The REST route that needed a permission callback and had one

A route with a permission callback that returned true for any logged-in user, on an endpoint that returned other people’s orders.

// what it was
'permission_callback' => 'is_user_logged_in',

// which is a permission callback, satisfies the notice,
// and authorises nothing.

// what it is
'permission_callback' => function ( WP_REST_Request $r ) {
    $order = turkerdev_find_order( $r['id'] );

    return $order && current_user_can( 'view_order', $order->id );
},

The absence of a permission callback produces a notice and the presence of a useless one does not, which means the check everybody runs — does every route have a callback — passes on a codebase with this bug. Reviewing what each callback actually asserts is a different exercise and found two more, both of which had been written to silence the notice.