Group class picker in the page editor is empty for admins (403 from /offerings) #121

New Issue

2026-07-28T15:54:40Z

thatguygriff commented

2026-07-28 15:54:40 +00:00

Filtering group sessions from the block editor shows an empty list. The browser console shows the offerings request failing:

{
    "code": "rest_forbidden",
    "message": "Sorry, you are not allowed to do that.",
    "data": { "status": 403 }
}

Cause

The editor's group-class dropdown fetches GET /wp-json/us-scheduler/v1/offerings (assets/js/blocks.js), but that route's permission_callback requires book_lesson only. That capability is granted solely to the us_student role — administrators and instructors hold manage_offerings but never book_lesson. So anyone actually editing a page is rejected with a 403, and the JS .catch falls back to an empty array, leaving the picker blank with no visible error.

Fix

Allow the offerings listing to be read by either book_lesson or manage_offerings. The response itself should be unchanged — still active offerings only, public ones plus invite-only classes the caller has been granted, with the e-transfer email omitted.

docs/features/offerings.md also still documents this endpoint as "Public", which is stale either way.

Filtering group sessions from the block editor shows an empty list. The browser console shows the offerings request failing: ```json { "code": "rest_forbidden", "message": "Sorry, you are not allowed to do that.", "data": { "status": 403 } } ``` ## Cause The editor's group-class dropdown fetches `GET /wp-json/us-scheduler/v1/offerings` (`assets/js/blocks.js`), but that route's `permission_callback` requires `book_lesson` only. That capability is granted solely to the `us_student` role — administrators and instructors hold `manage_offerings` but never `book_lesson`. So anyone actually editing a page is rejected with a 403, and the JS `.catch` falls back to an empty array, leaving the picker blank with no visible error. ## Fix Allow the offerings listing to be read by either `book_lesson` or `manage_offerings`. The response itself should be unchanged — still active offerings only, public ones plus invite-only classes the caller has been granted, with the e-transfer email omitted. `docs/features/offerings.md` also still documents this endpoint as "Public", which is stale either way.

thatguygriff added the bug label 2026-07-28 15:54:40 +00:00

thatguygriff referenced this issue from a commit

2026-07-28 15:55:06 +00:00

Let offering managers read the offerings catalogue

thatguygriff referenced a pull request that will close this issue

2026-07-28 15:55:36 +00:00

Let offering managers read the offerings catalogue #122

thatguygriff closed this issue

2026-07-28 16:07:09 +00:00

Sign in to join this conversation.