gutenberg / lib / experimental / knowledge / class-gutenberg-knowledge-rest-controller.php

class-gutenberg-knowledge-rest-controller.php in Gutenberg 23.7.2, at lib/experimental/knowledge/class-gutenberg-knowledge-rest-controller.php

120 lines 4.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Knowledge REST API Controller.
4	*
5	* @package gutenberg
6	*/
7
8	if ( ! defined( 'ABSPATH' ) ) {
9	exit;
10	}
11
12	/**
13	* REST API controller for knowledge posts.
14	*/
15	class Gutenberg_Knowledge_REST_Controller extends WP_REST_Posts_Controller {
16
17	/**
18	* Gate the knowledge collection on the post-type read capability.
19	*
20	* The default `WP_REST_Posts_Controller` allows unauthenticated reads of
21	* `publish` posts; knowledge posts store private data and require an
22	* authenticated user with read access.
23	*
24	* @param WP_REST_Request $request Full details about the request.
25	* @return true\|WP_Error True if the request has read access, WP_Error object otherwise.
26	*/
27	public function get_items_permissions_check( $request ) {
28	$post_type = get_post_type_object( $this->post_type );
29	if ( ! current_user_can( $post_type->cap->read ) ) {
30	return new WP_Error(
31	'rest_cannot_read',
32	__( 'Sorry, you are not allowed to view knowledge.', 'gutenberg' ),
33	array( 'status' => rest_authorization_required_code() )
34	);
35	}
36
37	return parent::get_items_permissions_check( $request );
38	}
39
40	/**
41	* Scope collection queries to rows readable by the current user.
42	*
43	* The parent controller filters unreadable posts after the query runs, but
44	* collection totals and pagination headers are based on the unfiltered
45	* query. Setting `perm` lets WP_Query apply private-post visibility before
46	* totals are calculated.
47	*
48	* @param array $prepared_args Prepared WP_Query arguments.
49	* @param WP_REST_Request\|null $request Full details about the request.
50	* @return array Updated WP_Query arguments.
51	*/
52	protected function prepare_items_query( $prepared_args = array(), $request = null ) {
53	$query_args = parent::prepare_items_query( $prepared_args, $request );
54	$query_args['perm'] = 'readable';
55
56	return $query_args;
57	}
58
59	/**
60	* Gate per-item reads on the user-specific read capability.
61	*
62	* The default treats every `publish` post as universally readable;
63	* knowledge posts reach the parent's checks only after `read_post`
64	* passes, which factors in ownership and status.
65	*
66	* @param WP_Post $post Post object.
67	* @return bool Whether the post can be read.
68	*/
69	public function check_read_permission( $post ) {
70	if ( ! current_user_can( 'read_post', $post->ID ) ) {
71	return false;
72	}
73
74	return parent::check_read_permission( $post );
75	}
76
77	/**
78	* Restrict the status surface for callers without publish capability
79	* to `private`. Administrators retain the parent's full status surface.
80	*
81	* @param string $post_status Requested post status.
82	* @param WP_Post_Type $post_type Post type object.
83	* @return string\|WP_Error Status, or WP_Error if not permitted.
84	*/
85	protected function handle_status_param( $post_status, $post_type ) {
86	if ( ! current_user_can( $post_type->cap->publish_posts ) ) {
87	if ( 'private' !== $post_status ) {
88	return new WP_Error(
89	'rest_cannot_publish',
90	__( 'Sorry, you are only allowed to set knowledge to a private status.', 'gutenberg' ),
91	array( 'status' => rest_authorization_required_code() )
92	);
93	}
94	return $post_status;
95	}
96
97	return parent::handle_status_param( $post_status, $post_type );
98	}
99
100	/**
101	* Default the status to `private` on create when none is supplied
102	* (the parent would fall back to `draft`). Updates pass through so a
103	* partial PATCH preserves the existing status.
104	*
105	* `wp_knowledge_type` is optional on create. When omitted, the post
106	* falls back to the default knowledge taxonomy term `note`. That fallback
107	* is applied by `wp_knowledge_ensure_default_type_term()` on the
108	* `save_post_wp_knowledge` hook (see knowledge.php), not here.
109	*
110	* @param WP_REST_Request $request Request object.
111	* @return stdClass\|WP_Error Prepared post object or error.
112	*/
113	protected function prepare_item_for_database( $request ) {
114	if ( ! isset( $request['id'] ) && null === $request['status'] ) {
115	$request->set_param( 'status', 'private' );
116	}
117	return parent::prepare_item_for_database( $request );
118	}
119	}
120