eventespresso / event-espresso-core

     */

    protected function verifyCurrentUserCan($required_permission, $attempted_calculation)

    {

        if (! current_user_can($required_permission)) {

            throw new RestException(

                'permission_denied',

                sprintf(

                    __(

                    // @codingStandardsIgnoreStart

                        'Permission denied, you cannot calculate %1$s on %2$s because you do not have the capability "%3$s"',

                        // @codingStandardsIgnoreEnd

                        'event_espresso'

                    ),

                    $attempted_calculation,

                    EEH_Inflector::pluralize_and_lower($this->getResourceName()),

                    $required_permission

                )

            );

        }

    }

    {

        Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'create');

        $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap();

        if (! current_user_can($default_cap_to_check_for)) {

            throw new RestException(

                'rest_cannot_create_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())),

                sprintf(

                    esc_html__(

                    // @codingStandardsIgnoreStart

                        'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to insert data into Event Espresso.',

                        // @codingStandardsIgnoreEnd

                        'event_espresso'

                    ),

                    $default_cap_to_check_for

                ),

                array('status' => 403)

            );

        }

        $submitted_json_data = array_merge((array) $request->get_body_params(), (array) $request->get_json_params());

        $model_data = ModelDataTranslator::prepareConditionsQueryParamsForModels(

            $submitted_json_data,

    {

        Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'edit');

        $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap();

        if (! current_user_can($default_cap_to_check_for)) {

            throw new RestException(

                'rest_cannot_edit_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())),

                sprintf(

                    esc_html__(

                    // @codingStandardsIgnoreStart

                        'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to update data into Event Espresso.',

                        // @codingStandardsIgnoreEnd

                        'event_espresso'

                    ),

                    $default_cap_to_check_for

                ),

                array('status' => 403)

            );

        }

        $obj_id = $request->get_param('id');

        if (! $obj_id) {

            throw new RestException(

    {

        Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_delete, 'delete');

        $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap();

        if (! current_user_can($default_cap_to_check_for)) {

            throw new RestException(

                'rest_cannot_delete_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())),

                sprintf(

                    esc_html__(

                    // @codingStandardsIgnoreStart

                        'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to delete data into Event Espresso.',

                        // @codingStandardsIgnoreEnd

                        'event_espresso'

                    ),

                    $default_cap_to_check_for

                ),

                array('status' => 403)

            );

        }

        $obj_id = $request->get_param('id');

        // this is where we would apply more fine-grained caps

        $model_obj = $model->get_one_by_ID($obj_id);

        // Check generic caps. For now, we're only allowing access to this endpoint to full admins.

        Capabilities::verifyAtLeastPartialAccessTo($model, EEM_Base::caps_edit, 'create');

        $default_cap_to_check_for = EE_Restriction_Generator_Base::get_default_restrictions_cap();

        if (! current_user_can($default_cap_to_check_for)) {

            throw new RestException(

                'rest_cannot_add_relation_from_' . EEH_Inflector::pluralize_and_lower(($model->get_this_model_name())),

                sprintf(

                    esc_html__(

                        // @codingStandardsIgnoreStart

                        'For now, only those with the admin capability to "%1$s" are allowed to use the REST API to add relations in Event Espresso.',

                        // @codingStandardsIgnoreEnd

                        'event_espresso'

                    ),

                    $default_cap_to_check_for

                ),

                array('status' => 403)

            );

        }

        // Get the main model object.

        $model_obj = $this->getOneOrThrowException($model, $request->get_param('id'));

        // For now, we require the other model object to exist too. This might be relaxed later.