In the Developing WordPress User Roles and Capabilities tutorial, you learned how to create and apply user roles, how to add/remove capabilities from a user role, and how to check user capabilities. In this tutorial, you will learn about the built-in support for capabilities when you register a custom post type, and how you can refine these capabilities to suit your specific requirements.

1. Confidential Customized for Lorem Ipsum LLC Version 1.0
Jonathan Bossenger
Custom Post Types and Capabilities
Learn.WordPress.org

2. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
What you will learn
1. How to restrict access to custom post types via capabilities?
2. How are capabilities assigned to a custom post type and how to manage them?
3. How to assign custom post type capabilities to existing or new roles?

3. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
Project requirements - develop a custom
plugin
● Create a custom post type to manage stories.
● Writers can only create, edit, and delete unpublished stories.
● Writers can publish their stories, but not edit or delete stories once published.
● Site administrators can create, edit, and delete any and all stories.

4. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
Meta Capabilities and Primitive Capabilities
1. Meta capabilities are mapped to primitive capabilities
2. Meta capabilities: edit_post, read_post, delete_post
3. Mapped to primitive capabilities like edit_posts and edit_others posts
4. Meta capabilities are not generally added to roles

5. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
Meta Capabilities and Primitive Capabilities
1. Two types of primitive capabilities
a. Primitive capabilities that are automatically mapped
b. Primitive capabilities that are NOT automatically mapped

6. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
The map_meta_cap() function
1. It’s used whenever the current_user_can() function is called.
2. It maps a capability to the primitive capabilities required of the given user to
satisfy the capability being checked, based on the context of the check.
3. It does not check whether the user has the required capabilities, it just returns
what the required capabilities are.

7. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
Writer role capabilities
1. Automatically mapped primitive capabilities
a. edit_stories, delete_stories, publish_stories, read_private_stories
2. Primitive capabilities mapped inside map_meta_cap:
a. read, delete_private_stories, edit_private_stories,

8. Confidential Customized for Lorem Ipsum LLC Version 1.0
Learn.WordPress.org
Developing custom post type capabilities
1. Set the correct capability_type(s)
2. Use either the capabilities argument or the map_meta_cap argument
3. Either update an existing role, or create a new custom role, and assign the
relevant capabilities needed
4. Always to set up and remove roles and or capabilities inside activation hook
and deactivation hook callbacks