Description

This PR fixes an issue where authenticated user data could be cached and subsequently served to public (unauthenticated) users.

The Problem

When a logged-in user makes a GraphQL request without a nonce (e.g., via a direct URL like /graphql?query={posts(where:{status:DRAFT}){nodes{title}}}), the following sequence occurs:

1. Request starts: AppContext->viewer is set to the authenticated user (e.g., admin with ID 123)
2. Query executes: Returns data based on the admin's permissions (draft posts, private content, etc.)
3. has_authentication_errors() runs: Since no nonce was provided, WPGraphQL core calls wp_set_current_user(0)
4. Cache logic runs: Smart Cache checks is_user_logged_in() to determine if caching is enabled

At step 4, is_user_logged_in() returns false because wp_set_current_user(0) was called in step 3. However, the query results from step 2 still contain authenticated data. This caused Smart Cache to incorrectly cache the authenticated response, which could then be served to public users.

The Solution

Instead of using is_user_logged_in() (which can change mid-request), we now use AppContext->viewer to determine the user's authentication state:

• AppContext->viewer is set once at Request creation and never changes
• Even after wp_set_current_user(0) is called, AppContext->viewer still reflects the original authenticated user
• This provides a reliable, stable indicator of whether the request was made by an authenticated user

Changes

src/Cache/Query.php

• Added $request property to access AppContext->viewer
• Updated build_key() to use AppContext->viewer->ID instead of wp_get_current_user()->ID

src/Cache/Results.php

• Updated is_object_cache_enabled() to check AppContext->viewer->exists() instead of is_user_logged_in()
• Added caching of the is_object_cache_enabled result per-request to ensure consistent behavior
• Added Cache-Control: no-store header for authenticated requests to prevent network/CDN caching

src/Cache/Collection.php

• Set $this->request before calling build_key() so it can access AppContext->viewer

Test Coverage

Added comprehensive test coverage:

tests/wpunit/AuthenticatedRequestCacheTest.php - Unit tests covering:

• Cache is disabled when AppContext->viewer exists (authenticated)
• Cache is enabled for unauthenticated requests
• Draft posts do not leak from authenticated to public users
• Cache-Control: no-store header is set for authenticated requests
• Sequential requests with different auth states are handled correctly

tests/acceptance/AuthenticatedRequestCacheCest.php - Acceptance tests covering:

• Admin makes request → sees drafts → cache NOT populated
• Admin makes second request → cache STILL not populated
• Public user makes same request → no drafts visible, no cache leak
• Public requests ARE properly cached
• Authenticated users bypass existing cache entries

How to Test

1. Enable object caching in WPGraphQL Smart Cache settings
2. Create a draft post
3. Log in as admin and visit: /graphql?query={posts(where:{status:DRAFT}){nodes{title status}}}
4. Verify admin sees the draft post
5. Open an incognito window and visit the same URL
6. Verify the public user does NOT see the draft post

Related

This fix addresses a quirk in WPGraphQL core where wp_set_current_user(0) is called in after_execute() — after the query has already executed with authenticated permissions. A separate issue will be opened in WPGraphQL core to address the timing of this authentication check.