Block Style Variations CSS not loaded for non-admins

[kraftner]

Description

The styles for block style variations are not visible in the editor for anyone without the edit_theme_options capability, so anyone but administrators.

They are loaded in the frontend but not in the backend.

Looking at the browser console one can see errors wit the REST API, but only in WP 6.6.1 without Gutenberg. With Gutenberg I don't see those errors, but the behavior and display of the blocks in the editor still has the same bug.

Step-by-step reproduction instructions

1. Create a user with any role that doesn't have edit_theme_options , e.g. editor.
2. Open a post and insert a button with a block style variation, e.g. core/button.
3. Apply a block style variation. You will not see the corresponding styles.
4. Save and open the post in the frontend and see the style.

Screenshots, screen recording, code snippet

Bildschirmaufzeichnung.vom.2024-08-23.17.49.21.webm

REST API errors in WP 6.6.1 without Gutenberg

Environment info

• WordPress 6.6.1
• with and without Gutenberg 19.0.0
• Twenty Twenty-Four theme

Please confirm that you have searched existing issues in the repo.

• Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

• Yes

[aaronrobertshaw]

Thanks for the detailed issue @kraftner 👍

I can replicate the issue.

For others looking into this issue, here's some additional context:

• Until WP6.6, global styles data was only used in the site editor
• Global styles data was restricted to users with edit_theme_options capabilities matching the restrictions on accessing the site editor
• Features such as block style variations, and the currently underway style inheritance work, rely on being able to access data in the post editor
• For the above features to work, read access to global styles data and entity records needs to be limited to those with say only edit_posts capabilities

I spent a while going in circles on how to achieve this for both the base (theme) global styles and the user-origin global styles. I'm sure others, who are more knowledgeable around the REST API and caps will have better ideas, but #64797 contains some hacks that sort of make global styles data accessible for non-admin users in the post editor.

[kraftner]

@aaronrobertshaw Thanks for your work on this. I was just wondering: Since this is a major regression introduced in 6.6, do you think this will make it into 6.6.2? I at least didn't see it on https://github.com/orgs/WordPress/projects/213/views/1 but would expect it to be there since this breaks major functionality.

[aaronrobertshaw]

@kraftner It would be nice to get a fix in for 6.6.2 however it isn't clear yet what the best approach to ensuring access to global styles data in the post editor is for non-admins.

Depending on the scope of required changes it might need more time for testing and to land in a possible 6.6.3. There are some explorations evolving in the exploratory PR I linked: #64797. That might be the best place to following along in the short term.

In the meantime though, I'll add this issue to the "In Progress" column of the 6.6.X board.

[aaronrobertshaw]

After some further discussion and exploration, a new potential fix is available in #65071.