function hw_pos_rest_guard(WP_REST_Request $request) { $secret_expected = hw_pos_get_env('HW_POS_SECRET'); $secret_got = (string) $request->get_header('x-hw-pos-secret'); if (!$secret_expected) { return new WP_Error( 'hw_pos_secret_not_configured', 'HW_POS_SECRET not configured on WordPress', ['status' => 500] ); } if ($secret_got === '' || !hash_equals($secret_expected, $secret_got)) { return new WP_Error( 'hw_pos_secret_invalid', 'X-HW-POS-SECRET missing/invalid', ['status' => 403] ); } $uid = get_current_user_id(); if (!$uid) { return new WP_Error( 'hw_pos_auth_missing', 'WP Basic Auth missing/invalid (Application Password)', ['status' => 401] ); } if ( !current_user_can('manage_woocommerce') && !current_user_can('edit_shop_orders') && !current_user_can('manage_options') ) { $u = wp_get_current_user(); return new WP_Error( 'hw_pos_capability_missing', 'WP user authenticated but lacks capability', [ 'status' => 403, 'user' => $u ? $u->user_login : null, 'roles' => $u ? $u->roles : [], ] ); } return true; }