br-resource-table

better-route: custom-table Resource CRUD

Custom tables have no WordPress visibility model, so all actions deny by default until an explicit policy is supplied.

use BetterRoute\Resource\Resource;
use BetterRoute\Resource\ResourcePolicy;

add_action('rest_api_init', static function (): void {
    global $wpdb;

    Resource::make('audit-events')
        ->restNamespace('myapp/v1')
        ->sourceTable($wpdb->prefix . 'myapp_audit_events', 'id')
        ->allow(['list', 'get'])
        ->fields(['id', 'event_type', 'user_id', 'created_at'])
        ->filters(['event_type', 'user_id'])
        ->filterSchema(['user_id' => 'int'])
        ->sort(['created_at', 'id'])
        ->policy(ResourcePolicy::adminOnly('manage_options'))
        ->register();
});

Do not pass a Router to register(). The optional argument is a dispatcher for tests/custom integration.

Required configuration

• Set restNamespace('vendor/version').
• Set exactly one of sourceTable() or sourceCpt(); 1.1 rejects both.
• Set a non-empty fields() list for table resources.
• Set a policy. Without it, list/get/create/update/delete all return 403.

Omitting allow() registers full CRUD. allow([]) registers no routes. Invalid action names throw. update creates both PUT and PATCH routes.

Table name and primary key

WpdbAdapter accepts either the current full prefixed table name or an unprefixed suffix. When the supplied name does not start with current $wpdb->prefix, the adapter prepends it. Prefer the explicit multisite-safe form:

->sourceTable($wpdb->prefix . 'myapp_events', 'event_id')

Do not pass a different database/table qualified name; . is rejected. Identifiers must be simple SQL identifiers.

The second argument is the database primary-key column. The generated WordPress route uses /(?P<id>\d+); its id value maps to that column, while OpenAPI renders the parameter as {id}.

Sorting and pagination

sort() is an allowlist of field names; it does not set a default direction: