Capabilities Vs User Meta

Question

What is the advantage of using capabilities instead of usermeta?

For example a cap access_feature_x vs meta access_feature_x. I can use current_user_can() vs get_user_meta() on various checks.

So, what improvement does capabilities provides?

Edit

The question seem too broad for a specific answer. So, I will provide an example context. Please keep your original answers as they are helpful too and add additional information below your current answer.

For example,

1. A feature on my membership site feature_x.
2. The feature is primarily disabled for all users except admin and editors.
3. Once user signup for the feature it activates and new UI part is shown to users.

For the above example. I can go with both usermeta and capabilities. How you would approach the given problem? Currently I am doing with meta

Answer 1

There is no one answer, because both have pros and cons depending on what you want to store and why.

A (probably non-exhaustive) list of differences to consider for a choice:

• Capabilities are designed to check if a user can do something or not. user_can and current_user_can are there to help you to check user permissions. You can implement that with user meta too, but makes no sense once you have that feature in core.

• There is no doubt that capabilities can be used to group users with similar characteristics, even if the groups are not related to permissions. In that case capabilities are for users somewhat similar to what taxonomy terms are for posts. user_can function can be used to check if a user has a capability or not (similar to has_term) but there is no core function that does the same for meta. However, retrieve a collection of users by capabilities is probably more expensive than retrieve users by a simple meta query (it's a guess, not based on real performance profiling data).

• To filter on the fly (without db change) all the capabilities assigned to a user is pretty easy (especially if cap are checked with user_can / current_user_can and there is no reason why not), while doing the same for meta is much harder.

• Meta can handle nested data (e.g. arrays and even different (sets of) values for same meta key). That's not possible with capabilities.

• Capabilities can be grouped in roles. And roles also have a UI in the backend that allows assigning a "set" of capabilities by assigning a role. There is no such benefit for meta.

• Capabilities are independent entities from users, and they survive users: if you delete all users that have a capability, it stays there. The same does not apply to meta: all meta goes with a user if it is deleted.

Edit

After the edit on the OP, I would say that capabilities are much better: you are implementing with meta something that core already does with capabilities, and is exactly what capabilities are intended to be.

As example, think to add_menu_page function, it has a $capability argument that lets you show a menu page only to users that have that capability.

This is only an example, there are different functions that accept capabilities as an argument. Moreover, as said in first point before the edit, it makes no sense to implement from scratch a feature that core already has.

Answer 2

The difference is that capabilities are part of the access permission system of the site, which utilize and can be changed by the built-in tools and APIs that are designed to handle permissions. You can create your own permission scheme but then it will not be easy to override with tools or code that expect access permissions to be handled in capabilities.

By using meta fields instead of capabilities you also lose the ability to group users into roles, which might or might not be important.

Your question highlights again one of the soft points in WordPress core, the lack of separation between content author and site user. When you think of a user as a user of the site, you should go capabilities, but if your code handles a user as a content author, you might do better by using meta fields.

As for the specific example in the edit part. This falls nicely into access control and you even need it for actual roles, therefor capabilities is the way to go.

Answer 3

User Capabilities will allow you set site-wide access settings for a specific User/User Account Type whereas the meta-data allows you to make settings individually for each Post/Page or anything that supports Meta in Wordpress. In other words, Capabilities are part of ACL (Access Control Layer) whereas Meta is best when used for Data Presentation.

User Capabilities are best if you're writing an application that uses certain access control in global scope of your application whereas the User Meta is best if you want to apply restriction per Post/Page. Note that, if you control ACL using Capabilities, you will just need to create a User account of specific User Type in order to apply certain restrictions; however you will need to make sure you (manually) add specific Meta value to every Post, Page that you want to apply ACL to.

Use of Capabilities and Meta is very much application specific and I'm afraid if I can generalize the best scenarios for you to define which is best among the two.