Hype5 Theater 0.6.17 · Pre-release
Roles and capabilities
On this page
Hype5 Theater controls access with its own WordPress capabilities and adds one role, Theater Manager. Every screen, REST route and save in the plugin — classic screens and the Hype5 app alike — checks these capabilities; switching the app on for a user never grants any. This page lists the role and each capability as registered in code, and where each one is used.
The Theater Manager role
| Role | Slug | Capabilities |
|---|---|---|
| Theater Manager (Teatri haldur) | hype5t_manager |
read, upload_files and all 33 Hype5 capabilities below |
The Administrator role receives the same 33 capabilities plus upload_files and read. No other role (Editor, Author and so on) receives Hype5 capabilities; grant them with code or a role-management plugin if needed.
The capabilities are added on activation and again whenever the plugin version changes (on the next admin page load by a user with manage_options). Deactivating or removing the plugin does not remove the role or the capabilities.
A Theater Manager does not have manage_options, so Appearance and the content-type option lists are not available to that role by default.
Hype5 capabilities
General
| Capability | Allows |
|---|---|
manage_hype5t_settings |
Settings, Add-ons, System Status; managing vocabulary terms (add, edit, pause, delete genres, audience recommendations, warnings, professions). |
manage_hype5t_performances |
The schedule: listing, creating, editing, bulk actions and deleting performances (classic Schedule screen and the app's Schedule). |
manage_hype5t_credits |
Changing credits and information rows. Without it, credits are read-only. Credit edits also need permission to edit the production. |
Content types
The post types use capability_type [hype5t_production, hype5t_productions], [hype5t_person, hype5t_persons] and [hype5t_venue, hype5t_venues] with map_meta_cap. For each plural — hype5t_productions, hype5t_persons, hype5t_venues — these ten capabilities are registered:
edit_, edit_others_, edit_private_, edit_published_, publish_, read_private_, delete_, delete_private_, delete_published_, delete_others_
for example edit_hype5t_productions, publish_hype5t_persons, delete_others_hype5t_venues. WordPress maps the meta capabilities (edit_post, delete_post, read_post, publish_post) to them as for any post type; creating a record uses the type's edit_ capability.
Taxonomies
| Taxonomy | Manage, edit, delete terms | Assign terms |
|---|---|---|
hype5t_genre, hype5t_audience, hype5t_warning |
manage_hype5t_settings |
edit_hype5t_productions |
hype5t_profession |
manage_hype5t_settings |
edit_hype5t_persons |
WordPress capabilities the plugin checks
| Capability | Used for |
|---|---|
manage_options |
Appearance (classic and app); content-type option lists; settings-related Getting started steps; running database updates and refreshing capabilities. |
edit_css |
Changing custom CSS. In WordPress this maps to unfiltered_html: unavailable when DISALLOW_UNFILTERED_HTML is set, and limited to super admins on multisite. |
upload_files |
Adding images and files from the media library, and tagging people in gallery images (which also needs read access to the person). |
The Hype5 app
A user can open the app when it is enabled for them and they have at least one of edit_hype5t_productions, edit_hype5t_persons, manage_hype5t_performances or edit_hype5t_venues. For such a user Hype5 Theater in the WordPress sidebar is a single entry that opens the app; everyone else keeps the classic menu, with each item under the capability listed above. Inside the app:
| Screen | Needs |
|---|---|
| Overview | access to the app; each part follows the capabilities above |
| Productions | edit_hype5t_productions (each production: edit_post) |
| Credits (Meeskond) | manage_hype5t_credits to change |
| Publishing panel | the type's publish_ capability to publish, schedule, make private or set a password |
| People | edit_hype5t_persons |
| Schedule | manage_hype5t_performances (a production's performance list is readable with edit_post on the production) |
| Venues | edit_hype5t_venues |
| Appearance | manage_options; custom CSS edit_css |
| Vocabularies | taxonomy capabilities; content types manage_options |
| Settings | manage_hype5t_settings |
Records a user may not read are never named in lists or usage counts; they are counted at most.
Enabling the app
The app is enabled with the HYPE5_THEATER_FUAJEE constant (all users who have the capabilities) or the hype5t_fuajee_testers option (the access list of user IDs), and can be adjusted per user with the hype5_theater_fuajee_enabled filter. See The Hype5 app. Enabling it for everyone with a Hype5 capability without the list or the constant is a pending rollout decision.
A user whose only Hype5 capability is manage_hype5t_settings or a vocabulary capability cannot open the app (it opens with a production, person, schedule or venue capability) and keeps the classic Settings, Add-ons, System Status and Vocabularies screens in the classic menu.
The classic screens keep their capabilities when they are not in the menu: WordPress checks each one against its own capability, so a hidden screen is never easier to open than before.