<?php
/**
 * REST controller for the form post type (wp/v2/tflexforms-forms).
 *
 * @package TFlexForms
 */

declare( strict_types = 1 );

namespace TFlexForms;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Core lets anyone read published posts of any REST-enabled post type. Forms
 * are internal configuration, so reading them requires the same capability
 * as editing them. The block editor's form picker is the only consumer.
 */
final class Forms_Rest_Controller extends \WP_REST_Posts_Controller {

	/**
	 * Requires form-editing rights to list forms.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return true|\WP_Error
	 */
	public function get_items_permissions_check( $request ) {
		if ( ! current_user_can( 'edit_tflexforms_forms' ) ) {
			return $this->forbidden();
		}
		return parent::get_items_permissions_check( $request );
	}

	/**
	 * Requires form-editing rights to read a single form.
	 *
	 * @param \WP_REST_Request $request Request.
	 * @return true|\WP_Error
	 */
	public function get_item_permissions_check( $request ) {
		if ( ! current_user_can( 'edit_tflexforms_forms' ) ) {
			return $this->forbidden();
		}
		return parent::get_item_permissions_check( $request );
	}

	/**
	 * Standard REST "forbidden" error.
	 */
	private function forbidden(): \WP_Error {
		return new \WP_Error(
			'rest_forbidden',
			__( 'Sorry, you are not allowed to view forms.', 'flexsolutions-form-builder' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}
}