Add exclude_roles to visibility roles

A visibility role can now list roles to EXEMPT: a user holding any of the
exclude_roles is not matched even when they satisfy the include roles. This
lets a role-based hide carve out users who hold a broader entitlement — e.g.
hide a tier's pricing on restricted categories EXCEPT for users who are also
dealer/operator — which the prior ANY/ALL positive-only matcher could not
express (no negation).

- Context::user_matches_visibility_role: veto when a user matches any
  exclude_role (the synthetic MSRP_CUSTOMER is honored); explicit per-user
  targeting is unaffected.
- Config::visibility_roles: normalize/persist exclude_roles.
- Admin\Settings: sanitize and render an "Except roles" multiselect.
- Test: parts_dealer hidden; parts_dealer who is also dealer/operator exempt.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mjoslyn

src/Admin/Settings.php

@@ -261,12 +261,14 @@ private function sanitize_visibility_roles( $rows ) {
 			}
 
 			$roles       = isset( $row['roles'] ) && is_array( $row['roles'] ) ? array_values( array_unique( array_filter( array_map( 'sanitize_key', $row['roles'] ) ) ) ) : array();
+			$exclude     = isset( $row['exclude_roles'] ) && is_array( $row['exclude_roles'] ) ? array_values( array_unique( array_filter( array_map( 'sanitize_key', $row['exclude_roles'] ) ) ) ) : array();
 			$users       = isset( $row['users'] ) && is_array( $row['users'] ) ? array_values( array_unique( array_filter( array_map( 'absint', $row['users'] ) ) ) ) : array();
 			$match       = isset( $row['match'] ) && 'all' === $row['match'] ? 'all' : 'any';
 			$out[ $key ] = array(
 				'key'             => $key,
 				'label'           => sanitize_text_field( $row['label'] ?? ucfirst( $key ) ),
 				'roles'           => $roles,
+				'exclude_roles'   => $exclude,
 				'users'           => $users,
 				'match'           => $match,
 				'categories'      => $this->sanitize_category_set( $row['categories'] ?? array() ),
@@ -831,6 +833,18 @@ private function render_visibility_role_row( $name, $index, array $role, array $
 					</select>
 					<p class="description"><?php esc_html_e( 'Users are matched by these roles. "MSRP Customer" matches anyone without a pricing tier (retail customers, subscribers, guests).', 'wc-pricebook' ); ?></p>
 				</div>
+				<div class="wc-pricebook-field wc-pricebook-field--full">
+					<label><?php esc_html_e( 'Except roles', 'wc-pricebook' ); ?></label>
+					<?php
+					$excluded_roles = isset( $role['exclude_roles'] ) && is_array( $role['exclude_roles'] ) ? array_map( 'strval', $role['exclude_roles'] ) : array();
+					?>
+					<select multiple class="wc-enhanced-select" name="<?php echo esc_attr( $base . '[exclude_roles][]' ); ?>" style="width:100%;" data-placeholder="<?php esc_attr_e( 'Select roles to exempt&hellip;', 'wc-pricebook' ); ?>">
+						<?php foreach ( $this->role_options() as $slug => $role_label ) : ?>
+							<option value="<?php echo esc_attr( (string) $slug ); ?>" <?php echo in_array( (string) $slug, $excluded_roles, true ) ? 'selected="selected"' : ''; ?>><?php echo esc_html( $role_label ); ?></option>
+						<?php endforeach; ?>
+					</select>
+					<p class="description"><?php esc_html_e( 'A user holding any of these roles is exempt from this rule, even if they match the roles above (e.g. hide a tier’s pricing except for users who are also dealer/operator).', 'wc-pricebook' ); ?></p>
+				</div>
 				<div class="wc-pricebook-field wc-pricebook-field--full">
 					<label><?php esc_html_e( 'Specific users', 'wc-pricebook' ); ?></label>
 					<?php $selected_users = isset( $role['users'] ) && is_array( $role['users'] ) ? array_map( 'intval', $role['users'] ) : array(); ?>

