# xspeed/1.0.1/includes/class-rest-manager.php

xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN, version 1.0.1. 121 lines.

- Page: https://pluginprobe.com/plugins/xspeed/1.0.1/code/includes/class-rest-manager.php
- Raw: https://pluginprobe.com/plugins/xspeed/1.0.1/raw/includes/class-rest-manager.php
- Modified: 2026-06-01T17:33:22+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/xspeed/1.0.1/code/includes/class-rest-manager.php#L10-L20`.

```php
<?php
/**
 * Rest_Manager — registers a module's REST routes under
 * `/xspeed/v1/<module-slug>/...` and wraps every callback with:
 *   - A final capability check (defaults to `manage_options`).
 *   - A tier gate that returns 404 if the module is unavailable on this
 *     install (Pro module without active Pro plugin → 404, not 403, so
 *     the route looks like it doesn't exist).
 *   - A conflict gate (refuse strategy → 409 with conflict details).
 *
 * Modules declare routes via Module::rest_routes(). They don't repeat the
 * cap check / tier gate / conflict gate — Rest_Manager always enforces.
 *
 * The pre-existing /xspeed/v1/status, /settings, /cache/purge,
 * /cache/toggle, /onboarding/* routes (registered by Rest_Api and
 * Onboarding) continue to work alongside per-module routes. They'll move
 * onto the module pattern when those features are refactored.
 *
 * @package XSpeed
 */

namespace XSpeed;

defined( 'ABSPATH' ) || exit;

final class Rest_Manager {

	public const NAMESPACE_V1 = 'xspeed/v1';

	/**
	 * Register every route a module declared, prefixed with its slug.
	 */
	public static function register_module( Module $module ): void {
		$routes = $module->rest_routes();
		if ( empty( $routes ) ) {
			return;
		}

		add_action(
			'rest_api_init',
			static function () use ( $module, $routes ) {
				$slug = $module->slug();
				foreach ( $routes as $route ) {
					$path = '/' . trim( $slug, '/' ) . '/' . ltrim( $route['path'] ?? '', '/' );
					$path = rtrim( $path, '/' );

					$args = array(
						'methods'             => $route['methods'] ?? 'GET',
						'callback'            => self::wrap_callback( $module, $route ),
						'permission_callback' => self::wrap_permission( $module, $route ),
					);
					if ( isset( $route['args'] ) ) {
						$args['args'] = $route['args'];
					}

					register_rest_route( self::NAMESPACE_V1, $path, $args );
				}
			}
		);
	}

	/**
	 * Wrap a module's callback with the tier + conflict gates.
	 */
	private static function wrap_callback( Module $module, array $route ): callable {
		$callback = $route['callback'] ?? null;
		$feature  = $route['feature'] ?? null; // optional sub-feature key for conflict resolution.

		return static function ( \WP_REST_Request $request ) use ( $module, $callback, $feature ) {
			// Tier gate — Pro route without active Pro plugin looks like it doesn't exist.
			if ( ! Tier_Registry::is_available( $module ) ) {
				return new \WP_Error(
					'rest_no_route',
					__( 'No route was found matching the URL and request method.', 'xspeed' ),
					array( 'status' => 404 )
				);
			}

			// Conflict gate — refuse-strategy → 409.
			if ( $feature ) {
				$reason = Conflict_Registry::why_blocked( $module->slug(), $feature );
				if ( $reason ) {
					return new \WP_Error(
						'xspeed_conflict_refused',
						$reason,
						array( 'status' => 409 )
					);
				}
			}

			if ( ! is_callable( $callback ) ) {
				return new \WP_Error( 'xspeed_no_callback', 'Module REST callback is not callable.', array( 'status' => 500 ) );
			}
			return call_user_func( $callback, $request );
		};
	}

	/**
	 * Wrap permission_callback with the always-on cap check. A module may
	 * declare its own permission_callback for an extra-strict gate; both
	 * must pass.
	 */
	private static function wrap_permission( Module $module, array $route ): callable {
		$declared   = $route['permission_callback'] ?? null;
		$capability = $route['capability'] ?? 'manage_options';

		return static function ( \WP_REST_Request $request ) use ( $declared, $capability ) {
			if ( ! current_user_can( $capability ) ) {
				return false;
			}
			if ( is_callable( $declared ) ) {
				$result = call_user_func( $declared, $request );
				if ( true !== $result ) {
					return $result;
				}
			}
			return true;
		};
	}
}

```