User roles and permissions in Wordpress - Step-by-Step Execution

Concept Flow - User roles and permissions

Define Roles

↓

Assign Capabilities

↓

Create Users

↓

Assign Roles to Users

↓

User Logs In

↓

Check User Role & Permissions

↓

Allow or Deny Actions

This flow shows how WordPress defines roles, assigns capabilities, creates users, and checks permissions when users perform actions.

Execution Sample

Wordpress

<?php
// Add a custom role
add_role('custom_editor', 'Custom Editor', ['edit_posts' => true, 'delete_posts' => false]);

// Assign role to user
$user = new WP_User($user_id);
$user->set_role('custom_editor');

// Check capability
if(current_user_can('edit_posts')) {
  // Allow editing
}

This code adds a custom role, assigns it to a user, and checks if the user can edit posts.

Execution Table

Step	Action	Role/Capability State	User Role	Permission Check	Result
1	Define 'custom_editor' role with 'edit_posts' capability	Roles: custom_editor(edit_posts: true, delete_posts: false)	None	N/A	Role created
2	Create user object for user_id	Roles unchanged	None	N/A	User object ready
3	Assign 'custom_editor' role to user	Roles unchanged	custom_editor	N/A	User role set
4	User tries to edit post	Roles unchanged	custom_editor	Check 'edit_posts'	Allowed (true)
5	User tries to delete post	Roles unchanged	custom_editor	Check 'delete_posts'	Denied (false)
6	User tries to publish post (not assigned)	Roles unchanged	custom_editor	Check 'publish_posts'	Denied (false)

💡 Permissions checked for user actions; allowed or denied based on role capabilities.

Variable Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	After Step 5	Final
Roles	None	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}
User Role	None	None	custom_editor	custom_editor	custom_editor	custom_editor
Permission Check	N/A	N/A	N/A	edit_posts: true	delete_posts: false	publish_posts: false

Key Moments - 3 Insights

Why can the user edit posts but not delete them?

Because the 'custom_editor' role has 'edit_posts' set to true but 'delete_posts' set to false, as shown in execution_table rows 4 and 5.

What happens if a capability is not assigned to a role?

The capability defaults to false, so the user cannot perform that action, as seen in step 6 where 'publish_posts' is not assigned.

Does assigning a role to a user change the role's capabilities?

No, assigning a role to a user only links the user to that role; the role's capabilities remain unchanged (see variable_tracker for Roles).

Visual Quiz - 3 Questions

Look at the execution_table at step 4. What permission does the user have?

A Can edit posts

B Can delete posts

C Can publish posts

D No permissions

💡 Hint

Check the 'Permission Check' and 'Result' columns at step 4 in execution_table.

At which step is the user assigned the 'custom_editor' role?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'User Role' column in execution_table to see when it changes from None.

If 'delete_posts' was set to true in the role, what would change in the execution_table?

A Step 4 result would be Denied

B Step 5 result would be Allowed

C User role would change

D No change

💡 Hint

Compare the 'Permission Check' and 'Result' columns for step 5.

Concept Snapshot

WordPress User Roles & Permissions:
- Roles group capabilities (actions users can do).
- Assign roles to users to grant permissions.
- Use add_role() to create roles with capabilities.
- Use current_user_can() to check permissions.
- Unassigned capabilities default to denied.

Full Transcript

In WordPress, user roles define what actions users can perform by grouping capabilities. First, roles are created with specific capabilities like editing or deleting posts. Then, users are assigned these roles. When a user tries to do something, WordPress checks if their role has the needed capability. If yes, the action is allowed; if not, it is denied. This system helps control access easily by managing roles instead of individual permissions for each user.