Restricted user capabilities cannot add image

Question

I have restricted a users capabilities

$capabilities = array(
    'delete_posts'           => true,
    'delete_published_posts' => true,
    'edit_posts'             => true,
    'edit_published_posts'   => true,
    'publish_posts'          => true,
    'read'                   => true,
    'upload_files'           => true
);

Everything works as I expect, except that the user cannot insert images into the editor field in a CPT, despite the fact they have the upload files capability.

'supports'      => array( 'title', 'editor' ),

What capability have I missed that lets them do this?

EDIT

So the offending code is somewhere below

function remove_admin_menu_items() {
    if ( current_user_can( 'test_author' ) ) {
        /** remove side dashboard items */
        remove_menu_page( 'edit.php' );                             //Posts
        remove_menu_page( 'edit.php?post_type=page' );              //Pages
        remove_menu_page( 'edit-comments.php' );                    //Comments
        remove_menu_page( 'themes.php' );                           //Appearance
        remove_menu_page( 'plugins.php' );                          //Plugins
        remove_menu_page( 'users.php' );                            //Users
        remove_menu_page( 'tools.php' );                            //Tools
        remove_menu_page( 'options-general.php' );                  //Settings
        remove_menu_page( 'edit.php?post_type=cpt_customposttype' );
    }
}
add_action( 'admin_init', 'remove_admin_menu_items' ); //use late hook so plugins have all loaded

Answer 1

You haven't missed any capabilities. User should be able to insert images into the editor with these capabilities.

The only problem I can think of is that, you are trying to modify the capabilities of a role which won't work.

See this section

If you are defining a custom role, and adding capabilities to the role using add_role(), be aware that modifying the capabilities array and re-executing add_role() will not necessarily update the role with the new capabilities list. The add_role() function short-circuits if the role already exists in the database.

The workaround in this case is to precede your add_role() call with a remove_role() call that targets the role you are adding.

Answer 2

I found the issue. Somewhere online recommended to use a late hook so all the plugins loaded.

add_action( 'admin_init', 'remove_admin_menu_items' );

Obviously I used the wrong hook. Instead I used the codex recommendation

add_action( 'admin_menu', 'remove_admin_menu_items' );