activitypub / includes / rest / class-remote-posts-controller.php

class-remote-posts-controller.php in ActivityPub trunk, at includes/rest/class-remote-posts-controller.php

61 lines 1.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Remote_Posts_Controller file.
4	*
5	* @package Activitypub
6	*/
7
8	namespace Activitypub\Rest;
9
10	/**
11	* Remote_Posts_Controller class.
12	*
13	* Restricts the WordPress REST route that core generates for the `ap_post` post
14	* type. The route holds remote posts cached for a specific local user, so it is
15	* limited to users who can use ActivityPub, and to their own feed.
16	*
17	* @since 9.3.0
18	*/
19	class Remote_Posts_Controller extends \WP_REST_Posts_Controller {
20	use Reader_Permission;
21
22	/**
23	* Check whether a request has read access to a single cached post.
24	*
25	* @since 9.3.0
26	*
27	* @param \WP_REST_Request $request Full details about the request.
28	* @return true\|\WP_Error True if the request has read access, WP_Error otherwise.
29	*/
30	public function get_item_permissions_check( $request ) {
31	$permission = $this->check_reader_capability();
32
33	if ( \is_wp_error( $permission ) ) {
34	return $permission;
35	}
36
37	return parent::get_item_permissions_check( $request );
38	}
39
40	/**
41	* Check whether a post can be read.
42	*
43	* This is the shared predicate: core's own `get_item_permissions_check()` calls it, and so
44	* does `WP_REST_Comments_Controller`, which serves the remote replies cached on these posts.
45	* Scoping here covers both routes; scoping only the route callbacks leaves the comment route
46	* reading the same records.
47	*
48	* @since 9.3.0
49	*
50	* @param \WP_Post $post Post object.
51	* @return bool True if the post can be read, false otherwise.
52	*/
53	public function check_read_permission( $post ) {
54	if ( ! parent::check_read_permission( $post ) ) {
55	return false;
56	}
57
58	return $this->can_read_feed_of( \get_post_meta( $post->ID, '_activitypub_user_id', false ) );
59	}
60	}
61