{
  "slug": "bw-guides",
  "name": "BW Guides",
  "version": "0.3.5",
  "download_url": "https://plugins.bowden.works/wp-content/uploads/plugin-updates/bw-guides-0.3.5.zip",
  "download_hash": "sha256:dc675e72054788c88b7e1bb5003f87380167ea486a7b9701096d6135bdc5d6d8",
  "download_size": 222973,
  "requires": "6.0",
  "tested": "",
  "requires_php": "7.4",
  "last_updated": "2026-08-13",
  "homepage": "https://plugins.bowden.works/bw-guides/",
  "author": "Bowden Works",
  "description": "Documentation and guides for your website, delivered and updated by Bowden Works.",
  "changelog": "## [0.3.5] - 2026-08-13\n\n### Added\n- **Reading and changing guides are now separate capabilities**, `bw_guides_read`\n  and `bw_guides_manage`, each filterable via `bw_guides_read_capability` /\n  `bw_guides_manage_capability`. A site can now let everyone read the\n  documentation without also letting them change it:\n\n  ```php\n  add_filter( 'bw_guides_read_capability', function () { return 'read'; } );\n  ```\n\n  Both capabilities are granted automatically to anyone holding `edit_posts` —\n  the capability that gated everything before — so **no site loses a screen on\n  upgrade and nobody's access changes**. The floor is a `user_has_cap` filter, so\n  it needs no activation and no migration. Administrators also get an explicit\n  role grant so the names appear in capability-manager plugins.\n\n### Fixed\n- **A site widening access to let staff *read* guides was also handing them the\n  ability to change guides for everybody.** One capability answered two very\n  different questions. Every AJAX endpoint writes — tags are shared taxonomy\n  terms, notes annotate the guide itself rather than a per-user copy, and the\n  update check runs a full sync that creates, updates and trashes posts — so\n  they are now gated by the manage capability, never the read one.\n- A read-only viewer no longer sees the tag editor or notes field. They rendered\n  and then failed on save, which read as a bug rather than as a boundary.\n- The background update check is no longer fired for readers, whose request\n  would only 403. Their view still reflects whatever the daily cron, or any\n  colleague with manage rights, last pulled in.\n- Uninstalling now removes both capabilities from every role.\n\n### Notes\n- Mirrors the capability split in BW Lead AI, with one deliberate difference: the\n  floor is whatever already granted access, not a fixed capability. Lead AI floors\n  at `manage_options` because that is what gated it; copying that here would have\n  locked Editors and Authors out of documentation they can read today.\n- The **settings screen deliberately stays on `manage_options`** rather than moving\n  to the manage capability: it exposes the site key, a bearer credential."
}