<?php
/**
 * Shared REST controller behaviour.
 *
 * @package MenuVerse
 */

namespace WPXero\MenuVerse\Rest;

use WPXero\MenuVerse\Capabilities;
use WPXero\MenuVerse\Plugin;

defined( 'ABSPATH' ) || exit;

/**
 * Base class for every MenuVerse REST controller.
 *
 * Nothing here is publicly readable or writable: every route resolves through
 * `permission_check()`, which is never `__return_true`.
 */
abstract class Rest_Controller {

	/**
	 * REST namespace.
	 *
	 * @var string
	 */
	const REST_NAMESPACE = 'menuverse/v1';

	/**
	 * Registers the controller routes.
	 *
	 * @return void
	 */
	abstract public function register_routes();

	/**
	 * Capability gate for every route.
	 *
	 * @return true|\WP_Error
	 */
	public function permission_check() {
		if ( Capabilities::current_user_can_manage() ) {
			return true;
		}

		return new \WP_Error(
			'menuverse_forbidden',
			__( 'You are not allowed to manage MenuVerse settings.', 'menuverse' ),
			array( 'status' => is_user_logged_in() ? 403 : 401 )
		);
	}

	/**
	 * Returns the plugin container.
	 *
	 * @return Plugin
	 */
	protected function plugin() {
		return Plugin::instance();
	}
}
