<?php
namespace Academy\API\Authorization;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

use WP_Error;
use WP_REST_Posts_Controller;

/**
 * REST controller for post types whose posts must never be readable by the
 * public (lessons stored as posts, ...).
 *
 * The stock WP_REST_Posts_Controller serves every PUBLISHED post — with
 * every show_in_rest meta key — to anyone, and register_meta()'s
 * auth_callback only guards writes. This controller requires the post
 * type's own `edit_posts` capability (admins / instructors) for reads.
 * Writes keep the parent's checks.
 */
class RestPrivatePostsController extends WP_REST_Posts_Controller {

	protected function can_read_private_type() {
		$post_type = get_post_type_object( $this->post_type );
		return $post_type && current_user_can( $post_type->cap->edit_posts );
	}

	protected function private_type_error() {
		return new WP_Error(
			'rest_forbidden',
			esc_html__( 'Sorry, you are not allowed to view these items.', 'academy' ),
			array( 'status' => rest_authorization_required_code() )
		);
	}

	public function get_items_permissions_check( $request ) {
		if ( ! $this->can_read_private_type() ) {
			return $this->private_type_error();
		}
		return parent::get_items_permissions_check( $request );
	}

	public function get_item_permissions_check( $request ) {
		if ( ! $this->can_read_private_type() ) {
			return $this->private_type_error();
		}
		return parent::get_item_permissions_check( $request );
	}
}