<?php
/**
 * The core posts controller for scheduled content items, limited to the
 * users who manage them.
 *
 * @package Yangra\Conditional
 */

namespace Yangra\Conditional\Rest;

use WP_Error;
use WP_REST_Posts_Controller;
use WP_REST_Request;
use Yangra\Conditional\Scheduling\ScheduledContent;

defined( 'ABSPATH' ) || exit;

/**
 * WordPress's posts controller lets anyone read published posts of a post
 * type that is in the REST API, even a non-public one. Scheduled content is
 * often not meant to be seen before its show time, so only users who manage
 * items (`edit_others_posts`) can read them.
 */
class ScheduledContentPostsController extends WP_REST_Posts_Controller {

	/**
	 * Checks that the user can list items.
	 *
	 * @param WP_REST_Request $request Request.
	 * @phpstan-param WP_REST_Request<array<string, mixed>> $request
	 * @return true|WP_Error
	 */
	public function get_items_permissions_check( $request ) {
		if ( ! current_user_can( ScheduledContent::CAPABILITY ) ) {
			return $this->forbidden();
		}

		return parent::get_items_permissions_check( $request );
	}

	/**
	 * Checks that the user can read an item.
	 *
	 * @param WP_REST_Request $request Request.
	 * @phpstan-param WP_REST_Request<array<string, mixed>> $request
	 * @return bool|WP_Error
	 */
	public function get_item_permissions_check( $request ) {
		if ( ! current_user_can( ScheduledContent::CAPABILITY ) ) {
			return $this->forbidden();
		}

		return parent::get_item_permissions_check( $request );
	}

	/**
	 * The error for users who can't read items.
	 *
	 * @return WP_Error
	 */
	private function forbidden(): WP_Error {
		return new WP_Error(
			'rest_forbidden',
			__( 'Sorry, you are not allowed to read scheduled content.', 'yangra-conditional' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}
}