RestStrategy registers all routes with permission_callback => __return_true

[alexstandiford]

Problem

RestStrategy registers every route with 'permission_callback' => '__return_true' and performs the real authorization inside the route callback via each controller's getMiddleware() (e.g. createAuthMiddlewareFromCurrentContext(...), which throws on an unauthorized request).

Functionally the data is protected — the middleware runs before the handler body and rejects unauthorized requests. But because permission_callback always returns true:

• WordPress advertises every endpoint (including destructive DELETE/bulk routes) as publicly accessible in the REST API index/discovery.
• Static analysis and the WordPress.org plugin-review scanners cannot see that authorization exists — __return_true on a mutating route is the single most-flagged REST pattern in review.
• There is no WP-level backstop: if a controller ever fails to register its auth middleware, the route is wide open with no declarative permission check.

Desired outcome

WordPress's own permission gate should reflect the real authorization. The permission_callback should run the same auth resolution the in-callback middleware uses, so an unauthorized request is rejected at the permission stage and the endpoint is not advertised as public. This is also a defense-in-depth improvement over running auth only inside the callback body.

Notes

Surfaced by the Siren WordPress plugin (consumer of this package) during WordPress.org review-simulation. Not blocking Siren's submission (auth is enforced), but it generates a guaranteed reviewer flag and is a genuine layering issue.

[alexstandiford]

Design constraint from the founder: not all PHPNomad endpoints are public — whether a route requires auth depends entirely on which middleware the controller returns. So the fix must NOT change the controller contract (no new interface method, no per-controller permission declarations).

The shape that satisfies that: RestStrategy already calls $controller->getMiddleware($request) inside the route callback. Instead of 'permission_callback' => '__return_true', register a permission callback that builds the WP_REST_Request-derived PHPNomad request, runs the SAME getMiddleware() chain, and maps a middleware rejection (the auth middleware throws) to a WP_Error with the appropriate status. Controllers with no auth middleware remain public — exactly as today — and controllers with auth middleware become declaratively protected at the WordPress layer, with the in-callback middleware run staying as defense-in-depth. Zero contract change; the integration just consults the middleware twice (or memoizes the first run on the request object).