fix: grant read_post cap for preview post to enable Block Bindings (#225)

* fix: grant read_post cap for preview post to enable Block Bindings

Since WordPress 6.5, Block Bindings sources (core/post-meta,
core/post-data) check is_post_publicly_viewable() OR
current_user_can('read_post') before returning a value. For public
previews, the post is still a draft, so anonymous users fail both
checks and all Block Bindings render empty.

Hook into map_meta_cap to grant read_post for the specific preview
post ID during the preview request. This requires no object cache
manipulation and does not affect any other posts or requests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: replace static property + method with closure for map_meta_cap

The static $preview_post_id property and grant_read_post_for_preview()
method are unnecessary — a closure with use ($post_id) keeps the post ID
scoped directly, which is simpler and equally safe.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Use `exist` to grant preview user capabilites to read metadata

Co-authored-by: Dominik Schilling <dominikschilling+git@gmail.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Dominik Schilling <dominikschilling+git@gmail.com>

Author: 3 people

public-post-preview.php

@@ -731,6 +731,23 @@ public static function set_post_to_publish( $posts ) {
 			// Set post status to publish so that it's visible.
 			$posts[0]->post_status = 'publish';
 
+			// Allow Block Bindings sources to resolve for this post.
+			add_filter(
+				'map_meta_cap',
+				static function( $caps, $cap, $user_id, $args ) use ( $post_id ) {
+					if (
+						'read_post' === $cap &&
+						isset( $args[0] ) &&
+						(int) $args[0] === $post_id
+					) {
+						return [ 'exist' ];
+					}
+					return $caps;
+				},
+				10,
+				4
+			);
+
 			// Disable comments and pings for this post.
 			add_filter( 'comments_open', '__return_false' );
 			add_filter( 'pings_open', '__return_false' );