Security¶

Barberklingen\BasePlugin\Modules\Security\SecurityLoader

Manages custom WordPress roles with granular WooCommerce capabilities and locks down admin areas to specific roles. Also disables XML-RPC completely.

Activating the module¶

SecurityLoader::get_instance();

Roles¶

Custom roles are defined under Modules\Security\Roles\. Each role extends UserRole and declares its capabilities by composing static capability helpers:

Role	Slug	Description
`CustomerServiceAgentRole`	`customer_service_agent`	Orders, subscriptions, users, SMS
`CustomerServiceTeamLeaderRole`	`customer_service_team_leader`	Extends agent with additional access
`FinanceRole`	`finance`	Finance-related capabilities
`GrowthRole`	`growth`	Growth/marketing capabilities
`DataRole`	`data`	Data/reporting capabilities
`WarehouseRole`	`warehouse`	Warehouse operations
`WarehouseTeamLeaderRole`	`warehouse_team_leader`	Extends warehouse role

Role structure¶

class MyCustomRole extends UserRole {
    public static function name(): string {
        return 'My Custom Role';
    }

    public static function capabilities(): array {
        return [
            DashboardCaps::read(),
            WooCommerceCaps::base(),
            WooCommerceCaps::view_orders(),
            WooCommerceCaps::edit_orders(),
        ];
    }

    public static function editable_roles(): array {
        return ['customer']; // roles this user can edit
    }
}

Capability groups¶

Capabilities are grouped into composable static helper classes:

Class	Covers
`DashboardCaps`	WordPress dashboard access
`PostCaps`	Posts and pages read/edit
`PageCaps`	Page-specific capabilities
`CommentsCaps`	Comment moderation
`WooCommerceCaps`	Orders, subscriptions, products, coupons
`CouponCaps`	WooCommerce coupon management
`UserCaps`	User read/edit/delete/export
`AffiliateCaps`	Affiliate data read
`SMSCaps`	SMS gateway management

Areas¶

AreasLoader boots area-specific access restrictions. Areas represent sections of the WordPress admin that are locked to specific roles:

Area	Locks
`WooCommerceArea`	WooCommerce screens
`ElementorArea`	Elementor editor
`PostsArea`	Posts list/edit
`CommentsArea`	Comments screen
`SMSGatewayArea`	SMS gateway settings

XML-RPC¶

XML-RPC is disabled unconditionally when SecurityLoader is active:

add_filter('xmlrpc_enabled', '__return_false', 9999);
add_filter('xmlrpc_methods', '__return_empty_array', 9999);

WP-CLI¶

wp security setup

Registers all custom roles and their capabilities in the database. Run after deploying role changes.