Fixed outbox permissions for commenters and non-owner users

includes/server/actors.php

@@ -20,6 +20,14 @@ function get_actor_by_slug ( $slug ) {
     return get_actor_from_row( $row );
 }
 
+function get_actor_row_by_slug ( $slug ) {
+    global $wpdb;
+    $row = $wpdb->get_row( $wpdb->prepare(
+        "SELECT * FROM {$wpdb->prefix}pterotype_actors WHERE slug = %s", $slug
+    ) );
+    return $row;
+}
+
 function get_actor_id( $slug ) {
     global $wpdb;
     return $wpdb->get_var( $wpdb->prepare(

includes/server/api.php

@@ -69,8 +69,18 @@ function get_shares( $request ) {
     return \pterotype\shares\get_shares_collection( $object_id );
 }
 
-function user_can_post_to_outbox() {
-    return current_user_can( 'publish_posts' );
+function user_can_post_to_outbox( $request ) {
+    $actor_slug = $request->get_url_params()['actor'];
+    $actor_row = \pterotype\actors\get_actor_row_by_slug( $actor_slug );
+    if ( ! $actor_row || is_wp_error( $actor_row ) ) {
+        return false;
+    }
+    if ( $actor_row->type === 'blog' ) {
+        return \current_user_can( 'publish_posts' );
+    } else if ( $actor_row->type === 'user' ) {
+        return \is_user_logged_in();
+    }
+    return true;
 }
 
 function register_routes() {