superpowers-sage:wp-capabilities

WordPress role-based authorization translates user roles into capabilities and meta-capabilities for protected resources. You register CPTs with correct capability_type and map_meta_cap, assign derived capabilities to roles on activation, and enforce runtime checks using current_user_can within permission callbacks.

The map_meta_cap mechanism dynamically translates meta-capabilities into primitive capabilities for protected resources. It allows WordPress to evaluate permissions contextually, mapping high-level actions like edit_post into specific capabilities such as edit_projects based on custom post type registration settings.

Yes, Sage/Acorn development supports bridging WordPress authorization to Laravel-style Gates and Policies. You can wire JWT middleware guards alongside WordPress current_user_can checks, ensuring the WP current user context is set correctly before evaluating route-level permissions.

Securing WordPress REST API routes involves applying role-based authorization through permission callbacks. You enforce current_user_can checks with the correct capability name for each protected action, optionally wrapping the logic in Acorn Gate or Policy middleware for structured access control.

Yes, custom post type capabilities must be granted to roles once during plugin or theme activation. After registering CPTs with map_meta_cap, you programmatically assign the resulting capabilities, such as edit_projects or publish_projects, to the appropriate user roles to enable proper access control.

REST permission callbacks fail when CPT registration lacks correct capability_type and map_meta_cap settings, or when capabilities are not properly assigned to roles. Verify your setup using WP-CLI role and capability lists, and perform runtime audits to confirm current_user_can checks behave as expected.