gutenberg / lib / experimental / guidelines / class-gutenberg-guidelines-rest-controller.php

class-gutenberg-guidelines-rest-controller.php in Gutenberg 23.4.0, at lib/experimental/guidelines/class-gutenberg-guidelines-rest-controller.php

118 lines 3.8 KB

Raw Download Zip

1	<?php
2	/**
3	* Guidelines REST API Controller.
4	*
5	* @package gutenberg
6	*/
7
8	if ( ! defined( 'ABSPATH' ) ) {
9	exit;
10	}
11
12	/**
13	* REST API controller for guideline posts.
14	*/
15	class Gutenberg_Guidelines_REST_Controller extends WP_REST_Posts_Controller {
16
17	/**
18	* Gate the guidelines collection on the post-type read capability.
19	*
20	* The default `WP_REST_Posts_Controller` allows unauthenticated reads of
21	* `publish` posts; guidelines store private data and require an
22	* authenticated user with read access.
23	*
24	* @param WP_REST_Request $request Full details about the request.
25	* @return true\|WP_Error True if the request has read access, WP_Error object otherwise.
26	*/
27	public function get_items_permissions_check( $request ) {
28	$post_type = get_post_type_object( $this->post_type );
29	if ( ! current_user_can( $post_type->cap->read ) ) {
30	return new WP_Error(
31	'rest_forbidden',
32	__( 'Sorry, you are not allowed to view guidelines.', 'gutenberg' ),
33	array( 'status' => rest_authorization_required_code() )
34	);
35	}
36
37	return parent::get_items_permissions_check( $request );
38	}
39
40	/**
41	* Scope collection queries to rows readable by the current user.
42	*
43	* The parent controller filters unreadable posts after the query runs, but
44	* collection totals and pagination headers are based on the unfiltered
45	* query. Setting `perm` lets WP_Query apply private-post visibility before
46	* totals are calculated.
47	*
48	* @param array $prepared_args Prepared WP_Query arguments.
49	* @param WP_REST_Request\|null $request Full details about the request.
50	* @return array Updated WP_Query arguments.
51	*/
52	protected function prepare_items_query( $prepared_args = array(), $request = null ) {
53	$query_args = parent::prepare_items_query( $prepared_args, $request );
54	$query_args['perm'] = 'readable';
55
56	return $query_args;
57	}
58
59	/**
60	* Gate per-item reads on the user-specific read capability.
61	*
62	* The default treats every `publish` post as universally readable;
63	* guidelines reach the parent's checks only after `read_post` passes,
64	* which factors in ownership and status.
65	*
66	* @param WP_Post $post Post object.
67	* @return bool Whether the post can be read.
68	*/
69	public function check_read_permission( $post ) {
70	if ( ! current_user_can( 'read_post', $post->ID ) ) {
71	return false;
72	}
73
74	return parent::check_read_permission( $post );
75	}
76
77	/**
78	* Restrict the status surface for callers without publish capability
79	* to `private`. Administrators retain the parent's full status surface.
80	*
81	* @param string $post_status Requested post status.
82	* @param WP_Post_Type $post_type Post type object.
83	* @return string\|WP_Error Status, or WP_Error if not permitted.
84	*/
85	protected function handle_status_param( $post_status, $post_type ) {
86	if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
87	if ( 'private' !== $post_status ) {
88	return new WP_Error(
89	'rest_cannot_publish',
90	__( 'Sorry, you are only allowed to set status to private for guidelines.', 'gutenberg' ),
91	array( 'status' => rest_authorization_required_code() )
92	);
93	}
94	return $post_status;
95	}
96
97	return parent::handle_status_param( $post_status, $post_type );
98	}
99
100	/**
101	* Default the status to `private` on create when none is supplied
102	* (the parent would fall back to `draft`). Updates pass through so a
103	* partial PATCH preserves the existing status.
104	*
105	* `wp_guideline_type` is optional on create. When omitted, the post
106	* falls back to the default guideline taxonomy term `artifact`.
107	*
108	* @param WP_REST_Request $request Request object.
109	* @return stdClass\|WP_Error Prepared post object or error.
110	*/
111	protected function prepare_item_for_database( $request ) {
112	if ( ! isset( $request['id'] ) && null === $request['status'] ) {
113	$request->set_param( 'status', 'private' );
114	}
115	return parent::prepare_item_for_database( $request );
116	}
117	}
118