initial

includes/Controllers/RsvRestPolicy.php

@@ -0,0 +1,38 @@
+<?php
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
+/**
+ * Authorization policy for the reservations/v1 REST API.
+ *
+ * Every route's `permission_callback` references one of these tiers so the
+ * intended audience is visible at the route definition:
+ *
+ *   - admin(): requires the manage_reservations capability (see RsvCapabilities).
+ *   - open():  genuinely public, OR a capability URL whose secret is validated
+ *              inside the handler itself (confirmation codes, the Google webhook,
+ *              the OAuth callback). Any `open()` route that is not fully public
+ *              MUST authorise its caller from the request.
+ */
+final class RsvRestPolicy {
+	/** Administrative endpoints: managing timetables, capacities, forms, reservations. */
+	public static function admin(): bool|WP_Error {
+		if ( current_user_can( RsvCapabilities::MANAGE ) ) {
+			return true;
+		}
+
+		return new WP_Error(
+			'rsv_forbidden',
+			__( 'Sorry, you are not allowed to do that.', 'reservair' ),
+			// 401 when logged out, 403 when logged in but under-privileged.
+			[ 'status' => rest_authorization_required_code() ]
+		);
+	}
+
+	/** Public endpoints, and capability URLs validated inside the handler. */
+	public static function open(): bool {
+		return true;
+	}
+}