User Capabilities are not available in WP REST permission callback?

Question

I want to only permit the execution of specific admin tasks for users who are

1. currently logged in to the wp admin panel (via is_user_logged_in) and who
2. have a specific capability (via current_user_can).

To do this check; I do:

register_rest_route(
                        'plugin/v1',
                        '/resource',
                        [
                            [
                                'methods'             => 'GET',
                                'permission_callback' => function ( WP_REST_Request $request ) {
                                    if(! is_user_logged_in()) { return false;}
                                    if(! current_user_can('edit_pages')) { return false;}
                            if(wp_verify_nonce($request->get_header('X-WP-Nonce'),'wp_rest') === false ) { return false; }
                                },
                                'callback'            => 'controller',
                                'args'                => $args
                            ]
                        ]
                    );

is_user_logged_in() is passed, but current_user_can fails, even if I try it with some really basic capability like edit_pages, and run the request as an Administrator user.

Interestingly, if I echo json_encode(wp_get_current_user()) in that permission callback, I can see that the caps property, supposed to represent the user's capabilities, is an empty array. So the admin user has no assigned capabilities, although he's an admin user. Anyone may know why this happens? Because, according to the docs:

Every user logged into WordPress is automatically assigned specific User capabilities depending on their User role.

This does not seem to be the case here??

Answer 1

Ok I've found the problem. The issue was indeed that I was not passing the nonce of the request in the proper way. Because, as I found in the docs:

If no nonce is provided the API will set the current user to 0, turning the request into an unauthenticated request, even if you’re logged into WordPress.

So I'm guessing that this was the actual issue. So I'm now passing a nonce via the X-WP-Nonce header, with the nonce being used being generated, also as the docs say, via:

wp_create_nonce('wp_rest');

Now, I can indeed retrieve the capabilities of the concerned Administrator user, and current_user_can() authorization within the permission_callback works.

What astonished me is that (and I'm not sure if I'm understanding that correctly); you cannot pass custom strings to wp_create_nonce when you use REST, as you can do it using the legacy wp_ajax API. The above-mentioned failed when I specified any string different from wp_rest to the value of wp_create_nonce. Just feels odd to me that the string used to generate a nonce for like 30 different REST requests MUST be the same string, always.

And finally, after current_user_can, I'm also checking the nonce via:

wp_verify_nonce(
$request->get_header('X-WP-Nonce'),
'wp_rest'
);

Just because the docs say nothing about doing this automatically if you're not using WP's built-in Javascript API. So I guessed you have to do it on your own in such a scenario, but as it seems, WP actually does it for you also in this scenario, so that part can be omitted.