Hype5 Theater 0.7.0 · Beta — by invitation
Roles and capabilities
On this page
Hype5 Theater controls access with its own WordPress capabilities and adds one role, Theater Manager. Every screen, REST route and save in the plugin — classic screens and the Hype5 app alike — checks these capabilities; switching the app on for a user never grants any. This page lists the role and each capability as registered in code, and where each one is used.
The Theater Manager role
| Role | Slug | Capabilities |
|---|---|---|
| Theater Manager (Teatri haldur) | hype5t_manager |
read, upload_files and all 33 Hype5 capabilities below |
The Administrator role receives the same 33 capabilities plus upload_files and read. No other role (Editor, Author and so on) receives Hype5 capabilities; grant them with code or a role-management plugin if needed.
The capabilities are added on activation. When the plugin version changes (on the next admin page load by a user with manage_options), only capabilities that the plugin has not granted before are added (Theater 0.7.0; recorded in the hype5t_caps_granted option): a capability you removed from Administrator or Theater Manager is not given back, and a capability explicitly denied on the role is never overwritten. The Theater Manager role is created when the plugin installs its capabilities on a site for the first time; a role you deleted is not recreated — also not when the plugin is deactivated and activated again (to get it back, add it with code, or delete the hype5t_caps_version and hype5t_caps_granted options before activating, which grants the full set again). Deactivating or removing the plugin does not remove the role or the capabilities. (Until 0.6.17 every version change re-added the full set — so rolling back to a 0.6.x version gives the full set back to both roles, including capabilities you removed or denied, and recreates a deleted Theater Manager role; check the roles after such a rollback.)
A Theater Manager does not have manage_options, so Appearance and the content-type option lists are not available to that role by default.
Hype5 capabilities
General
| Capability | Allows |
|---|---|
manage_hype5t_settings |
Settings, Add-ons, System Status; managing vocabulary terms (add, edit, pause, delete genres, audience recommendations, warnings, professions). |
manage_hype5t_performances |
The schedule: listing, creating, editing, bulk actions and deleting performances (classic Schedule screen and the app's Schedule). |
manage_hype5t_credits |
Changing credits and information rows. Without it, credits are read-only. Credit edits also need permission to edit the production. |
Content types
The post types use capability_type [hype5t_production, hype5t_productions], [hype5t_person, hype5t_persons] and [hype5t_venue, hype5t_venues] with map_meta_cap. For each plural — hype5t_productions, hype5t_persons, hype5t_venues — these ten capabilities are registered:
edit_, edit_others_, edit_private_, edit_published_, publish_, read_private_, delete_, delete_private_, delete_published_, delete_others_
for example edit_hype5t_productions, publish_hype5t_persons, delete_others_hype5t_venues. WordPress maps the meta capabilities (edit_post, delete_post, read_post, publish_post) to them as for any post type; creating a record uses the type's edit_ capability.
Taxonomies
| Taxonomy | Manage, edit, delete terms | Assign terms |
|---|---|---|
hype5t_genre, hype5t_audience, hype5t_warning |
manage_hype5t_settings |
edit_hype5t_productions |
hype5t_profession |
manage_hype5t_settings |
edit_hype5t_persons |
WordPress capabilities the plugin checks
| Capability | Used for |
|---|---|
manage_options |
Appearance (classic and app); content-type option lists; settings-related Getting started steps; running database updates and refreshing capabilities. |
edit_css |
Changing custom CSS. In WordPress this maps to unfiltered_html: unavailable when DISALLOW_UNFILTERED_HTML is set, and limited to super admins on multisite. |
upload_files |
Adding images and files from the media library, and tagging people in gallery images (which also needs read access to the person). |
The Hype5 app
A user can open the app when they have at least one of edit_hype5t_productions, edit_hype5t_persons, edit_hype5t_venues, manage_hype5t_performances, manage_hype5t_settings, manage_options or a vocabulary (taxonomy) capability — the capabilities of the classic Hype5 Theater screens (Theater 0.7.0). For such a user Hype5 Theater in the WordPress sidebar is a single entry that opens the app. Every request of the app (/hype5-theater/v1/app/*) is refused at its gate for users without one of these capabilities, and then checks the capability of its own screen. Inside the app:
| Screen | Needs |
|---|---|
| Overview | access to the app; each part follows the capabilities above |
| Productions | edit_hype5t_productions (each production: edit_post) |
| Credits (Meeskond) | manage_hype5t_credits to change |
| Publishing panel | the type's publish_ capability to publish, schedule, make private or set a password |
| People | edit_hype5t_persons |
| Schedule | manage_hype5t_performances (a production's performance list is readable with edit_post on the production) |
| Venues | edit_hype5t_venues |
| Appearance | manage_options; custom CSS edit_css |
| Vocabularies | taxonomy capabilities; content types manage_options |
| Settings | manage_hype5t_settings |
Records a user may not read are never named in lists or usage counts; they are counted at most.
Switching the app off
The app is on for everyone with the capabilities above. define('HYPE5_THEATER_FUAJEE', false); switches it off for everyone (the classic menu returns), and the hype5_theater_fuajee_enabled filter (bool $enabled, int $user_id) can switch it off or on per user; neither grants a capability. The 0.6 access list (hype5t_fuajee_testers) is no longer read. See The Hype5 app.
A user whose only Hype5 capability is manage_hype5t_credits has no Hype5 screen (credits are edited inside a production, which needs edit_hype5t_productions), so they get neither the app nor a classic menu.
The classic screens keep their capabilities when they are not in the menu: WordPress checks each one against its own capability, so a hidden screen is never easier to open than before.