Company Access Manager

Last modified in version: 1.2.3

WordPress plugin for hierarchical company and location access control in a vendor portal. Ultimate Member remains responsible for authentication; this plugin owns authorization.

V1 Scope

• Creates ACF-managed company taxonomy and location custom post type records when ACF Pro is active.
• Falls back to PHP registration when ACF Pro is unavailable or has not loaded the ACF content type records yet.
• Stores user access assignments in prefixed user meta:
  • cam_access_level
  • cam_company_id
  • cam_location_ids
• Supports Rental Manager, Company Manager, and Location User access rules.
• Adds a Company Access admin area with dashboard, user access, content restrictions, migration tools, and settings screens.
• Adds standard WordPress user profile fields for access assignments.
• Shows assigned locations as company-filtered responsive checkboxes on user access forms.
• Filters front-end Location CPT queries, including Elementor Loop Grid output, to the current user's accessible locations.
• Uses company taxonomy constraints for Company Manager location listings to avoid recursive frontend query filtering.
• Sorts front-end Location CPT queries by company name, then location name.
• Allows admin customization of access-level display names.
• Exposes the current user's assigned company name as an Elementor dynamic tag and synced user meta key cam_company_name.
• Exposes Location document file name and URL dynamic tags for Elementor Loop Grid templates.
• Adds Elementor Loop Grid query IDs for filtering connector-provided document_upload repeater rows by document type.
• Provides a [location_documents] shortcode for listing Location documents by document type.
• Uses the plugin-managed User Access section as the canonical user permission UI to avoid duplicate ACF user fields.
• Registers the Elementor company-name dynamic tag with Elementor-compatible saved tag reconstruction.
• Adds page-level restriction metadata for company, location, or all-company access through the plugin's canonical Company Access meta box.
• Supports an All Companies page restriction scope for any logged-in Company Access user with an associated company.
• Exposes Locations and Companies to Elementor dynamic controls where Elementor asks WordPress for public post types and taxonomies.
• Enforces direct URL access through template_redirect.
• Provides non-destructive migration from legacy posts and categories.
• Registers local ACF Pro field groups when ACF Pro is active, while preserving server-side validation and enforcement in plugin code.

Installation

Copy this folder into wp-content/plugins/company-access-manager, then activate Company Access Manager in WordPress.

After activation, visit Settings > Permalinks or deactivate/reactivate the plugin if location permalinks do not resolve.

Release Packaging

Use a dedicated release conversation/thread for release builds. A new thread is fine, but it must verify the release version from the repository files and current Git state rather than relying on prior conversation context.

Before packaging a release:

1. Run git status and confirm no unrelated release-blocking changes are present.
2. Read the package version from the plugin header and CAM_VERSION in company-access-manager.php; these values must match and define the release artifact version.
3. Increment the plugin header version and CAM_VERSION in company-access-manager.php.
4. Update an individual file's @version, Last modified in version, or similar marker only when that file's substantive content was changed for the release. Do not sweep unchanged files to the new package version.
5. Commit the version update and intended release changes.
6. Build the upload-ready ZIP file from that clean committed version with:

powershell -ExecutionPolicy Bypass -File .\build-release.ps1

The generated ZIP is written to dist/ and contains a stable top-level company-access-manager/ folder with company-access-manager.php directly inside it. Upload that ZIP through Plugins > Add Plugin > Upload Plugin so WordPress installs the plugin at wp-content/plugins/company-access-manager/company-access-manager.php and recognizes future uploads as upgrades for the existing plugin instead of installing a second copy.

After packaging is complete, treat the generated ZIP as immutable. Do not replace, edit, or rebuild that same versioned ZIP; increment the version again and create a new commit before building another package.

Migration

Use Company Access > Migration Tools.

• Dry Run lists legacy categories that will become companies and legacy posts that will become locations.
• Execute Migration copies records without deleting or modifying original posts, categories, or Ultimate Member roles.
• Migration is idempotent using source ID metadata, so repeated runs should not create duplicate migrated records.

Admin Workflow Documentation

For the operator-facing process to add companies, connect Google Sheets to Ninja Forms, create locations, upload location documents, and assign users, see Company and Location Onboarding Workflow.

Elementor Dynamic Tags

In a Location Loop Grid template, use Location Document File Name for button text and Location Document File URL for the button link. Both tags default to file 1 from the Location's document_upload repeater and include Document Type and File Number controls. Leave Document Type set to Any Type for row-number selection across all uploaded files, or choose Invoice, Work Order, or Manual to select the matching file by type.

Elementor Loop Grid Document Type Queries

When using the Repeaters/Relationships Connector with Loop Grid source set to ACF Repeater and repeater name document_upload, set the Elementor Query ID to one of these values to show only repeater rows with that document type:

cam_document_type_invoice
cam_document_type_workorder
cam_document_type_manual

Location Document Shortcode

On a Location page, use [location_documents type="invoice"] to render all uploaded invoice documents for the current Location. The supported type values are invoice, workorder, and manual.

For a tabbed document section, use one shortcode per tab:

[location_documents type="invoice"]
[location_documents type="workorder"]
[location_documents type="manual"]

Notes

• WordPress administrators bypass all Company Access restrictions.
• Rental Managers can view all restricted content but do not receive plugin administration privileges unless their WordPress role also allows it.
• ACF's documentation notes that PHP-exported/native content type registrations are not manageable from ACF's admin pages. This plugin creates ACF internal records for location and company when ACF is active, then uses PHP registration only as a fallback.
• For Elementor dynamic fields, use the ACF Location Details > Company field on Location posts or Elementor's post terms controls for the Companies taxonomy.
• Search and archive filtering are intentionally out of V1 scope.
• Direct file protection is intentionally out of V1 scope.
• Uninstall is non-destructive by default.