Understanding user capabilities
Capabilities can be considered as tasks that users are permitted to perform inside the application. A single user role can perform many capabilities, while a single capability can be performed by many user roles. Typically, we use the term access control for handling capabilities in web applications. Let's see how capabilities work inside WordPress.
Creating your first capability
Capabilities are always associated with user roles, and hence we cannot create new capabilities without providing a user role. Let's look at the following code for associating a custom capability with a follower user role created in the Creating user roles for a application section:
public function add_application_user_capabilities(){
$role = get_role( 'follower' );
$role->add_cap( 'follow_developer_activities' );
}
First, we need to retrieve the user role as an object using the get_role function. Then, we can associate a new or existing capability using the add_cap function. We need to continue this process for each user role until we assign all the capabilities to necessary user levels. Also, make sure to call this function on activation with the register_activation_hook function.
Understanding default capabilities
You can find over fifty built-in capabilities in the WordPress default database. Most of these capabilities are focused on providing permissions related to website or blog creation. Therefore, it's a must to create our own capabilities when developing web applications. If you are curious to learn, you can look at the wp_user_roles option inside the wp_options table for all the available user roles and their capabilities.
select option_value from wp_users where option_name='wp_user_roles'
You should see a serialized array like the following:
a:10:{s:13:"administrator";a:2:{s:4:"name";s:13:"Administrator";s:12:"capabilities";a:67:{s:13:"switch_themes";b:1;s:11:"edit_themes";b:1;s:16:"activate_plugins";b:1;s:12:"edit_plugins";b:1;s:10:"edit_users";b:1;s:10:"edit_files";b:1;s:14:"manage_options";b:1;s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12
A part of the value contained in the wp_user_roles row is displayed in the preceding code. It's quite confusing and not practical to understand the capabilities of each user role by looking at this serialized array. Therefore, we can take advantage of an existing WordPress plugin to view and manage user roles and capabilities.
There are plenty of great and free plugins for managing user roles and permissions. My favorite is the Members plugin by Justin Tadlock, as it's quite clean and simple. You can grab a copy of this plugin at http://wordpress.org/plugins/members/.
Let's see how capabilities are displayed for the follower role in our application using the following screenshot of the plugin:
All the capabilities that are assigned to specific user roles will be ticked by default. As expected, the follow_developer_activities capability added in the previous section is successfully assigned to the follower role.
Up to now, we have learned how to use WordPress roles and capabilities in the context of web applications. We will be updating the capabilities while creating new functionalities in the upcoming chapters. Next, we are going to see how user registration works in WordPress.