Require capability to dismiss welcome notice

[dknauss]

Description of the Change

Adds a capability check to the AJAX handler that dismisses the welcome notice.

The handler already verifies the nonce. This change also requires manage_options on single-site installs and manage_network_options when the plugin is network active, matching the administrative context where the notice is managed.

Benefits

• Adds a defense-in-depth capability check for a state-changing AJAX request.
• Keeps behavior unchanged for administrators who can manage the relevant settings.

Possible Drawbacks

None expected. Users without the relevant admin capability should not be able to persist this admin notice dismissal state.

Verification Process

• php -l includes/classes/Notifications/Welcome.php
• composer run lint
• git diff --check

Changelog Entry

Fixed - Require the relevant admin capability when dismissing the welcome notice.

Checklist:

• My code follows the code style of this project.
• All new and existing tests pass. (No automated test suite exists in this repo; CI runs lint only.)

AI assistance was used in drafting and reviewing this change; final authorship and verification are mine.

[jeffpaul]

@dknauss is this still in process or can this come out of draft for review?

[Copilot]

Pull request overview

This PR hardens the welcome-notice dismissal flow by adding an authorization check to the wp_ajax_tenup_dismiss_welcome handler, aligning permissions with whether the plugin is network-activated or not.

Changes:

• Require manage_options for single-site (or non-network-activated) installs when dismissing the welcome notice via AJAX.
• Require manage_network_options when the plugin is network activated, before persisting the dismissal state.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dknauss]

Thanks for the reminder @jeffpaul; I had forgotten this.

I just brought it out of draft and pushed a follow-up (ec90bd6) that closes the gap the Copilot review flagged above: the capability check was only on the AJAX dismiss handler. A user below manage_options would still see the dismissible notice but their dismissal wouldn't persist, so it would reappear every page load. The notice render and the script enqueue are now gated on the same capability, so only users who are able to dismiss it ever see it. I've left the redundant exit; after wp_send_json_error() as-is, since that call already ends the request via wp_die().

I also pushed ef98d7b to #228 addressing Copilot's note that an explicit empty-array deny-all was being expanded to all blocks.

#230 and #233 have minor Copilot comments (a float→int timeout truncation and array pass1 input) now, but I'll address those next if you want.