learnpress / inc / MCP / Support / Permissions.php

Permissions.php in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses 4.4.4, at inc/MCP/Support/Permissions.php

85 lines 2.4 KB

Raw Download Zip

1	<?php
2
3	namespace LearnPress\MCP\Support;
4
5	defined( 'ABSPATH' ) \|\| exit;
6
7	/**
8	* Current-user capability helpers for MCP write/sensitive-read operations.
9	*
10	* These checks are defense-in-depth on top of the shared MCP permission
11	* callback (which already requires a valid API key and a base capability).
12	* They mirror the capability patterns used by the LearnPress post models
13	* (`edit_{post_type}s` to create, `edit_post`/`delete_post` meta caps to
14	* mutate a specific post) so MCP never relies on key scope alone.
15	*/
16	class Permissions {
17
18	/**
19	* Whether the current user may create a post of the given type.
20	*
21	* Mirrors PostModel::check_capabilities_create() (`edit_{post_type}s`).
22	*
23	* @param string $post_type Post type, e.g. LP_COURSE_CPT.
24	*
25	* @return bool
26	*/
27	public static function can_create( string $post_type ): bool {
28	return current_user_can( 'manage_options' )
29	\|\| current_user_can( 'edit_' . $post_type . 's' );
30	}
31
32	/**
33	* Whether the current user may edit a specific post.
34	*
35	* @param int $post_id Post ID.
36	*
37	* @return bool
38	*/
39	public static function can_edit_post( int $post_id ): bool {
40	return current_user_can( 'manage_options' )
41	\|\| current_user_can( 'edit_post', $post_id );
42	}
43
44	/**
45	* Whether the current user may delete (trash) a specific post.
46	*
47	* @param int $post_id Post ID.
48	*
49	* @return bool
50	*/
51	public static function can_delete_post( int $post_id ): bool {
52	return current_user_can( 'manage_options' )
53	\|\| current_user_can( 'delete_post', $post_id );
54	}
55
56	/**
57	* Whether the current user may manage LearnPress users / enrollments.
58	*
59	* Manual enrollment management is an administrative action; keep it on the
60	* base management capability rather than guessing a finer LMS capability.
61	*
62	* @return bool
63	*/
64	public static function can_manage_enrollments(): bool {
65	return current_user_can( 'manage_options' )
66	\|\| current_user_can( 'list_users' );
67	}
68
69	/**
70	* Whether the current context is privileged enough to read sensitive quiz
71	* data (correct answers, hints, explanations).
72	*
73	* Requires the ability to edit the quiz itself or to manage the site.
74	* A plain read scope alone is intentionally not sufficient.
75	*
76	* @param int $quiz_id Quiz post ID.
77	*
78	* @return bool
79	*/
80	public static function can_read_sensitive_quiz( int $quiz_id ): bool {
81	return current_user_can( 'manage_options' )
82	\|\| current_user_can( 'edit_post', $quiz_id );
83	}
84	}
85