Update permission callback to check user capability

inc/REST/RemoteDataController.php

@@ -78,7 +78,8 @@ public static function execute_queries( WP_REST_Request $request ): array|WP_Err
 		);
 	}
 
-	public static function permission_callback(): bool {
-		return true;
+	public static function permission_callback( WP_REST_Request $request ): bool {
+		$post_id = $request->get_param( 'post_id' );
+		return current_user_can( 'edit_post', $post_id );
 	}
 }

src/blocks/remote-data-container/hooks/useRemoteData.ts

@@ -1,4 +1,6 @@
 import apiFetch from '@wordpress/api-fetch';
+import { select } from '@wordpress/data';
+import { store as editorStore } from '@wordpress/editor';
 import { useEffect, useState } from '@wordpress/element';
 
 import { REMOTE_DATA_REST_API_URL } from '@/blocks/remote-data-container/config/constants';
@@ -177,6 +179,9 @@ export function useRemoteData( {
 	}
 
 	async function fetch( inputs: RemoteDataQueryInput[] ): Promise< void > {
+		const { getCurrentPostId } = select( editorStore );
+		const postId = getCurrentPostId();
+
 		// If there are no inputs, there is nothing to fetch. Empty query inputs
 		// must be represented by an empty object, e.g. `[ {} ]`.
 		if ( 0 === inputs.length ) {
@@ -194,6 +199,7 @@ export function useRemoteData( {
 			block_name: blockName,
 			query_key: queryKey,
 			query_inputs: inputs,
+			post_id: postId ?? null,
 		};
 
 		try {

types/remote-data.d.ts

@@ -97,6 +97,7 @@ interface RemoteDataApiRequest {
 	block_name: string;
 	query_inputs: RemoteDataQueryInput[];
 	query_key: string;
+	post_id: ?( number | string );
 }
 
 interface RemoteDataApiResult {