Custom Post Type Capabilities -- Enable Edit, Disable Create and Delete

Question

I'm trying to configure capabilities for a custom post type. I want to enable editing, but disable creating and deleting. create_posts cannot be set to false unless delete_posts is also false, but it seems that this combination disables the editing screen.

Thanks!

Answer 1

There are a lot of capabilities, you can set for your post type.

foreach ( self::$todo_roles as $role ) {            
     $wp_roles->add_cap( $role, 'edit_' . self::$post_type_1 );
     $wp_roles->add_cap( $role, 'read_' . self::$post_type_1 ); 
     $wp_roles->add_cap( $role, 'delete_' . self::$post_type_1 );
     $wp_roles->add_cap( $role, 'edit_' . self::$post_type_1 . 's' );
     $wp_roles->add_cap( $role, 'edit_others_' . self::$post_type_1 . 's' );    
     $wp_roles->add_cap( $role, 'publish_' . self::$post_type_1 . 's' );
     $wp_roles->add_cap( $role, 'read_private_' . self::$post_type_1 . 's' );   
     $wp_roles->add_cap( $role, 'delete_' . self::$post_type_1 . 's' ); 
     $wp_roles->add_cap( $role, 'delete_private_' . self::$post_type_1 . 's' ); 
     $wp_roles->add_cap( $role, 'delete_published_' . self::$post_type_1 . 's' );
     $wp_roles->add_cap( $role, 'delete_others_' . self::$post_type_1 . 's' );  
     $wp_roles->add_cap( $role, 'edit_private_' . self::$post_type_1 . 's' );
     $wp_roles->add_cap( $role, 'edit_published_' . self::$post_type_1 . 's' ); 
} 

With something like the above you can add capabilities the roles.

As hint to the source. The self::$post_type_1 is a variable in a class for the custom post type. The foreach loop is to add this capabilities often to different roles.

Answer 2

Here is what I've done to achieve this. I'll use "blob" as my example custom post type. When calling register_post_type, include the following args:

"capability_type" => "blob",
'capabilities' => array(
    'create_posts' => 'create_blob',
    'publish_posts' => 'publish_blob',
    'edit_posts' => 'edit_blob',
    'edit_others_posts' => 'edit_others_blob',
    'delete_posts' => 'delete_blob',
    'delete_others_posts' => 'delete_others_blob',
    'read_private_posts' => 'read_private_blob',
    'edit_post' => 'edit_blob',
    'delete_post' => 'delete_blob',
    'read_post' => 'read_blob',
),
"map_meta_cap" => false,

You will also need the following code to map the meta capabilities. Source.

add_filter( 'map_meta_cap', 'my_map_meta_cap', 10, 4 );

function my_map_meta_cap( $caps, $cap, $user_id, $args ) {

    /* If editing, deleting, or reading a blob, get the post and post type object. */
    if ( 'edit_blob' == $cap || 'delete_blob' == $cap || 'read_blob' == $cap ) {
        $post = get_post( $args[0] );
        $post_type = get_post_type_object( $post->post_type );

        /* Set an empty array for the caps. */
        $caps = array();
    }

    /* If editing a blob, assign the required capability. */
    if ( 'edit_blob' == $cap ) {
        if ( $user_id == $post->post_author )
            $caps[] = $post_type->cap->edit_posts;
        else
            $caps[] = $post_type->cap->edit_others_posts;
    }

    /* If deleting a blob, assign the required capability. */
    elseif ( 'delete_blob' == $cap ) {
        if ( $user_id == $post->post_author )
            $caps[] = $post_type->cap->delete_posts;
        else
            $caps[] = $post_type->cap->delete_others_posts;
    }

    /* If reading a private blob, assign the required capability. */
    elseif ( 'read_blob' == $cap ) {

        if ( 'private' != $post->post_status )
            $caps[] = 'read';
        elseif ( $user_id == $post->post_author )
        $caps[] = 'read';
        else
            $caps[] = $post_type->cap->read_private_posts;
    }

    /* Return the capabilities required by the user. */
    return $caps;
}

Now you will need a plugin in order to edit the new custom capabilities you've defined. I used Members. Use the plugin to grant or deny the new capabilities to user roles. For Members plugin and your specific request of allowing editing but preventing creating and deleting, this involves opening the Users->Roles menu item, editing a role, click on "Blob" in the left side menu to filter for capabilities related to Blob, and then denying "create_blobs", "delete_blogs", and "delete_others_blobs". Once they are set and you're happy with them you can disable the plugin, the capabilities will be stored in the database.