feat(users): govern profiles and access

Normalize fixed profile fields, profile actions, and the five-column capability matrix for comments, uploads, and downloads.
2026-08-13 00:24:54 +08:00
parent 0b06b2c7df
commit 8241570ca2
67 changed files with 780 additions and 1127 deletions
@@ -266,6 +266,15 @@ class CommentActions {
            ], 403);
        }

+        $user_id = get_current_user_id();
+        if (!function_exists('aksrt_user_can') || !aksrt_user_can('comment_add', $user_id, $post_id)) {
+            return new \WP_REST_Response([
+                'success' => false,
+                'code'    => 'comment_forbidden',
+                'message' => __('当前账号没有发表评论的权限。', 'aksrt'),
+            ], $user_id > 0 ? 403 : 401);
+        }
+
        $nonce = (string) ($params['_aksrt_comment_nonce'] ?? $params['_wpnonce'] ?? '');
        if ($nonce !== '' && !wp_verify_nonce($nonce, 'aksrt_comment_nonce') && !wp_verify_nonce($nonce, 'wp_rest')) {
            return new \WP_REST_Response([