Thanks for the quick reply @heshamgaber.
You’re quite right; after accepting the invitation for one of my test users, I was logged in to WordPress.com and confirmed as a member of the site with the correct role, however, that didn’t translate to being logged in to my site until I went to /wp-login.php.
I did also disable caching in WordPress.com just to fully rule that out, though memcached couldn’t be fully disabled.
I also notice that the users with required roles see the post content in WordPress.com Reader, while other users only see the restricted notice, which is a good detail. Is that because of the REST API protection you’ve added?
Edit — it seems inconsistent whether the reader shows content or the restriction message to subscribers who don’t have the required roles, so I’m not sure that’s actually working after all.
-
This reply was modified 3 days, 4 hours ago by joshheald.
