Explain the hidden Publishing section on the settings screen

[Hackshaven]

Summary

A user who can open Settings → Terraviz (manage_options) but lacks the plugin's manage_terraviz capability saw the Publishing section — the Cloudflare Access service-token Client ID / Client Secret fields — silently missing. That reads as a missing feature rather than a permission, and is what a user with a custom "Developer" role ran into while setting up a test site.

This PR renders the Publishing section header for such users with a notice in place of the fields:

• Non-administrators are told the fields need manage_terraviz and to ask a site administrator to either enter the token themselves or grant the capability — with a role-editor plugin, or a WP-CLI command pre-filled with the viewer's user id (wp user add-cap <id> manage_terraviz).
• Administrators whose role lacks the capability (usually because the plugin was enabled without its activation hook running, which is the only place it is granted) are told to deactivate and reactivate the plugin instead.
• Users with the capability explicitly denied on their account (manage_terraviz => false, which outranks any role grant, so reactivation can't lift it) are told so, with the command that removes the denial (wp user remove-cap <id> manage_terraviz).

The credential fields, their sanitize_credential save path, and the "Verify credential" action remain gated on manage_terraviz exactly as before — this only changes what a user without the capability sees.

Changes

• src/Settings.php — register_publishing() registers the section with a new render_publishing_locked() callback when the current user lacks manage_terraviz.
• tests/unit/SettingsPublishingSectionTest.php — renders the settings sections for four cases (manage_options without the capability; administrator whose role lacks it; per-user denial; capability holder) and asserts the right notice / fields appear. The role case removes and restores the administrator role's grant; the others grant or deny per user.
• CHANGELOG.md — [Unreleased] → Added entry.
• Merged main to pick up the wp-env 11.17 Screenshots fix (Move wp-env to 11.17 so the Screenshots workflow can start WordPress #47).

Testing

• phpunit --testsuite unit against the WP test suite (latest WordPress, PHP 8.3): 223 tests, 749 assertions, all passing (also in reverse order). The per-user-denial test fails against the earlier version of the notice.
• phpcs: 0 errors (the one warning is pre-existing, in tests/unit/CryptoTest.php).
• semgrep scan --config p/php --config p/security-audit --config p/secrets: 0 findings.
• Screenshots: the CI run after merging main captured all 12 shots; Settings screen and Publisher dashboard unchanged. Its admin login holds manage_terraviz, so the notice never renders there.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MKEqjkVyUQiZZL7QTk9m64

[github-actions]

🖼️ Visual report

12 shot(s) · 2 viewport(s) (desktop, mobile) · 3 with changes

Regression: 3 shot(s) changed, 0 new (no baseline), threshold 0.001.

Scene	Viewport	Change
Dataset block	mobile	0.11% (154 px)
Right-Now Hero block	mobile	0.11% (165 px)
Tour block	mobile	0.12% (165 px)

All 12 shot(s)

Scene	Viewport	Change
Catalog block	desktop	—
Catalog block	mobile	—
Dataset block	desktop	—
Dataset block	mobile	0.11% (154 px)
Right-Now Hero block	desktop	—
Right-Now Hero block	mobile	0.11% (165 px)
Related Datasets rail	desktop	—
Related Datasets rail	mobile	—
Tour block	desktop	—
Tour block	mobile	0.12% (165 px)
Publisher dashboard	desktop	—
Settings screen	desktop	—

Full gallery (actuals + .diff.png overlays) → the screenshots-gallery artifact on the Screenshots run.

Advisory — the Screenshots workflow is kept out of the core CI gate, so this never blocks a merge. Visual review only.

[Copilot]

🟡 Changes recommended

The administrator recovery advice does not resolve explicit per-user capability denials.

1 open finding

• Reactivation cannot override explicit per-user manage_terraviz denial · New

What changed in this PR

Explains why Publishing settings are hidden from users without manage_terraviz, while preserving existing credential authorization.

Changes:

• Adds a locked Publishing notice with role-specific recovery guidance.
• Tests notices and credential visibility for three permission states.
• Documents the change in the changelog.

File	Description
tests/​unit/​SettingsPublishingSectionTest.php	Tests permission-dependent notices and fields.
src/​Settings.php	Adds the locked Publishing section and guidance.
CHANGELOG.md	Records the new settings notice.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.