Permissions and Abilities

SnipShare manages permissions through the WordPress Abilities API, with a role-based fallback via the user_has_cap filter so the same model works even on WordPress versions that do not ship the Abilities API.

Registered abilities

SnipShare registers one ability category (snipshare) and five abilities:

Ability	Grants	Default roles
snipshare/create-paste	Create new pastes	Administrator, Editor, Author, Contributor, Subscriber
snipshare/fork-paste	Fork other users’ pastes	Administrator, Editor, Author, Contributor, Subscriber
snipshare/manage-paste	Edit and delete own pastes	Administrator, Editor, Author, Contributor, Subscriber
snipshare/moderate	Review reports and trash any paste	Administrator, Editor
snipshare/create-collection	Create and manage collections	Administrator, Editor, Author, Contributor

Each ability is exposed to the REST API (show_in_rest).

How editing and deleting are decided

• A moderator (holds snipshare/moderate) may edit or delete any paste.
• An owner may edit or delete their own paste when they hold snipshare/manage-paste.

Delete permission follows the same rule as edit permission.

Checking permissions in code

Use the static helpers on SnipShare_Abilities rather than raw user_can() calls:

SnipShare_Abilities::can_create_paste( $user_id );
SnipShare_Abilities::can_fork_paste( $user_id );
SnipShare_Abilities::can_manage_paste( $user_id );
SnipShare_Abilities::can_moderate( $user_id );
SnipShare_Abilities::can_create_collection( $user_id );
SnipShare_Abilities::can_edit_paste( $paste, $user_id );
SnipShare_Abilities::can_delete_paste( $paste, $user_id );

Each helper defaults $user_id to the current user when omitted.

Admin screens

The three SnipShare admin screens (Settings, All Pastes, Moderation) additionally require the WordPress manage_options capability to load.

Customizing role mappings

On sites with the Abilities API, an administrator can override the default role mappings through the Abilities management UI. In code, hook the user_has_cap filter to grant or deny any snipshare/* ability for specific users or roles.