View-only dashboard logs permission errors on every load for data the user can't access

[shervElmi]

Bug Description

When a user opens the view-only Site Kit dashboard, the page asks for data that the user's role can't read. The server answers each of these requests with a 403 error. The browser console then logs a Google Site Kit API Error line for each one. The page still renders, and nothing on it looks broken. The errors come back on every load.

On the main view-only dashboard, three requests fail on each load. core/site/data/email-reporting-errors fails every time. modules/adsense/data/notifications fails whenever the site has AdSense connected. When the user's role can see Analytics, core/user/data/initial-setup-settings fails too. When the role can't see Analytics, modules/analytics-4/data/site-goals-settings fails in its place. The view-only dashboard for a single post also logs the email-reporting-errors error.

The view-only dashboard should ask only for data the user's role can read, so none of these errors appear.

The requests come from dashboard code that runs for every user and reads the data before it checks whether the user may read it. That code sits in four places. They're the error notice in the Email reports panel, the AdSense notifications, the check for the visitor groups setup, and Site Goals.

Steps to reproduce

1. Set up Site Kit with Analytics, Search Console and AdSense connected.
2. In Users > Add New, create a user with the Editor role.
3. On the Site Kit dashboard, click the Open sharing settings icon in the header.
4. In Dashboard sharing & permissions, give the Editor role view access to Analytics and Search Console.
5. Click Apply.
6. Sign in as the Editor user.
7. Open the Site Kit dashboard with the browser's DevTools Console tab open.
8. The console shows three Google Site Kit API Error lines, for email-reporting-errors, initial-setup-settings and notifications. Each says Sorry, you are not allowed to do that. The console should show none of them.
9. As the administrator, open Dashboard sharing & permissions again and remove the Editor role's view access to Analytics.
10. Click Apply.
11. Reload the dashboard as the Editor user.
12. The console shows a Google Site Kit API Error line for site-goals-settings, next to the lines for email-reporting-errors and notifications. It should show none of them.

Additional Context

• Plugin Version: "1.188.0".

---

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

• When an Editor opens the view-only Site Kit dashboard, the page makes no request to these endpoints, whether or not the role can see Analytics:
  • core/site/data/email-reporting-errors
  • core/user/data/initial-setup-settings
  • modules/adsense/data/notifications
• When the Editor role can't see Analytics, the view-only dashboard makes no request to modules/analytics-4/data/site-goals-settings.
• On the view-only dashboard for a single post, the page makes no request to core/site/data/email-reporting-errors.
• On these view-only dashboards, the browser console shows no Google Site Kit API Error line for email-reporting-errors, initial-setup-settings, notifications or site-goals-settings.
• When the Editor role can see Analytics, the view-only dashboard still shows the same Site Goals widgets that an administrator sees.
• For an administrator on the main Site Kit dashboard, these keep working as they do today:
  • The Email reports panel shows its error notice when the last batch of email reports failed to send.
  • When the site has AdSense connected, AdSense notifications sent by the server appear on the dashboard.
  • After Analytics setup, when visitor groups aren't set up yet, the main dashboard sets them up on its own. It shows loading tiles while it runs.

Implementation Brief

Test Coverage

QA Brief

Changelog entry