[spacedmonkey]

Trac ticket: https://core.trac.wordpress.org/ticket/40365

Summary

Removes cross-network functionality from WP_REST_Sites_Controller, so the endpoint only operates on the current network.

• Collection: the network / network_exclude query params and the network__in orderby are removed. Results are always limited to the current network, and a network param is ignored.

• Schema: network is now readonly. Sites cannot be created on, or moved to, another network; new sites always land on the current network.

• Permissions: check_network_ids() is replaced with site_in_network( WP_Site $site ). Each single-site permission check returns its own error (401/403) for a site that is not on the current network. This runs before the capability checks, so it applies to super admins too.

  Check	Error code
  get_item_permissions_check	rest_unable_read_from_network
  update_item_permissions_check	rest_unable_update_from_network
  delete_item_permissions_check	rest_unable_delete_from_network

• New filter: rest_site_in_network( bool $in_network, WP_Site $site, int $network_id ) lets the result be overridden.

• check_url_is_available() is simplified now that network_id is never supplied by the request.

• Super admin changes reverted: the $network_id parameter added to get_super_admins() and is_super_admin() is no longer needed. Both functions, and tests/phpunit/tests/user/capabilities.php, are restored to their trunk versions.

Tests

• Removed the tests for the old network params and per-network super admin checks.

• Added coverage for every CRUD route against a site on a second network:

  • the permission checks called directly
  • real requests via GET/PUT/PATCH/DELETE, including by a super admin of that network
  • include on the collection
  • create and update ignoring network

  Each case asserts the error code for its operation.

• Added tests for the filter: allowing a site on another network, blocking one on the current network, and the arguments it receives.

• Regenerated tests/qunit/fixtures/wp-api-generated.js.

Verification

• Multisite: the sites controller, site meta and user capabilities tests pass (934 tests).
• Single-site: the user capabilities tests pass (753 tests).
• phpcs: clean. PHPStan: no errors.
• The restapi group has one pre-existing, unrelated failure: Test_oEmbed_Controller::test_proxy_with_classic_embed_provider. It also fails in isolation.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props spacedmonkey.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.