WC_REST_Authentication::reject_out_of_scope_route │ public │ WC 11.1.0

Reject a request when a WooCommerce API key authenticated a route outside our namespaces.

Scope is first judged from REQUEST_URI, during determine_current_user, before WordPress has parsed the request, so at that point the route the request will be dispatched to is not settled yet. This runs later on rest_authentication_errors, after authentication_fallback() and check_authentication_error(), so $this->user reflects the final authentication decision and WordPress has resolved the route. It acts only on a key we authenticated ourselves; a failed or absent key keeps the result the earlier callbacks produced.

Method of the class: WC_REST_Authentication{}

No Hooks.

Returns

WP_Error|null|bool.

Usage

$WC_REST_Authentication = new WC_REST_Authentication();
$WC_REST_Authentication->reject_out_of_scope_route( $result );

$result(WP_Error|null|true|false) (required)

Authentication result from earlier callbacks.

Changelog

WC_REST_Authentication::reject_out_of_scope_route() WC REST Authentication::reject out of scope route code ^{WC 11.1.2}

public function reject_out_of_scope_route( $result ) {
	if ( null !== $this->user && ! $this->is_resolved_route_in_scope() ) {
		return new WP_Error(
			'woocommerce_rest_authentication_error',
			__( 'The provided API key cannot be used to access this endpoint.', 'woocommerce' ),
			array( 'status' => 401 )
		);
	}

	return $result;
}