Fix: make Give 4.0+ compatible with legacy user roles

[jonwaldstein]

Resolves: GIVE-3021

Description

This should solve all our Give user role problems 🤞

For context, our custom give user roles have been around since the beginning of time. Over time, we have gotten out of sync with user roles/caps and the features we have. This PR tries to correct that by digging through the depths of GiveWP and updating all the permission checks to utilize a centralized UserPermission facade.

Affects

• Everything 😬
• The give_worker role has migration to replace edit_give_payments with view_give_payments

Visuals

GiveWP Role Permissions Matrix

Donations

Role	View	Edit	Delete
Administrator	✅	✅	✅
GiveWP Manager	✅	✅	✅
GiveWP Accountant	✅	✅	✅
GiveWP Worker	✅	❌	❌
GiveWP Donor	❌	❌	❌

Donors

Role	View	Edit	Delete
Administrator	✅	✅	✅
GiveWP Manager	✅	✅	✅
GiveWP Accountant	✅	✅	✅
GiveWP Worker	❌	❌	❌
GiveWP Donor	❌	❌	❌

Forms

Role	View	Edit	Delete	Publish
Administrator	✅	✅	✅	✅
GiveWP Manager	✅	✅	✅	✅
GiveWP Accountant	✅	❌	❌	❌
GiveWP Worker	✅	✅	✅	✅
GiveWP Donor	❌	❌	❌	❌

Reports

Role	View	Export
Administrator	✅	✅
GiveWP Manager	✅	✅
GiveWP Accountant	✅	✅
GiveWP Worker	❌	❌
GiveWP Donor	❌	❌

Settings & Tools

Role	Manage Settings	View Sensitive Data
Administrator	✅	✅
GiveWP Manager	✅	✅
GiveWP Accountant	❌	❌
GiveWP Worker	❌	❌
GiveWP Donor	❌	❌

Testing Instructions

ZIP: https://github.com/impress-org/givewp/actions/runs/20375958542

We need to test every user role scenario outlined here:
https://givewp.com/documentation/core/give-user-roles/

Pre-review Checklist

• Acceptance criteria satisfied and marked in related issue
• Relevant @unreleased tags included in DocBlocks
• Includes unit tests
• Reviewed by the designer (if follows a design)
• Self Review of code and UX completed

[glaubersilva]

@jonwaldstein I started an initial overview, but I will need more time, so I'll keep checking it tomorrow. What I can see now is that in the PR descriptions says that the GiveWP Worker role can't view forms, but in the docs, we have this information for this same role: Read/Edit/Delete/Publish GiveWP Forms

[jonwaldstein]

@glaubersilva thanks man! take your time. I think that's a typo in the description from my personal assistant 😏 - I'll update it

[glaubersilva]

@jonwaldstein This is a great and massive work! Thanks for getting some time to tackle this beast. Overall, everything looks right to me. I just left some comments and questions about possible improvements.

[glaubersilva]

I'm wondering if we can use get_queried_object() or get_queried_object_id(); instead of $this->getPostIdFromRestRoute() since these methods are used inside the rest_get_queried_resource_route() method to compose the route URL.

[jonwaldstein]

That's a great question! I had to investigate this. Apparently get_queried_object does not work within this request nor will rest_get_queried_resource_route because they operate in a different kind of request geared towards the frontend. I had opus explain this to me in laymans terms because I was confused LOL

Think of WordPress as having two different doors for incoming requests:

Door 1: The Front Door (Normal page visits)

1. When someone visits yoursite.com/my-campaign-page/:
2. WordPress says "Someone wants to see a page!"
3. WordPress looks up which page, loads it, and remembers: "We're showing page #123"
4. get_queried_object() asks: "What are we showing?" → WordPress answers: "Page #123"

Door 2: The Side Door (REST API calls)

1. When the block editor calls yoursite.com/wp-json/wp/v2/pages/123:
2. WordPress says "This is an API call, not a page visit"
3. WordPress hands it off to the REST server, which reads the URL directly
4. WordPress never bothers to remember "we're showing page #123"—it's just an API call
5. get_queried_object() asks: "What are we showing?" → WordPress says: "¯\(ツ)_/¯ Nothing, this isn't a page visit"

The Bottom Line:
get_queried_object() only works when someone is visiting a page. During an API call, nobody is "visiting" anything—it's just data being requested. WordPress doesn't track it the same way.
So you have to read the URL yourself to find the 123.

[glaubersilva]

Nice analogy! Living and learning. hahaha

[jonwaldstein]

@glaubersilva thanks man!, ready for re-review 🪇

[glaubersilva]

@jonwaldstein Great job man! It's ready to be intensively tested by QA now. 😅 🚀