Query Loop does not include private posts

[mrfoxtalbot]

Description

The Query Block does not display private posts. The public view does show all posts, including private ones, but the editor view only displays published posts:

Editor View:

Public view:

Step-by-step reproduction instructions

1. Create two posts: One public, one private
2. Edit the Homepage template in the Site Editor.
3. Add a query loop
4. Notice how the private post does not show
5. Save and visit the public view: The private post is listed there,

Screenshots, screen recording, code snippet

Additional Screenshots using the TT1 Blocks theme.

Editor view:

Public view:

Environment info

• WordPress 5.9
• Gutenberg 12.5.4

Please confirm that you have searched existing issues in the repo.

Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Yes

[ntsekouras]

Thanks for reporting this @mrfoxtalbot!

I looked into this and I couldn't find a proper solution for now. Here is what I could make out after investigating a bit

1. There is a difference how the query results are handled in WP_Query and REST API. Specifically:

Default value is ‘publish‘, but if the user is logged in, ‘private‘ is added.

By adding explicitly in the REST request in Query status: ['publish', 'private'], fixes the problem for admins and editors, but messes with the results for others who are not allowed to view private posts. That is because the initial results are fetched and they are filtered afterwards here. This can lead for example if we have two private posts(expected first in the list) and we have posts per page two as well, in the editor the REST request will be an empty array.

I couldn't find in core if and where I could adjust this behavior. I also think from my searching that it should pass from the same flow and therefore the checks that happen in front end should also apply to the REST request.

A workaround that doesn't seem right is by filtering rest_post_query but feels hacky to me..

@TimothyBJacobs , @spacedmonkey do you have any input here as you've worked with the REST API a lot?