Updating and reorganizing CAP tweaks

[leogermani]

All Submissions:

• Have you followed the Newspack Contributing guideline?
• Does your code follow the WordPress' coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Improves our implementation of an alternative to CAP Guest Authors.

How to test the changes in this Pull Request:

1. Checkout this branch
2. Add define( 'NEWSPACK_DISABLE_CAP_GUEST_AUTHORS', true ); to wp-config
3. Visit Users > Guest Authors and see the replacement page
4. Click Add new Guest Author and confirm you see the regular form to add a new user but with some modifications (no username, no password)
5. Create a user and confirm you can assign it as coauthor
6. Confirm you can not login as this user
7. Confirm the edit page for this user does not have a bunch of fields (username, password, application password, woo fields, profile colors, etc)
8. @adekbadek confirm that this transitions well from a site using the previous approach. (the user role has the same slug and the capability is no longer checked)

-- test author cap ---

Add the edit_cap_posts capability to a subscribe user and confirm you can assign them as coauthors. Remove the capability and make sure you no longer can.

Make sure all other roles that can edit posts still can be assigned as coauthors.

-- test user account deletion --

Login as subscriber with the special cap and try to delete its account. Confirm you get a message saying you can't

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully ran tests with your changes locally?

[adekbadek]

I like how this improves what's proposed in #3233 and the blocking of the account deletion request. The login blocking and role name changes are not needed here.

[adekbadek]

This role is called "Non-Editing Contributor" now, it was already communicated as such to our publishers. It's intentionally different than "Guest Authors" to underline that it's something else than CoAuthors-Plus' Guest Authors. Someone used to creating Guest Authors should be directed to use this new feature instead, not confused by the familiar label cropping up in a different place.

[leogermani]

I understand that, and the change here was also intentional.

The new overridden Guest Authors page point the user to use the Guest Authors role instead, so this change makes it consistent.

We are actually moving a feature the user knows from one place to another. Guest Authors used to live here, and now it lives there, but it's the same thing.

What could/should be called "Non-Editing Contributors" are users that have another "non editor" role but are cherry picked to be able to assigned as co authors (get the custom capability). Maybe we could add a section in their user profile to allow admins to grand this capability without the need of third-party plugins.

But these are just names. If you want we can keep the name and discuss it further. We just need to also change it in the new Guest Authors page replacement

[adekbadek]

Why shouldn't these users be allowed to log in? The goal of the original implementation, in line with the requirements, was to allow any user to become assignable to posts. Many sites have users who are subscribers (should be able to manage their subscriptions), but they've contributed to an article and are listed as authors. They should still be able to log in and manage their subscriptions. The only thing they should not be able to do is editing posts.

[leogermani]

We are blocking the users with this role from logging in, just as we are not event allowing a password to be set.

User with the custom capability that allows them to be assigned as co authors can still login. They are not affected.

[adekbadek]

User with the custom capability that allows them to be assigned as co authors can still login.

But users with multiple roles (e.g. subscriber,contributor_no_edit) won't be able to log in, and should.

[adekbadek]

Should have asked earlier – the testing instructions state:

Add the edit_cap_posts capability to a subscribe user

How to do it in WP Admin UI, as a "non-technical user"?

[leogermani]

Should have asked earlier – the testing instructions state:

Add the edit_cap_posts capability to a subscribe user

How to do it in WP Admin UI, as a "non-technical user"?

Using a plugin that manages roles and capabilities.

But as I said I think we should add an option in the edit user screen.

[adekbadek]

Using a plugin that manages roles and capabilities.

I'm using capability-manager-enhanced for role-related stuff. Can't see any option to add a capability to a single user. Capabilities can only be added to roles with this plugin. Can you recommend a plugin to achieve that goal?

Another issue with this approach is that it makes it impossible for the publisher to see which users are assignable to posts in the WP Admin Users view. It can be filtered by roles, but not by capabilities.

[leogermani]

closed in favor of #3277 See pemhSX-Sz-p2