CodeBold
Commerce
000
Product / Members
Home /Members

Hiding a menu
is not a
permission.

Plenty of software greys out a button and calls it security. A hidden link is still reachable by typing the address into the bar. Ours refuses: every screen checks the capability twice — once when the menu is registered, and again when the page renders.

01 / Capabilities

Twenty-six,
in four groups.

Each one is separate. That is the whole point — a cashier who can refund without being able to discount is a normal thing to want, and it should not require editing code.

Suite · 4 capabilities

✓Manage suite settings
✓Manage outlets and warehouses
✓Manage roles and capabilities
✓Permanently delete records

Point of sale · 12 capabilities

✓Open the POS register
✓Open a shift
✓Close a shift and count cash
✓Manage registers
✓Apply discounts
✓Override prices
✓Void lines and sales
✓Process refunds
✓Accept returns without a receipt
✓Open the cash drawer (no sale)
✓Record cash in, cash out and safe drops
✓View POS reports

Inventory · 8 capabilities

✓View inventory
✓Edit stock levels
✓View costs and margins
✓Manage suppliers
✓Manage purchase orders
✓Receive stock
✓Transfer stock between outlets
✓Run stock takes

Membership · 2 capabilities

✓Manage membership plans
✓Manage members

Names shown exactly as they read on the roles screen.

02 / Ready-made roles

Four to start
from.

Use them as they are, or take them apart. They are ordinary WordPress roles carrying the suite's capabilities, not a parallel user system.

01

Cashier

Sells and opens a shift. Cannot close the drawer, discount, override or refund.

02

Shift Manager

Everything a cashier does, plus closing the shift, discounts, voids, refunds, cash movements and POS reports.

03

Stock Manager

The supply side — suppliers, purchase orders, receiving, costing, stock takes, transfers. Reports, but no till.

04

Outlet Manager

All twelve till capabilities and the inventory group. The role you give the person who runs the shop.

03 / What refusing looks like

403, not a
missing link.

A cashier who types the reports address straight into the bar gets a refusal naming the capability they do not have. Not a blank screen, not a redirect to the dashboard, and certainly not the page.

The home page has this running as a working sketch — pick a role and watch it type the address.

Try it on the home page→
Cashier types the address straight into the bar:
/wp-admin/admin.php?page=codebold-commerce-reports
403 — refused. Capability codebold_view_pos_reports not granted.

Checked at the menu · checked again at the page

04 / Questions

About Members.

Is this a paid-memberships plugin?
No, and the name misleads — we know. It is roles and capabilities for the suite: who can use the till, who can see cost prices, who can close a shift. Nothing to do with selling subscriptions to customers.
What does "checked twice" mean?
A capability is checked once when the admin menu is registered, and again when the page itself renders. Greying out a button is not security — a hidden link is still reachable by typing the address into the bar. The second check is what refuses.
Can I lock an administrator out?
No, and that guard is deliberate. An administrator on your own WordPress site keeps access to their own site. Everything else is yours to take apart.
Can I build my own roles?
Yes. The four that ship are a starting point, not a fence. Every capability is separate, so a role that refunds but cannot discount is a role you can make.

Free on WordPress.org.
Like the rest of it.

Members works on its own, and it is the permission layer the till and the stockroom check against.

Download free→ The till