Fix course structure API exposing the lesson AI generated bootstrap text

[m1r0]

Resolves SEN-28

Proposed Changes

The course structure API returns the lesson AI-generated text (the _initial_content post meta) to unauthorized users. This text is generated when using Sensei Pro to generate the course and lesson content. Note that the meta is never updated with the real lesson content, so this is not a security issue.

Testing Instructions

1. Have Sensei LMS and Sensei Pro.
2. Generate a course using the AI feature.
3. Run curl https://sensei.test/wp-json/sensei-internal/v1/course-structure/[COURSE POST ID]?context=view
4. Make sure the initialContent from the response is empty.

Pre-Merge Checklist

• PR title and description contain sufficient detail and accurately describe the changes
• Adheres to coding standards (PHP, JavaScript, CSS, HTML)
• All strings are translatable (without concatenation, handles plurals)
• Follows our naming conventions (P6rkRX-4oA-p2)
• Hooks (p6rkRX-1uS-p2) and functions are documented
• New UIs are responsive and use a mobile-first approach
• Code is tested on the minimum supported PHP and WordPress versions

[Copilot]

Pull request overview

This PR fixes an issue where the course structure API was exposing lesson AI-generated bootstrap text (_initial_content post meta) to unauthorized users. The fix adds a capability check to ensure only users with edit_lesson permission can see this content.

Key Changes:

• Added capability check in prepare_lesson() to restrict initialContent visibility to authorized users
• Updated PHPCS configuration to whitelist edit_lesson and edit_lessons capabilities

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
includes/class-sensei-course-structure.php	Added current_user_can('edit_lesson') check before returning initialContent to prevent unauthorized access
phpcs.xml.dist	Whitelisted edit_lesson and edit_lessons capabilities for PHPCS validation
changelog/fix-course-structure-exposing-lesson-initial-content	Added changelog entry documenting the fix

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.