src/Config.php

@@ -255,6 +255,7 @@ public function visibility_roles() {
 			$role       = is_array( $role ) ? $role : array();
 			$key        = isset( $role['key'] ) ? $role['key'] : $key;
 			$want       = isset( $role['roles'] ) && is_array( $role['roles'] ) ? array_values( array_unique( array_filter( array_map( 'sanitize_key', $role['roles'] ) ) ) ) : array();
+			$except     = isset( $role['exclude_roles'] ) && is_array( $role['exclude_roles'] ) ? array_values( array_unique( array_filter( array_map( 'sanitize_key', $role['exclude_roles'] ) ) ) ) : array();
 			$users      = isset( $role['users'] ) && is_array( $role['users'] ) ? array_values( array_unique( array_filter( array_map( 'intval', $role['users'] ) ) ) ) : array();
 			$match      = isset( $role['match'] ) && 'all' === $role['match'] ? 'all' : 'any';
 			// Category SET ({ mode, categories }) — the same scoping model as pricing tiers.
@@ -265,6 +266,8 @@ public function visibility_roles() {
 				'key'        => $key,
 				'label'      => isset( $role['label'] ) ? $role['label'] : ucfirst( $key ),
 				'roles'      => $want,
+				// Users holding any of these roles are exempt even if they match `roles`.
+				'exclude_roles' => $except,
 				'users'      => $users,
 				'match'      => $match,
 				'categories' => $categories,

src/Context.php

@@ -572,8 +572,24 @@ private function user_matches_visibility_role( $user_id, array $role, array $use
 		foreach ( $want as $slug ) {
 			$hits[] = ( self::MSRP_CUSTOMER === $slug ) ? (bool) $is_msrp : in_array( $slug, $user_roles, true );
 		}
+		$matched = 'all' === $match ? ! in_array( false, $hits, true ) : in_array( true, $hits, true );
+		if ( ! $matched ) {
+			return false;
+		}
+
+		// Exclude roles: a user holding ANY of these is exempt from this visibility role,
+		// even though they matched the include roles above. Lets a role-based rule carve
+		// out users who hold a broader entitlement — e.g. hide a tier's pricing EXCEPT for
+		// users who are also dealer/operator. The synthetic MSRP_CUSTOMER is honored here
+		// too. Explicit per-user targeting (above) is not affected.
+		$except = isset( $role['exclude_roles'] ) && is_array( $role['exclude_roles'] ) ? $role['exclude_roles'] : array();
+		foreach ( $except as $slug ) {
+			if ( ( self::MSRP_CUSTOMER === $slug ) ? (bool) $is_msrp : in_array( $slug, $user_roles, true ) ) {
+				return false;
+			}
+		}
 
-		return 'all' === $match ? ! in_array( false, $hits, true ) : in_array( true, $hits, true );
+		return true;
 	}
 
 	/**

tests/ContextTest.php

@@ -252,6 +252,32 @@ public function test_visibility_role_match_all() {
 		$this->assertSame( array(), $this->context->visibility_role_categories( 6 )['exclude'] );
 	}
 
+	public function test_visibility_role_exclude_roles_exempt_matched_users() {
+		// Include parts_dealer, but exempt anyone who is also dealer/operator — the Fenton
+		// case: hide restricted-category pricing from a parts-only dealer, while a
+		// parts_dealer who is also a dealer/operator keeps seeing prices.
+		$this->with_visibility_roles(
+			array(
+				'r' => array(
+					'label'         => 'R',
+					'roles'         => array( 'parts_dealer' ),
+					'exclude_roles' => array( 'dealer', 'operator' ),
+					'match'         => 'any',
+					'categories'    => array( 'mode' => 'include', 'categories' => array( 555 ) ),
+					'hide'          => 'product',
+				),
+			)
+		);
+		Store::add_user( 5, array( 'customer', 'parts_dealer' ) );           // parts only → matched.
+		Store::add_user( 6, array( 'parts_dealer', 'dealer' ) );             // also dealer → exempt.
+		Store::add_user( 7, array( 'parts_dealer', 'operator' ) );           // also operator → exempt.
+		Store::add_user( 8, array( 'customer' ) );                           // not parts → no include match.
+		$this->assertSame( array( 555 ), $this->context->visibility_role_categories( 5 )['exclude'] );
+		$this->assertSame( array(), $this->context->visibility_role_categories( 6 )['exclude'] );
+		$this->assertSame( array(), $this->context->visibility_role_categories( 7 )['exclude'] );
+		$this->assertSame( array(), $this->context->visibility_role_categories( 8 )['exclude'] );
+	}
+
 	public function test_role_targeting_is_capability_based() {
 		// Role targeting (visibility roles, force overrides, bulk pricing) uses the same
 		// capability check as tier membership: user_can($user, $slug). A capability