An example of a custom permission callback

permission.php

<?php 

public function user_get_check( \WP_REST_Request $request ) {
  // To avoid CORS issue.
  if ( $request->get_method() === 'OPTIONS' ) {
    return true;
  }

  $auth_array = $request->get_headers();

  if ( ! isset( $auth_array['authorization'] ) || empty( $auth_array['authorization'] ) ) {
    return $this->error_handler( 'user_token_missing' );
  }

  $user_token_arr = array_values( array_filter( explode( 'Bearer ', $auth_array['authorization'][0] ) ) );

  $user_token = trim( $user_token_arr[0] );

  /**
   * This is a wrapper for
   *
   * wp_parse_auth_cookie( $token, 'logged_in' ) and 
   * wp_validate_auth_cookie( $token, 'logged_in' ) functions.
   */
  $token = $this->users_auth->is_auth_token_valid( $user_token );

  if ( ! $token ) {
    return $this->error_handler( 'user_token_auth_fail' );
  }

  return true;
}