Admin, roles and capability hooks

These hooks change the HappenBoard admin and who may use it. They cover the screens in its menu, the start-up data of its admin app, the capabilities each role receives, and the per-visitor limit on public booking lookups. Reach for them when you add a screen for your own add-on, set up a custom role, or tune a busy booking page. The Roles and permissions guide explains each capability in plain words, and Extending HappenBoard with hooks covers the basics of the reference.

How capabilities are granted

HappenBoard checks its own capabilities, such as happenboard_manage_events or happenboard_view_attendees, rather than WordPress roles. The free plugin and HappenBoard Pro each add theirs to the Administrator and Editor roles when they install them. Two details matter when you change them in code:

• The role filters below run only when the capabilities are installed: at activation, or once after an update that adds new ones. They change what is written then, not what roles have today.
• HappenBoard’s REST routes and admin menu also let any user with manage_options through. Removing a HappenBoard capability from administrators does not lock them out.

Pro roles and permissions lists the six capabilities HappenBoard Pro adds.

apply_filters( 'happenboard_admin_submenus', array $default )

add_filter(
    'happenboard_admin_submenus',
    function ( $submenus ) {
        // Append: returning a new array would drop the built-in screens
        // and the ones HappenBoard Pro adds.
        $submenus[] = array(
            'path'       => 'options-general.php?page=my-addon',
            'label'      => __( 'My add-on', 'my-addon' ),
            'capability' => 'manage_options',
            'parent'     => '',
            'external'   => true, // A classic admin page, not an app route.
        );

        return $submenus;
    },
    20
);

apply_filters( 'happenboard_screen_context', array $context )

add_filter(
    'happenboard_screen_context',
    function ( $context ) {
        // Your own settings, nested so booleans stay booleans in JavaScript.
        $context['myAddon'] = array(
            'enabled'  => true,
            'endpoint' => rest_url( 'my-addon/v1/' ),
        );

        return $context;
    },
    20
);

apply_filters( 'happenboard_capabilities_role_defaults', array $mapping )

// In an mu-plugin or your plugin's main file, so it is in place before init.
add_filter(
    'happenboard_capabilities_role_defaults',
    function ( $mapping ) {
        // Let WooCommerce shop managers see attendees and bookings.
        $mapping['shop_manager'] = array(
            'happenboard_view_attendees',
            'happenboard_view_bookings',
        );

        return $mapping;
    }
);
// Then deactivate and reactivate HappenBoard once to apply it.

apply_filters( 'happenboard_pro_capabilities_role_defaults', array $mapping )

add_filter(
    'happenboard_pro_capabilities_role_defaults',
    function ( $mapping ) {
        // WooCommerce shop managers handle ticket orders and refunds.
        $mapping['shop_manager'] = array(
            'happenboard_view_orders',
            'happenboard_export_orders',
            'happenboard_refund_orders',
        );

        return $mapping;
    }
);
// Then deactivate and reactivate HappenBoard Pro once to apply it.

apply_filters( 'happenboard_me_capabilities', array $caps, WP_User $user )

add_filter(
    'happenboard_me_capabilities',
    function ( $caps, $user ) {
        // A custom front end also needs the booking capabilities.
        $extra = array( 'happenboard_view_bookings', 'happenboard_manage_booking_types', 'happenboard_host' );

        foreach ( $extra as $cap ) {
            $caps[ $cap ] = user_can( $user, $cap );
        }

        return $caps;
    },
    10,
    2
);

apply_filters( 'happenboard_throttle_public_reads', bool $counts )

add_filter(
    'happenboard_throttle_public_reads',
    function ( $counts ) {
        // No Redis or Memcached here, but a bot keeps scraping the booking
        // page: count the lookups anyway.
        return true;
    }
);

Next steps

• Roles and permissions: what each free capability allows.
• Pro roles and permissions: the ticket, order, check-in and resource capabilities.
• happenboard_booking_client_ip: give the lookup limit the real visitor address behind a proxy.