2.0.0

A major release: a route that declares no permission is refused.

Changed

• A route without a permission is refused (rest_forbidden, 401 for a visitor, 403 for a logged-in user). Until now it stayed public and called _doing_it_wrong(). Declare permissionCallback: Everyone::class on the routes that are public on purpose, or a permission such as IsLoggedIn
• The pollora/wp-rest/private_by_default filter now defaults to true. Return false to keep the routes without a permission public while a site migrates; WordPress is then told, with WP_DEBUG, which route to fix

Removed

• The pollora/wp_rest/private_by_default filter name and the WpRestRouteRegistrar::PRIVATE_BY_DEFAULT constant, deprecated since 0.2.1. Use pollora/wp-rest/private_by_default

v0.2.1

The private-by-default filter is now pollora/wp-rest/private_by_default; the pollora/wp_rest/private_by_default name of 0.2.0 still works and is reported as deprecated. See CHANGELOG.md.

v0.2.0

See CHANGELOG.md: Everyone permission, pollora/wp_rest/private_by_default filter, deprecation of routes without a permission.

v0.1.0

A first version for the framework's next release to build on; 1.0.0 comes with that release.

Added

• First release, extracted from pollora/framework (src/WpRest) with its history. Class names are unchanged: Pollora\WpRest\*, and Pollora\Support\WpGlobals
• Runs without Laravel's application: controllers are built by the discovery's instance resolver, with their constructor dependencies, and custom HandlesAttributes attributes get the PSR-11 container given to WpRestDiscovery. An architecture test keeps the package to the attributes, discovery, PSR contracts and WordPress