<?php
/**
 * Public connector-authentication seam for trusted extensions.
 *
 * @package SEOvaultSEO\Extension
 */

namespace SEOvaultSEO\Extension;

use SEOvaultSEO\Api\Router;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Builds permission callbacks for connector-owned extension routes.
 *
 * Extensions receive only the fixed read and write factories; Free retains
 * ownership of site-key parsing, rate limiting, audit logging, and capability
 * checks. Arbitrary caller-supplied capability names are not accepted.
 */
class ConnectorAuth {

	/**
	 * Private read capability used by the public read factory.
	 */
	private const CAP_READ = 'extension:read';

	/**
	 * Private write capability used by the public write factory.
	 */
	private const CAP_WRITE = 'extension:write';

	/**
	 * Permission callback for connector-authenticated read routes.
	 *
	 * @return callable
	 */
	public static function read_permission_callback() {
		return Router::require_caps( self::CAP_READ );
	}

	/**
	 * Permission callback for connector-authenticated write routes.
	 *
	 * @return callable
	 */
	public static function write_permission_callback() {
		return Router::require_caps( self::CAP_WRITE );
	}
}
