add check to private visibility for taxonomy #220

src/api/endpoints/class-tainacan-rest-items-controller.php

@@ -385,21 +385,38 @@ class REST_Items_Controller extends REST_Controller {
 	public function get_items_permissions_check( $request ) {
 		$collection = $this->collections_repository->fetch($request['collection_id']);
 
+		if('edit' === $request['context'] && !is_user_logged_in()) {
+			return false;
+		}
+
+		if ( isset($request['taxquery']) && !$this->get_items_permissions_check_for_taxonomy($request['taxquery']) ) {
+			return false;
+		}
+
 		if(($collection instanceof Entities\Collection)) {
-			if('edit' === $request['context'] && !$collection->can_read()) {
+			if(!$collection->can_read()) {
 				return false;
 			}
-
 			return true;
 		} else {
-			if('edit' === $request['context'] && !$this->collections_repository->can_read(new Entities\Collection())) {
-				return false;
-			}
-
 			return true;
 		}
 	}
 
+	private function get_items_permissions_check_for_taxonomy($taxonomies) {
+		$taxonomy_repository = Repositories\Taxonomies::get_instance();
+		foreach ($taxonomies as $tax) {
+			$tax_id = $taxonomy_repository->get_id_by_db_identifier($tax['taxonomy']);
+			$taxonomy = $taxonomy_repository->fetch($tax_id);
+			if(($taxonomy instanceof Entities\Taxonomy)) {
+				if(!$taxonomy->can_read()) {
+					return false;
+				}
+			}
+		}
+		return true;
+	}
+
 	/**
 	 * @param \WP_REST_Request $request
 	 *

src/api/endpoints/class-tainacan-rest-taxonomies-controller.php

@@ -172,7 +172,10 @@ class REST_Taxonomies_Controller extends REST_Controller {
 		$taxonomy = $this->taxonomy_repository->fetch($request['taxonomy_id']);
 
 		if(($taxonomy instanceof Entities\Taxonomy)) {
-			if('edit' === $request['context'] && !$taxonomy->can_read()) {
+			if('edit' === $request['context'] && !is_user_logged_in()) {
+				return false;
+			}
+			if(!$taxonomy->can_read()) {
 				return false;
 			}
 

src/api/endpoints/class-tainacan-rest-terms-controller.php

@@ -350,7 +350,10 @@ class REST_Terms_Controller extends REST_Controller {
 		$taxonomy = $this->taxonomy_repository->fetch($request['taxonomy_id']);
 
 		if(($taxonomy instanceof Entities\Taxonomy)) {
-			if('edit' === $request['context'] && !$taxonomy->can_read()) {
+			if('edit' === $request['context'] && !is_user_logged_in()) {
+				return false;
+			}
+			if(!$taxonomy->can_read()) {
 				return false;
 			}
 
@@ -385,7 +388,10 @@ class REST_Terms_Controller extends REST_Controller {
 		$taxonomy = $this->taxonomy_repository->fetch($request['taxonomy_id']);
 
 		if(($taxonomy instanceof Entities\Taxonomy)) {
-			if('edit' === $request['context'] && !$taxonomy->can_read()) {
+			if('edit' === $request['context'] && !is_user_logged_in()) {
+				return false;
+			}
+			if(!$taxonomy->can_read()) {
 				return false;
 			}
 

src/classes/repositories/class-tainacan-repository.php

@@ -670,6 +670,12 @@ abstract class Repository {
 	 * @throws \Exception
 	 */
 	public function can_read( $entity, $user = null ) {
+		if(!is_user_logged_in()) {
+			$status = get_post_status($entity->get_id());
+			$post_status_obj = get_post_status_object($status);
+			return $post_status_obj->public;
+		}
+
 		if ( is_null( $user ) ) {
 			$user = get_current_user_id();
 		} elseif ( is_object( $user ) ) {