{"action":"created","issue":{"url":"https://api.github.com/repos/WP-API/WP-API/issues/660","labels_url":"https://api.github.com/repos/WP-API/WP-API/issues/660/labels{/name}","comments_url":"https://api.github.com/repos/WP-API/WP-API/issues/660/comments","events_url":"https://api.github.com/repos/WP-API/WP-API/issues/660/events","html_url":"https://github.com/WP-API/WP-API/issues/660","id":50399756,"number":660,"title":"Allow read and edit permission checks to be filterable ","user":{"login":"NateWr","id":2306629,"avatar_url":"https://avatars.githubusercontent.com/u/2306629?v=3","gravatar_id":"","url":"https://api.github.com/users/NateWr","html_url":"https://github.com/NateWr","followers_url":"https://api.github.com/users/NateWr/followers","following_url":"https://api.github.com/users/NateWr/following{/other_user}","gists_url":"https://api.github.com/users/NateWr/gists{/gist_id}","starred_url":"https://api.github.com/users/NateWr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NateWr/subscriptions","organizations_url":"https://api.github.com/users/NateWr/orgs","repos_url":"https://api.github.com/users/NateWr/repos","events_url":"https://api.github.com/users/NateWr/events{/privacy}","received_events_url":"https://api.github.com/users/NateWr/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/WP-API/WP-API/labels/Enhancement","name":"Enhancement","color":"009800"}],"state":"open","locked":false,"assignee":{"login":"rachelbaker","id":979807,"avatar_url":"https://avatars.githubusercontent.com/u/979807?v=3","gravatar_id":"","url":"https://api.github.com/users/rachelbaker","html_url":"https://github.com/rachelbaker","followers_url":"https://api.github.com/users/rachelbaker/followers","following_url":"https://api.github.com/users/rachelbaker/following{/other_user}","gists_url":"https://api.github.com/users/rachelbaker/gists{/gist_id}","starred_url":"https://api.github.com/users/rachelbaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rachelbaker/subscriptions","organizations_url":"https://api.github.com/users/rachelbaker/orgs","repos_url":"https://api.github.com/users/rachelbaker/repos","events_url":"https://api.github.com/users/rachelbaker/events{/privacy}","received_events_url":"https://api.github.com/users/rachelbaker/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/WP-API/WP-API/milestones/10","labels_url":"https://api.github.com/repos/WP-API/WP-API/milestones/10/labels","id":844496,"number":10,"title":"2.0","description":null,"creator":{"login":"danielbachhuber","id":36432,"avatar_url":"https://avatars.githubusercontent.com/u/36432?v=3","gravatar_id":"","url":"https://api.github.com/users/danielbachhuber","html_url":"https://github.com/danielbachhuber","followers_url":"https://api.github.com/users/danielbachhuber/followers","following_url":"https://api.github.com/users/danielbachhuber/following{/other_user}","gists_url":"https://api.github.com/users/danielbachhuber/gists{/gist_id}","starred_url":"https://api.github.com/users/danielbachhuber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielbachhuber/subscriptions","organizations_url":"https://api.github.com/users/danielbachhuber/orgs","repos_url":"https://api.github.com/users/danielbachhuber/repos","events_url":"https://api.github.com/users/danielbachhuber/events{/privacy}","received_events_url":"https://api.github.com/users/danielbachhuber/received_events","type":"User","site_admin":false},"open_issues":65,"closed_issues":91,"state":"open","created_at":"2014-10-29T00:12:18Z","updated_at":"2015-02-02T04:35:43Z","due_on":null,"closed_at":null},"comments":12,"created_at":"2014-11-28T19:41:41Z","updated_at":"2015-02-02T23:36:40Z","closed_at":null,"body":"I'm trying to build a SaaS app on the REST API. To do so, I need to block read access to posts that are created by users. Only the author should be able to retrieve their own posts via the ```/posts``` endpoint.\r\n\r\nThis seems like a common use case for the REST API. But I am having a devil of a time figuring out how to use ```map_meta_cap``` and ```user_has_cap``` to accomplish this. If a post status is ```publish```, the API seems to bypass these filters. \r\n\r\nMy custom ```$post_type->public = false```, but ```$post_type->show_in_json = true``` so that it can be exposed via the API. This way you can't go to ```mysite.com/?p=123``` and access the post. However, you if you hit the ```/posts/123``` endpoint the API will expose the post. It will disregard any ```do_not_allow``` capabilities required via ```map_meta_cap```. I can even strip all capabilities from a user in ```user_has_cap``` and it will still show me the post.\r\n\r\nAs far as I can tell, it completely [bypasses](https://github.com/WP-API/WP-API/blob/develop/lib/class-wp-json-posts.php#L402) any current_user_can() checks for published posts, regardless of the ```$post_type->public``` value.\r\n\r\nI'm new to ```map_meta_cap``` and really struggling with it, so maybe I'm missing something obvious. Is there another way that read access to others' posts of specific post types is supposed to be protected from the API?\r\n\r\nFor reference, here is the ```map_meta_cap``` filter I'm using which, if I understand it correctly, should block access to all posts. Instead I can still hit ```/posts/123``` to retrieve any post with a ```publish``` status.\r\n\r\n```\r\nadd_filter( 'map_meta_cap', 'my_map_meta_cap' ), 10, 4 );\r\nfunction my_map_meta_cap( $required_caps, $current_cap, $user_id, $args ) {\r\n\t$required_caps[] = 'do_not_allow';\r\n\treturn $required_caps;\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/WP-API/WP-API/issues/comments/72562394","html_url":"https://github.com/WP-API/WP-API/issues/660#issuecomment-72562394","issue_url":"https://api.github.com/repos/WP-API/WP-API/issues/660","id":72562394,"user":{"login":"davekiss","id":1256071,"avatar_url":"https://avatars.githubusercontent.com/u/1256071?v=3","gravatar_id":"","url":"https://api.github.com/users/davekiss","html_url":"https://github.com/davekiss","followers_url":"https://api.github.com/users/davekiss/followers","following_url":"https://api.github.com/users/davekiss/following{/other_user}","gists_url":"https://api.github.com/users/davekiss/gists{/gist_id}","starred_url":"https://api.github.com/users/davekiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davekiss/subscriptions","organizations_url":"https://api.github.com/users/davekiss/orgs","repos_url":"https://api.github.com/users/davekiss/repos","events_url":"https://api.github.com/users/davekiss/events{/privacy}","received_events_url":"https://api.github.com/users/davekiss/received_events","type":"User","site_admin":false},"created_at":"2015-02-02T23:36:40Z","updated_at":"2015-02-02T23:36:40Z","body":"This bit me, too. I'd really like to extend from the CPT class included instead of having to write a custom endpoint only to circumvent the capability check behavior. \r\n\r\nFor me, \"published\" is different than \"public\""}}