fix(users): honour selected role on bulk user generation

[faisalahammad]

Summary

The Users REST endpoint was silently overwriting the admin form's selected role with a hard-coded subscriber default. Every bulk user generation run produced Subscriber-only users regardless of what the admin picked (or what role was set as the site default). This PR mirrors the fix landed in #210 for the Posts endpoint: prefer the plural roles value from the form, accept the singular role alias for REST callers, normalize arrays to comma-separated strings, and drop the schema default that was causing the override.

Fixes #216

Changes

src/FakerPress/REST/Endpoints/Users.php

Before:

// Translate REST params to module format.
if ( isset( $params['role'] ) ) {
    $params['roles'] = $params['role'];
}

'role'     => [
    'description' => __( 'User role for generated users.', 'fakerpress' ),
    'type'        => 'string',
    'default'     => 'subscriber',
],

After:

// Translate REST params to module format.
// The admin form posts `roles` (plural, the same key the module reads); the public
// REST schema also exposes a singular `role` alias. Accept whichever arrived and
// normalise to the comma-joined string the User module expects.
$roles_value = $params['roles'] ?? $params['role'] ?? null;
if ( null !== $roles_value ) {
    if ( is_array( $roles_value ) ) {
        $roles_value = implode( ',', array_map( 'sanitize_key', array_map( 'strval', $roles_value ) ) );
    }
    $params['roles'] = sanitize_text_field( (string) $roles_value );
    unset( $params['role'] );
}

'roles'    => [
    'description' => __( 'User roles to sample from. Accepts an array of slugs or a comma-separated string.', 'fakerpress' ),
    'type'        => [ 'array', 'string' ],
    'items'       => [
        'type' => 'string',
    ],
],
'role'     => [
    'description' => __( 'Deprecated singular alias for roles — accepts a single role slug.', 'fakerpress' ),
    'type'        => 'string',
],

Why: WP REST merges the default value into every request, so $params['role'] was always subscriber. The old normalization block then unconditionally copied that into $params['roles'], which is what the User module reads. Now the plural form value wins, arrays are coerced, slugs are sanitized, and the singular alias remains available for direct REST callers.

Testing

Test 1: Single role from the admin form

1. Go to FakerPress > Users.
2. Set quantity to 5 and pick only Administrator in the Roles dropdown.
3. Generate.
4. Open Users > All Users and confirm all 5 have the Administrator role.

Test 2: Multiple roles from the admin form

1. Go to FakerPress > Users.
2. Set quantity to 10 and pick Editor + Author.
3. Generate and confirm users have either Editor or Author role.

Test 3: Direct REST call with the plural roles

curl -X POST "http://example.test/wp-json/fakerpress/v1/users/generate" \
  -u "admin:password" -H "Content-Type: application/json" \
  -d '{"qty":{"min":3,"max":3},"roles":"editor"}'

Test 4: Direct REST call with the singular role alias (backwards compatible)

curl -X POST "http://example.test/wp-json/fakerpress/v1/users/generate" \
  -u "admin:password" -H "Content-Type: application/json" \
  -d '{"qty":{"min":2,"max":2},"role":"contributor"}'

Result in all four cases: generated users receive the requested role(s); no more Subscriber override.

Screen recording

FakerPress-user-role-fix.mov

[bordoni]

Thank you for this fix, @faisalahammad! 🙏 Your change is spot-on. To land it in the 0.9.2 milestone I recreated it on top of the current main (so it picks up a CI fix that was blocking the test suite) and added regression tests, a site-default-role fallback, and the changelog entry — with full credit to you via Co-authored-by in #229, which has now merged. Closing this in favour of #229. Thanks again for contributing to FakerPress!

[faisalahammad]

Thank you so much @bordoni for the update and for including me in the credit! I’m really glad to see the fix merged and appreciate all the extra work you put into it. Looking forward to contributing more to FakerPress! 😊