Secrets API: New `manage_secrets` capability is not used.

[peterwilsoncc]

The Secrets API introduces a new capability manage_secrets and adds it to the administrator role during the upgrade routine.

However this is not used in the code base, ie the string user_can( 'manage_secrets' ) nor user_can( WP_SECRETS_CAP_MANAGE ) appears in the code base.

Additionally:

It's been some time since new capabilities have been added to the database during an upgrade routine, instead they have been added as faux capabilities via filters, for example see view_site_health_checks (​code reference).

The capability is defined as a constant, suggesting that if it is intended to be used that developers should be using the constant rather than current_user_can( 'manage_secrets' ). This is a non-standard pattern in WordPress and shouldn't be introduced as it will lead to developer confusion. This is likely to result in bugs in themes and plugins checking the capability as it will mix the constant and the hard coded text.

As the capability is not been used, I suggest it be removed wholesale from WordPress 7.2 in favour of the existing use of the manage_options capability.

manage_secrets was added to the administrator role in the database by populate_roles_720() and upgrade_720(), but nothing in core checks it.

This makes it a meta capability instead, mapped to manage_options in map_meta_cap(). That matches how manage_network_secrets is already handled and avoids adding a stored capability during an upgrade routine.

• Adds a manage_secrets case to map_meta_cap().
• Removes populate_roles_720() and upgrade_720(), which only existed to grant the capability.
• Updates the WP_SECRETS_CAP_MANAGE docblock.
• Updates the Secrets capability tests and moves manage_secrets from the primitive to the meta capability lists in Tests_User_Capabilities.

The capability name is kept so WP-CLI and a future admin screen can still check it, as the constant's docblock describes. The ticket proposes removing it entirely; I'm happy to change the patch to do that if that is preferred.

Sites that already ran the upgrade on a 7.2 beta keep a stored manage_secrets entry on the administrator role. It has no effect after this change, and this patch does not remove it.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Fable 5.2
Used for: Writing the patch and tests and running the test suite; I reviewed the changes.