Caller final class

Minn\Rest\Caller · public/minn/src/Minn/Rest/Caller.php · 149 lines

Who is making this REST call. Resolved once from the cookie and nonce; an anonymous or failed caller has id 0 and every capability check fails.

Uses 7

Auth\AuthFailure Auth\Authenticated Auth\Authenticator Auth\Capabilities Http\Request RestError Runtime\Runtime

Used by 47 (show)

Admin\BundleController Admin\EditorController Admin\LanguageController Admin\OverviewController Admin\PackagesController Admin\PreferencesController Admin\RenderController Admin\SessionsController Admin\SiteController Admin\StructureController Admin\SystemController Admin\ThemesController Admin\UpdatesController Admin\V1Controller Api ApplicationPasswordsController BlockRendererController BlockTypesController BlocksController CommentObject CommentsController GlobalStylesController GlobalStylesObject InstalledThemesController MediaController MediaObject MenuItemObject MenuObject MenusController PluginsController PolicyGate PostObject PostsController PostsWriteController RevisionsController SearchController Services SettingsController SidebarsController StatusesController TemplateObject TemplatesController TermObject TermsController UserObject UsersController WidgetsController

Constants and properties

private	`Minn\Auth\Authenticated\|Minn\Auth\AuthFailure\|null $resolved`
private	`readonly Minn\Http\Request $request`	Promoted from the constructor.
private	`readonly Minn\Auth\Authenticator $authenticator`	Promoted from the constructor.
private	`readonly Minn\Auth\Capabilities $capabilities`	Promoted from the constructor.

Public

new	`__construct(Minn\Http\Request $request, Minn\Auth\Authenticator $authenticator, Minn\Auth\Capabilities $capabilities)`#
method	`resolveAs(Minn\Auth\Authenticated $session): void`#	Settles the caller as a session already proven elsewhere: an in-process request a plugin makes through rest_do_request() carries no nonce, so it runs as whoever the outer request resolved.
method	`resolveAnonymous(): void`#	Settles the caller as nobody: plugin code (determine_current_user) signed the request out.
method	`cookieBound(): bool`#	Whether a sign-in cookie vouches for this caller (or failed to, for want of its nonce): a cookie's nonce vouches for its own user only.
method	`recheck(): void`#	Has the cookie and nonce checked again on the next question: a plugin's nonce lifetime (nonce_life) is heard only once plugins load.
method	`resolveInvalidNonce(): void`#	Settles the caller as one whose cookie's nonce does not vouch for the user plugin code named.
method	`session(): ?Minn\Auth\Authenticated`#	The session, or null for an anonymous or refused caller.
method	`id(): int`#	The caller's user id, 0 when anonymous.
method	`can(string $capability, ?int $postId = NULL): bool`#	Whether the caller holds a capability, on a post when given. With plugins loaded the answer is WordPress's: the same mapping, then map_meta_cap and user_has_cap, where role editors and lock plugins have their say.
method	`editsAnyRestType(): bool`#	Whether the caller can edit posts of some type shown in REST: what the reference asks before showing statuses, block types and the active theme. A plugin's types count once plugins are loaded.
method	`capabilities(): Minn\Auth\Capabilities`#	The capability engine.
method	`require(string $code = 'rest_not_logged_in', string $message = 'You are not currently logged in.', int $status = 401): Minn\Auth\Authenticated`#	The session, or the reference's refusal: a bad nonce is always 403 rest_cookie_invalid_nonce; no identity is the caller-supplied error.
method	`requireFloor(string ...$capabilities): int`#	The floor every Minn Admin route shares: a signed-in caller who can edit posts, plus any further capability named, all refused with the same rest_forbidden the reference uses. Returns the caller's id.
method	`requireCap(string ...$capabilities): void`#	403 rest_forbidden unless the caller holds every capability named.
method	`refuse(string $code, string $message): Minn\RestError`#	401 for an anonymous caller, 403 for one who is signed in but refused.

Internals 1

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private resolve(): Minn\Auth\Authenticated|Minn\Auth\AuthFailure#