Commit abcdbf7cc3f for woocommerce
commit abcdbf7cc3f56779445e4b6dd41f562dad3206c8
Author: Ján Mikláš <neosinner@gmail.com>
Date: Thu Nov 5 16:25:19 2026 +0100
Align Blueprint import availability with user permissions (#70675)
* fix: align Blueprint import eligibility
* chore: add Blueprint changelog
* fix: lead the Blueprint import notice with the live-site rule
Administrators on live sites are the largest blocked group, so show the
Coming Soon remedy first and the permission requirement second.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NM9YXvk1aFWgz6vnqD5rqx
* test: isolate the Blueprint import-allowed REST server
Register only the Blueprint routes on a fresh server instead of re-firing
rest_api_init for each data row, and clear the global server on teardown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NM9YXuqBMeUmx5XsGG4ttc
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
diff --git a/plugins/woocommerce/changelog/wooairr-465-ai-regression-reviewtrunk-the-blueprintimport-allowed b/plugins/woocommerce/changelog/wooairr-465-ai-regression-reviewtrunk-the-blueprintimport-allowed
new file mode 100644
index 00000000000..02dd338b8d1
--- /dev/null
+++ b/plugins/woocommerce/changelog/wooairr-465-ai-regression-reviewtrunk-the-blueprintimport-allowed
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Show Blueprint imports as unavailable when the current user lacks import permission.
diff --git a/plugins/woocommerce/client/admin/client/blueprint/components/BlueprintUploadDropzone.tsx b/plugins/woocommerce/client/admin/client/blueprint/components/BlueprintUploadDropzone.tsx
index ae12ea6963f..62879c01156 100644
--- a/plugins/woocommerce/client/admin/client/blueprint/components/BlueprintUploadDropzone.tsx
+++ b/plugins/woocommerce/client/admin/client/blueprint/components/BlueprintUploadDropzone.tsx
@@ -483,7 +483,7 @@ export const BlueprintUploadDropzone = () => {
>
{ createInterpolateElement(
__(
- 'Blueprint imports are disabled by default for live sites. <br/>Enable <link>Coming Soon mode</link> or define "ALLOW_BLUEPRINT_IMPORT_IN_LIVE_MODE" as true.',
+ 'Blueprint imports are disabled by default for live sites. Enable <link>Coming Soon mode</link> or define "ALLOW_BLUEPRINT_IMPORT_IN_LIVE_MODE" as true. <br/>Imports also require site administrator permissions and, on multisite, super admin access.',
'woocommerce'
),
{
diff --git a/plugins/woocommerce/src/Admin/Features/Blueprint/RestApi.php b/plugins/woocommerce/src/Admin/Features/Blueprint/RestApi.php
index 97414cc7390..7d691714598 100644
--- a/plugins/woocommerce/src/Admin/Features/Blueprint/RestApi.php
+++ b/plugins/woocommerce/src/Admin/Features/Blueprint/RestApi.php
@@ -354,7 +354,7 @@ class RestApi {
* @return \WP_REST_Response
*/
public function get_import_allowed() {
- $can_import = $this->can_import_blueprint();
+ $can_import = true === $this->check_import_permission() && $this->can_import_blueprint();
return rest_ensure_response(
array(
diff --git a/plugins/woocommerce/tests/php/src/Admin/Features/Blueprint/RestApiTest.php b/plugins/woocommerce/tests/php/src/Admin/Features/Blueprint/RestApiTest.php
index bc499e6a0a6..5e5fb77d849 100644
--- a/plugins/woocommerce/tests/php/src/Admin/Features/Blueprint/RestApiTest.php
+++ b/plugins/woocommerce/tests/php/src/Admin/Features/Blueprint/RestApiTest.php
@@ -8,13 +8,13 @@ declare(strict_types=1);
namespace Automattic\WooCommerce\Tests\Admin\Features\Blueprint;
use Automattic\WooCommerce\Admin\Features\Blueprint\RestApi;
+use WC_Unit_Test_Case;
use WP_REST_Request;
-use WP_Test_REST_TestCase;
/**
* Unit tests for RestApi class.
*/
-class RestApiTest extends WP_Test_REST_TestCase {
+class RestApiTest extends WC_Unit_Test_Case {
/**
* @var RestApi
*/
@@ -77,6 +77,7 @@ class RestApiTest extends WP_Test_REST_TestCase {
* Clean up after each test.
*/
public function tearDown(): void {
+ $this->clear_rest_server();
parent::tearDown();
// Clean up global state.
unset( $_FILES['file'] );
@@ -89,6 +90,59 @@ class RestApiTest extends WP_Test_REST_TestCase {
remove_all_filters( 'pre_option_woocommerce_coming_soon' );
}
+ /**
+ * @testdox Should report import eligibility only for users who may import.
+ * @testWith ["administrator", true]
+ * ["shop_manager", false]
+ * @param string $role User role.
+ * @param bool $expected Whether the user may import.
+ */
+ public function test_import_allowed_respects_permissions( string $role, bool $expected ): void {
+ $user_id = $this->factory->user->create( array( 'role' => $role ) );
+ wp_set_current_user( $user_id );
+ update_option( 'woocommerce_coming_soon', 'yes' );
+ if ( is_multisite() && $expected ) {
+ grant_super_admin( $user_id );
+ }
+
+ try {
+ $server = $this->create_rest_server_with_routes( array( array( $this->rest_api, 'register_routes' ) ) );
+ $response = $server->dispatch( new WP_REST_Request( 'GET', '/wc-admin/blueprint/import-allowed' ) );
+
+ $this->assertSame( 200, $response->get_status() );
+ $this->assertSame( $expected, $response->get_data()['import_allowed'] );
+ update_option( 'woocommerce_coming_soon', 'no' );
+ $this->assertFalse( $this->rest_api->get_import_allowed()->get_data()['import_allowed'] );
+ } finally {
+ if ( is_multisite() && $expected ) {
+ revoke_super_admin( $user_id );
+ }
+ }
+ }
+
+ /**
+ * @testdox Should deny a multisite subsite administrator and allow a network super administrator.
+ * @group ms-required
+ */
+ public function test_import_allowed_requires_multisite_super_admin(): void {
+ if ( ! is_multisite() ) {
+ $this->markTestSkipped( 'Requires multisite.' );
+ }
+ update_option( 'woocommerce_coming_soon', 'yes' );
+
+ $this->assertFalse( is_super_admin( $this->user ) );
+ $this->assertWPError( $this->rest_api->check_import_permission() );
+ $this->assertFalse( $this->rest_api->get_import_allowed()->get_data()['import_allowed'] );
+
+ grant_super_admin( $this->user );
+ try {
+ $this->assertTrue( $this->rest_api->check_import_permission() );
+ $this->assertTrue( $this->rest_api->get_import_allowed()->get_data()['import_allowed'] );
+ } finally {
+ revoke_super_admin( $this->user );
+ }
+ }
+
/**
* Test that blueprint imports are disabled in live mode.
*/