<?php
/**
 * REST permission callbacks.
 *
 * @package HostKhata
 */

namespace HostKhata\Rest;

defined( 'ABSPATH' ) || exit;

use WP_Error;

/**
 * Builds `permission_callback` closures so no route is ever left open.
 *
 * Cookie-authenticated requests are also protected by core's REST nonce check
 * (`X-WP-Nonce`), which runs before these callbacks.
 *
 * @since 0.1.0
 */
final class Permissions {

	/**
	 * A callback that requires a capability.
	 *
	 * @since 0.1.0
	 *
	 * @param string $capability Capability name.
	 * @return callable
	 */
	public static function require_capability( string $capability ): callable {
		return static function () use ( $capability ) {
			if ( current_user_can( $capability ) ) {
				return true;
			}

			return self::forbidden();
		};
	}

	/**
	 * A callback that requires a logged-in user. Ownership of the object must still be checked by the route.
	 *
	 * @since 0.1.0
	 *
	 * @return callable
	 */
	public static function require_login(): callable {
		return static function () {
			if ( is_user_logged_in() ) {
				return true;
			}

			return new WP_Error(
				'hostkhata_unauthorized',
				__( 'You need to log in.', 'hostkhata' ),
				array( 'status' => 401 )
			);
		};
	}

	/**
	 * The error returned when a user lacks permission.
	 *
	 * @since 0.1.0
	 *
	 * @return WP_Error
	 */
	public static function forbidden(): WP_Error {
		return new WP_Error(
			'hostkhata_forbidden',
			__( 'You are not allowed to do that.', 'hostkhata' ),
			array( 'status' => is_user_logged_in() ? 403 : 401 )
		);
	}
}