, read access to global styles data and entity records needs to be limited to those with say only edit_posts capabilities

I spent a while going in circles on how to achieve this for both the base (theme) global styles and the user-origin global styles. I'm sure others, who are more knowledgeable around the REST API and caps will have better ideas, but https://github.com/WordPress/gutenberg/pull/64797 contains some hacks that sort of make global styles data accessible for non-admin users in the post editor.

kraftner commented 2 weeks ago

@aaronrobertshaw Thanks for your work on this. I was just wondering: Since this is a major regression introduced in 6.6, do you think this will make it into 6.6.2? I at least didn't see it on https://github.com/orgs/WordPress/projects/213/views/1 but would expect it to be there since this breaks major functionality.

aaronrobertshaw commented 2 weeks ago

@kraftner It would be nice to get a fix in for 6.6.2 however it isn't clear yet what the best approach to ensuring access to global styles data in the post editor is for non-admins.

Depending on the scope of required changes it might need more time for testing and to land in a possible 6.6.3. There are some explorations evolving in the exploratory PR I linked: https://github.com/WordPress/gutenberg/pull/64797. That might be the best place to following along in the short term.

In the meantime though, I'll add this issue to the "In Progress" column of the 6.6.X board.

aaronrobertshaw commented 2 days ago

After some further discussion and exploration, a new potential fix is available in https://github.com/WordPress/gutenberg/pull/65071.

WordPress / gutenberg