Blocking SOME but not all endpoints in Wordpress rest api - endpoint

Question

I am creating a REACT app that uses wordpress as a backend through the rest API. I am using the Simple-JWT-Login plugin to handle the register, login, authentication, and it works perfectly.
I want to block non-logged in users from accessing the /wp/v2/posts endpoint. I know I can do this by doing something like:
add_filter( 'rest_authentication_errors', function( $result ) {
if ( ! empty( $result ) ) {
return $result;
}
if ( ! is_user_logged_in() ) {
return new WP_Error( 'rest_not_logged_in', 'You are not currently logged in.', array( 'status' => 401 ) );
}
if ( ! current_user_can( 'edit_posts' ) ) {
return new WP_Error( 'rest_not_admin', 'You are not entitled to view that.', array( 'status' => 401 ) );
}
return $result;
});
However that blocks all endpoints, including ?rest_route=/simple-jwt-login/v1/auth and ?rest_route=/simple-jwt-login/v1/users which are the ones from the Simple-JWT-Login plugin used for registering and authenticating users. Therefore users end up in a catch 22 whereby they can't login unless they are already logged in!
Is there a way of modifying the above code to block just the wp/v2/posts/ endpoint, or, alternatively, of effectively whitelisting the registering and authenticating endpoints?
Many thanks for any ideas!
Have searched on here and elsewhere but can't find a solution.

Answer 1

You could always check for the url before showing the error with $_SERVER['REQUEST_URI'] but that might become a pain to add all your allowed urls in a if check.
I like to use apache_request_headers with preg_match to check for a Bearer Token and if the current request has the correct bearer token, show the results. Otherwise you would throw a error. I can't guarantee its 100% safe or the correct way to do it but it works pretty well for a super basic simple system.
Something like the below code might work for someone:
add_filter("rest_authentication_errors", function ($result) {
if (!empty($result)) {
return $result;
}
$headers = apache_request_headers();
$matches = array();
$currentToken = "PUT YOUR BEARER TOKEN HERE";
$pattern = $currentToken."/i";
preg_match('/Bearer '. $pattern, $headers['Authorization'], $matches);
if(isset($matches)){
$token = $matches[0];
if($token == 'Bearer ' . $currentToken){
return $result;
} else {
return new WP_Error( 'no_auth_found', 'You are not currently logged in.' , array( 'status' => 401));
}
}
});