Full Sync :: limit to contributors and above

[mdbitz]

Reduce included users in Full Syncs to contributor and above users. This is performed by an explicit check of the {$wpdb->prefix}user_level meta which correlates to a non 0 value.

Fixes https://wp.me/p9dueE-3JV

Changes proposed in this Pull Request:

• Limit the scope of User Full Syncs to contributor and above users.

Does this pull request change what data or activity we track or use?

NO

Testing instructions:

Create several users on your site, subscribers, contributors, admins, etc
Pre applying patch

• wp shell
• $um = Automattic\Jetpack\Sync\Modules::get_module( 'full-sync' ); // get full sync module.
• $um->start( [ 'users'=>1 ] ); // initiate a full sync of users.
• $um->get_status(); // returns current status
• // Verify that the "total" for users matches # of users on the site regardless of capabilities.

Post applying patch

• wp shell
• $um = Automattic\Jetpack\Sync\Modules::get_module( 'full-sync' ); // get full sync module.
• $um->start( [ 'users'=>1 ] ); // initiate a full sync of users.
• $um->get_status(); // returns current status
• // Verify that the "total" for users matches # of users on the site with contributor or above role

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• ✅ All commits were linted before commit.
  
• ✅ Add a "[Status]" label (In Progress, Needs Team Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

The e2e test report can be found here. Please note that it can take a few minutes after the e2e tests checks are complete for the report to be available.

---

Once your PR is ready for review, check one last time that all required checks (other than "Required review") appearing at the bottom of this PR are passing or skipped.
Then, add the "[Status] Needs Team review" label and ask someone from your team review the code.
Once you’ve done so, switch to the "[Status] Needs Review" label; someone from Jetpack Crew will then review this PR and merge it to be included in the next Jetpack release.

---

Jetpack plugin:

• Next scheduled release: December 7, 2021.
• Scheduled code freeze: November 30, 2021.

[mdbitz]

Full Sync tests need overhaul:

1. WP_Test_Jetpack_Sync_Full_Immediately::test_full_sync_sends_all_users
   Failed asserting that 1 matches expected 11.

2. WP_Test_Jetpack_Sync_Full_Immediately::test_full_sync_doesnt_send_deleted_users
   Failed asserting that 1 matches expected 2.

3. WP_Test_Jetpack_Sync_Full_Immediately::test_initial_sync_doesnt_sync_subscribers
   Failed asserting that 3 matches expected 13.

[kraftbj]

Should we add a test here to confirm that a less-than-contributor is not included?

[mdbitz]

test_full_sync_sends_all_users creates a subscriber and verifies via the count that it doesn't get included.

I'm of the opinion that new tests have diminishing returns due to Full Sync being replaced with checksums.

[leogermani]

Tested with the provided instructions and it worked as expected.

It's worth noting that user_level is "semi" deprecated. Something that's (almost) not used in core anymore... but it's still there and kept up to date in the user meta table.

It's updated based on the higher level of the level_%d capabilities ( where %d goes from 0 to 10). All core roles still declare these caps and I checked that Woocommerce also does.

Other custom roles might not do it and will therefore be kept out of sync.

[mdbitz]

Yes user_level is "semi" deprecated however it still provides the most reasonable level for this limitation. We can't use "edit_post" or other single capabilities as it doesn't align fully with customizations. A non 0 level still is best way to exclude subscribers and other custom roles that don't have an "edit" / contributor role.