API / Minn\Auth / Capabilities

Capabilities final readonly class

Minn\Auth\Capabilities · public/minn/src/Minn/Auth/Capabilities.php · 277 lines

The capability engine: a user's roles from {prefix}capabilities usermeta, what those roles and the user's own capabilities grant, and the meta-capability mapping for edit_post, delete_post, and read_post.

Constants and properties

private	`readonly Minn\Db $db`	Promoted from the constructor.
private	`readonly Minn\Content\Users $users`	Promoted from the constructor.
private	`readonly Minn\Auth\Roles $roles`	Promoted from the constructor.

Public

new	`__construct(Minn\Db $db, Minn\Content\Users $users, Minn\Auth\Roles $roles)`#
static	`fromDb(Minn\Db $db): self`#	The capability engine over the shared database door.
method	`roles(): Minn\Auth\Roles`#	The role definitions.
method	`capsOf(int $userId): array`#	The capabilities stored on the user, as stored: role names and the capabilities granted (or taken away) one by one. `@return array<string, mixed>`
method	`rolesOf(int $userId): array`#	The role slugs a user holds: each stored capability that names a registered role, whatever it is set to (probe: the reference counts 'editor' => false as a role). One a plugin granted but never registered does not count. `@return list<string> role slugs`
method	`allcapsOf(int $userId): array`#	Everything a user holds, as the reference's allcaps: each role's capabilities in turn, then the user's own over them, role names included, so a capability taken away one by one stays away and current_user_can('administrator') is true for an administrator. Values are as stored. `@return array<string, mixed>`
method	`can(int $userId, string $capability, ?int $postId = NULL): bool`#	Does the user hold every primitive the (possibly meta) capability maps to?
method	`map(string $capability, int $userId, ?int $postId = NULL): array`#	The primitives a capability requires, all of which must be held. `@return list<string>`

Internals 7

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private

fileModsAllowed(string $context): bool#

Whether file changes are allowed for a capability check, as wp_is_file_mod_allowed() answers: DISALLOW_FILE_MODS, through file_mod_allowed with the check's context.

private

mapMore(string $capability, int $userId, ?int $objectId): array#

The rest of the reference's meta capabilities (captured with map_meta_cap for an administrator, an editor and an author): each names the primitive that decides it, refuses outright, or maps through the object it is about. A name it does not know is its own primitive.

@return list<string>

private

mapCommentCapability(int $userId, int $commentId): array#

A comment is edited as its post is (as editing posts, when the post is gone); a comment that does not exist, by no one. @return list<string>

@return list<string>

private

mapPostCapability(string $capability, int $userId, int $postId): array#

A post's meta capability as the reference maps it (probe post-caps): read_post needs read for a published post or one's own, the private read for a private one, and what editing needs for anything else (future, draft, pending, trash). Editing or deleting one's own post needs the published capability while it is published or scheduled (or was, before the trash), the plain one otherwise; someone else's, the others capability, with the published one while it is published or scheduled and the private one while it is private. The privacy policy page needs manage_options as well.

@return list<string>

private

mapTermCapability(string $capability, int $userId, ?int $termId): ?array#

A term capability on a plugin's taxonomy as the reference maps it (probe rest-plugin-caps): the taxonomy's own name for it (edit_terms, delete_terms, assign_terms), mapped in turn; nothing for a term that does not exist or a default term's deletion (in any taxonomy). Null otherwise for the built-in taxonomies, whose mapping is fixed.

@return list<string>|null

private

fold(string $type, array $required): array#

$required list<string>

@return list<string>

private trashedFrom(int $postId): string#