[wp-trac] [WordPress Trac] #39544: REST API: Improve users endpoint in multisite

[WordPress Trac]

#39544: REST API: Improve users endpoint in multisite
----------------------------+-----------------------------
 Reporter:  flixos90        |       Owner:
     Type:  task (blessed)  |      Status:  new
 Priority:  normal          |   Milestone:  Future Release
Component:  REST API        |     Version:
 Severity:  normal          |  Resolution:
 Keywords:                  |     Focuses:  multisite
----------------------------+-----------------------------

Comment (by jeremyfelt):

 We had a good
 [https://wordpress.slack.com/archives/C03BVB47S/p1493136608179107
 conversation in Slack] last week about this.

 Some thoughts/assertions from that discussion:

 Replying to [comment:5 flixos90]:
 > Should `POST/PUT/PATCH wp/v2/users/<id>` only allow changes of roles and
 `POST/PUT/PATCH wp/v2/users/<id>?global=true` only allow changes of
 everything but roles?

 As [comment:7 @jnylen0 mentioned], we should handle this via capabilities.

 Here's what seemed right to me at first glance:

 * `POST/PUT/PATCH wp/v2/users/<id>` updates data in the site context for a
 user depending on capabilities.
 * `POST/PUT/PATCH wp/v2/users/<id>?global=true` updates data in the site
 and global contexts for a user depending on capabilities.

 However, the only current data that lives in a site context is a user's
 role(s) and a few display settings. We could just assume `global=true` for
 both calls and defer to capabilities always.

 I'm not sure what position that puts us in for the future if we somehow
 find reason to add more site context settings. Really, all the data is
 stored in the same place, so maybe it's all global?

 Replying to [comment:5 flixos90]:
 > I think it would be best if we had `POST wp/v2/users?global=true` for
 creating a global user _without_ adding them to a site, and then `POST
 wp/v2/users` to add a user to a site.

 We chatted through this a bit too and came to a conclusion that we can
 support a combo here.

 * `POST wp/v2/users` Adds an existing global user to a site.
 * `POST wp/v2/users?global=true` creates a new global user and does not
 add them to the site.
 * `POST wp/v2/users?global=true&add_to_site=true` creates a new global
 user and adds them to the site.

 The `add_to_site` (or other) parameter adds a little more complexity, but
 also allows for 1 API call to add a new user to a site rather than 2.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/39544#comment:14>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform