WP_REST_Abilities_V1_Run_Controller::coerce_input_to_schema │ private │ WP 7.1.0

Coerces raw request input to the types declared in the ability input schema.

GET and DELETE deliver every scalar as a string ("10", "true") and a list as a single comma-separated string, so without coercion an ability receives raw strings where its schema declares integers, booleans, or arrays.

Coercion never changes what validation accepts. Input is coerced only when WP_Ability::validate_input() already accepts it, and any error surfaced while sanitizing falls back to the raw input, so validate_input() stays the single authority on what is rejected.

Method of the class: WP_REST_Abilities_V1_Run_Controller{}

No Hooks.

Returns

mixed. Coerced input, or the raw input when it cannot be safely coerced.

Usage

// private - for code of main (parent) class only
$result = $this->coerce_input_to_schema( $input, $ability );

$input(mixed) (required)

Raw input extracted from the request.

$ability(WP_Ability) (required)

The ability being executed.

Changelog

WP_REST_Abilities_V1_Run_Controller::coerce_input_to_schema() WP REST Abilities V1 Run Controller::coerce input to schema code ^{WP 7.1}

private function coerce_input_to_schema( $input, WP_Ability $ability ) {
	if ( null === $input ) {
		return $input;
	}

	$schema = $ability->get_input_schema();
	if ( empty( $schema ) ) {
		return $input;
	}

	/*
	 * Only coerce input that already validates. Sanitizing invalid input can silently
	 * change which values are accepted -- `additionalProperties: false` strips unknown
	 * keys, and a non-numeric string casts to 0 -- so leaving invalid input untouched
	 * lets validate_input() reject it exactly as it does without coercion.
	 *
	 * validate_input() is asked rather than rest_validate_value_from_schema() so that the
	 * `wp_ability_validate_input` filter decides what counts as valid here as well. A filter
	 * that overrides a schema failure accepts the input, so the input is coerced; a filter
	 * that rejects otherwise valid input leaves it untouched for validate_input() to report.
	 */
	if ( is_wp_error( $ability->validate_input( $input ) ) ) {
		return $input;
	}

	$sanitized = rest_sanitize_value_from_schema( $input, $schema, 'input' );

	/*
	 * Sanitizing can still surface an error the lenient validation above did not, such as
	 * items that are unique as strings but collide once cast to integers (`uniqueItems`).
	 * The error may be returned at the top level or nested inside the returned array, so
	 * scan recursively and fall back to the raw input on any error.
	 */
	if ( $this->input_contains_error( $sanitized ) ) {
		return $input;
	}

	return $sanitized;
}