← All changes | app/Controllers/AttributeController.php +10 -19 3.0.3 → trunk View file →

		@@ -810,42 +810,33 @@
810	810	return $data;
811	811	}
812	812
813	813	/**
814		- * Check permissions for read operations
	814	+ * Granular permission checks. Trip attributes are a trip-taxonomy
	815	+ * concept — they classify trips for filtering / display — so the
	816	+ * Team module's `yatra_manage_trip_taxonomies` cap is the right
	817	+ * gate for write operations, and `yatra_view_trips` for reads.
	818	+ * WP administrators pass every cap via the Team module's admin-
	819	+ * fallback filter so no explicit `manage_options` check is needed.
815	820	*/
816	821	public function get_permissions_check(): bool
817	822	{
818		- return current_user_can('manage_options');
	823	+ return current_user_can('yatra_view_trips');
819	824	}
820	825
821		- /**
822		- * Check permissions for create/update/delete operations
823		- */
824	826	public function check_permission(?WP_REST_Request $request = null): bool
825	827	{
826		- $hasPermission = current_user_can('manage_options');
827		-
828		- if (defined('WP_DEBUG') && WP_DEBUG) {
829		- }
830		-
831		- return $hasPermission;
	828	+ return current_user_can('yatra_manage_trip_taxonomies');
832	829	}
833	830
834		- /**
835		- * Check permissions for search operations
836		- */
837	831	public function search_permissions_check(): bool
838	832	{
839		- return current_user_can('manage_options');
	833	+ return current_user_can('yatra_view_trips');
840	834	}
841	835
842		- /**
843		- * Check permissions for update operations
844		- */
845	836	public function update_permissions_check(): bool
846	837	{
847		- return current_user_can('manage_options');
	838	+ return current_user_can('yatra_manage_trip_taxonomies');
848	839	}
849	840
850	841	/**
851	842	* Get item schema