I'm encountering funny behaviour with a custom post of mine that I'm working with in a plugin of mine. Here are the arguments of the custom post:
array(
'label' => [omitted],
'labels' => [omitted],
'public' => false,
'show_ui' => true,
'menu_position' => 21,
'menu_icon' => 'dashicons-editor-help',
'supports' => array('title','editor','comments'),
'capability_type' => array('custom-post','custom-posts'),
'show_in_rest' => false,
'show_in_menu' => 'my-plugin' // Able to create posts with restricted user role if I remove this line.
)
Note that this custom post type is put inside of a menu, which requires a capability of edit_custom-posts
to be able to access.
add_menu_page('My Plugin Module', 'My Plugin Module', 'edit_custom-posts', 'my-plugin','','dashicons-admin-network',21);
As I want to allow only site Administrators, as well as a custom user role (let's call them Plugin Admins), to be able to manage these custom post types completely. To this end, I've added the following capabilities to them:
$cap['edit_custom-post'] = true;
$cap['read_custom-post'] = true;
$cap['delete_custom-post'] = true;
$cap['edit_custom-posts'] = true;
$cap['edit_others_custom-posts'] = true;
$cap['publish_custom-posts'] = true;
$cap['read_private_custom-posts'] = true;
$cap['edit_published_custom-posts'] = true;
$cap['delete_published_custom-posts'] = true;
Everything works the way I want it to: Administrators and Plugin Admins have no problem accessing, editing and creating new custom posts, if I do not put the custom post under the my-plugin
menu. When I do, Administrators still can create new custom posts, but Plugin Admins can do everything except create new custom posts. Instead, they will get a Sorry, you are not allowed to access this page error.
Anyone have any insight into why this is happening? What permission does the Administrator have that the Plugin Admins do not?