Extend Woocommerce rest api routes fails

What if in your register_rest_route() call you can pass it the permission_callback option:

'permission_callback' => function () {
  return current_user_can('customer');
  // OR
  return current_user_can('shop_manager');
}

That way you are sure that you are dealing with a logged in Woocommerce user??

These are the two roles that Woocommerce is adding to your site. https://docs.woocommerce.com/document/roles-capabilities/

I know it’s not answering your question directly, but I hope this helps! If I am way off, I can take the answer down.