Comments: wp-admin ignores moderate_comments

[gwwar]

It turns out that wp-admin does not respect moderate_comments at all. https://core.trac.wordpress.org/ticket/6907#comment:4

At a high level this means that a default Author role can moderate comments on their post in wp-admin, but cannot using our rest apis.

Unless there are security concerns, I would recommend modifying the comment endpoints to match wp-admin behavior.

To summarize:

• Visibility of edit-comments.php checks edit_posts instead of moderate_comments
• Authors in wp-admin can see all comments (pending too), but they can only moderate comments on their own blog posts. The action bar is missing from other comments
  
• The API endpoints are much stricter. An author can only see approved comments, unapproved comments on their post, and cannot moderate any comments.

[gwwar]

Also probably related:
Automattic/notifications-panel#180
#10529

[gwwar]

Verified that edit-comments.php uses edit_posts instead of moderate_comments

The action links are also filtered by:

foreach ( $comment_ids as $comment_id ) { // Check the permissions on each
		if ( !current_user_can( 'edit_comment', $comment_id ) )
			continue;

[kwight]

Working on this in:

• wpcom: d7553-code (approve/moderate actions) and d7548-code (view)
• JP: REST API: Match permissions for viewing comments to those of wp-admin. jetpack#7980 (view)

[kwight]

POSTs (moderate) fixed in r163946-wpcom and Automattic/jetpack#7981 (v5.5).
GETs (view) fixed in r163950-wpcom and Automattic/jetpack#7980 (v5.5).