| @@ -88,9 +88,9 @@ | ||
| 88 | 88 | add_action( 'rest_api_init', array( $this, 'register_routes' ) ); |
| 89 | 89 | } |
| 90 | 90 | |
| 91 | 91 | /** |
| 92 | - * Returns the endpoint name. | |
| 92 | + * Returns the endpoint's name. | |
| 93 | 93 | * |
| 94 | 94 | * This method should be overridden by child classes and used to return the |
| 95 | 95 | * endpoint name. |
| 96 | 96 | * |
| @@ -127,15 +127,23 @@ | ||
| 127 | 127 | /** |
| 128 | 128 | * Registers a REST route. |
| 129 | 129 | * |
| 130 | 130 | * @since 3.17.0 |
| 131 | + * @since 3.24.2 Added the `$permission_callback` parameter. | |
| 131 | 132 | * |
| 132 | - * @param string $route The route to register. | |
| 133 | - * @param string[] $methods Array with the allowed methods. | |
| 134 | - * @param callable $callback Callback function to call when the endpoint is hit. | |
| 135 | - * @param array<mixed> $args The endpoint arguments definition. | |
| 133 | + * @param string $route The route to register. | |
| 134 | + * @param string[] $methods Array with the allowed methods. | |
| 135 | + * @param callable $callback Callback function to call when the endpoint is hit. | |
| 136 | + * @param array<mixed> $args The endpoint arguments definition. | |
| 137 | + * @param callable|null $permission_callback Permission callback to use instead of the default one. | |
| 136 | 138 | */ |
| 137 | - public function register_rest_route( string $route, array $methods, callable $callback, array $args = array() ): void { | |
| 139 | + public function register_rest_route( | |
| 140 | + string $route, | |
| 141 | + array $methods, | |
| 142 | + callable $callback, | |
| 143 | + array $args = array(), | |
| 144 | + ?callable $permission_callback = null | |
| 145 | + ): void { | |
| 138 | 146 | // Trim any possible slashes from the route. |
| 139 | 147 | $route = trim( $route, '/' ); |
| 140 | 148 | |
| 141 | 149 | // Store the route for later reference. |
| @@ -151,9 +159,10 @@ | ||
| 151 | 159 | array( |
| 152 | 160 | array( |
| 153 | 161 | 'methods' => $methods, |
| 154 | 162 | 'callback' => $callback, |
| 155 | - 'permission_callback' => array( $this, 'is_available_to_current_user' ), | |
| 163 | + 'permission_callback' => $permission_callback ?? | |
| 164 | + array( $this, 'is_available_to_current_user' ), | |
| 156 | 165 | 'args' => $args, |
| 157 | 166 | 'show_in_index' => ! is_wp_error( $this->is_available_to_current_user() ), |
| 158 | 167 | ), |
| 159 | 168 | ) |
| @@ -185,9 +194,9 @@ | ||
| 185 | 194 | |
| 186 | 195 | /** |
| 187 | 196 | * Returns the endpoint slug. |
| 188 | 197 | * |
| 189 | - * The slug is the endpoint name prefixed with the route prefix, from | |
| 198 | + * The slug is the endpoint's name prefixed with the route prefix, from | |
| 190 | 199 | * the API controller. |
| 191 | 200 | * |
| 192 | 201 | * Used as an identifier for the endpoint, when registering routes. |
| 193 | 202 | * |
| @@ -241,8 +250,13 @@ | ||
| 241 | 250 | * applied capability filters. |
| 242 | 251 | * |
| 243 | 252 | * The default access capability is not passed here by default, to allow for |
| 244 | 253 | * a more explicit declaration in child classes. |
| 254 | + * | |
| 255 | + * The result is checked with current_user_can(), so a capability such as | |
| 256 | + * `exist` makes the endpoint available to everyone, unless other checks | |
| 257 | + * apply: post-specific routes also require edit access to the post, and | |
| 258 | + * Content Intelligence routes also check the user's role. | |
| 245 | 259 | * |
| 246 | 260 | * @since 3.14.0 |
| 247 | 261 | * @since 3.17.0 Moved to the new API structure. |
| 248 | 262 | * |
