← All changes | includes/my-wordpress/window.php +31 -2 1.1.6 → 1.1.10 View file →

		@@ -91,8 +91,37 @@
91	91	*
92	92	* Mirrors the recycle-bin gate — anyone who can edit posts can
93	93	* browse posts and pages.
94	94	*
	95	+ * This is the module's one capability gate, and it is a **server-side
	96	+ * authorization** gate, not just a visibility one. It decides:
	97	+ *
	98	+ * - The non-REST post-type bridge: whether
	99	+ * `desktop-mode/v1/post-type/<slug>` routes register at all
	100	+ * (`rest-post-type.php`).
	101	+ * - The per-comment dossier route
	102	+ * `desktop-mode/v1/comment-stats/<id>` (`comment-stats.php`).
	103	+ * - The user and term dossier routes
	104	+ * `desktop-mode/v1/user-stats/<id>`,
	105	+ * `desktop-mode/v1/user-footprint/<id>` and
	106	+ * `desktop-mode/v1/term-stats/<taxonomy>/<id>` (`user-stats.php`,
	107	+ * `user-footprint.php`, `term-stats.php`), which then scope their
	108	+ * payloads to what the caller may read.
	109	+ * - Whether the WooCommerce integration's boot config ships, so the
	110	+ * client can reach the order / customer / product surfaces at all
	111	+ * — those routes still enforce their own Woo capabilities on top
	112	+ * (`integrations/woocommerce.php`).
	113	+ * - Whether preview-action scripts registered by plugins are
	114	+ * enqueued (`preview-actions.php`).
	115	+ * - Whether Station Home offers the "WP Explorer" quick action
	116	+ * (`apps/station-home/parts/snapshot.php`).
	117	+ *
	118	+ * It does **not** gate the app's own window or pinned launcher: WP
	119	+ * Explorer is an App Framework app and declares
	120	+ * `->capabilities( 'edit_posts' )` itself (`apps/my-wordpress/`).
	121	+ * Returning `true` here opens the surfaces above without opening the
	122	+ * window; to move the window too, filter the app's manifest.
	123	+ *
95	124	* @return bool
96	125	*/
97	126	function openstation_my_wordpress_user_can_use() {
98	127	$can = current_user_can( 'edit_posts' );
		@@ -97,10 +126,10 @@
97	126	function openstation_my_wordpress_user_can_use() {
98	127	$can = current_user_can( 'edit_posts' );
99	128
100	129	/**
101		- * Filter whether the current user can see the My WordPress
102		- * pinned icon and window.
	130	+ * Filter whether the current user can reach the My WordPress
	131	+ * module's surfaces — its REST routes included.
103	132	*
104	133	* @param bool $can Default: edit_posts capability.
105	134	*/
106	135	return (bool) apply_filters( 'openstation_my_wordpress_user_can_use', $can );