---
phase: 02-provider-registration-auth
plan: 04
type: execute
depends_on: ["02-03"]
files_modified: [includes/class-access-control.php]
---

<objective>
Implement access control and redirects for provider role.

Purpose: Prevent providers from accessing WP-Admin (except profile) and protect dashboard page.
Output: Access control hooks that enforce provider restrictions per PROJECT.md requirements.
</objective>

<execution_context>
~/.claude/get-shit-done/workflows/execute-plan.md
./summary.md
</execution_context>

<context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/phases/01-foundation-setup/01-03-SUMMARY.md
@.planning/phases/02-provider-registration-auth/02-03-SUMMARY.md

**From PROJECT.md:**
- Constraint: "Providers: restricted capabilities, no WP-Admin access except profile"
- Core value: Admin moderation is the trust layer

**From Phase 1:**
- Provider role `ddhh_provider` exists with no admin capabilities

**From 02-03:**
- Dashboard page exists at /anbieter-dashboard/
</context>

<tasks>

<task type="auto">
  <name>Task 1: Redirect providers away from WP-Admin</name>
  <files>includes/class-access-control.php</files>
  <action>
Create `includes/class-access-control.php` with static method setup_hooks():

Hook into 'admin_init' action:
- Check if current user has role 'ddhh_provider' (use wp_get_current_user()->roles)
- If ddhh_provider AND not accessing profile.php or admin-ajax.php:
  - Get dashboard page URL: get_permalink(get_option('ddhh_jm_dashboard_page_id'))
  - Redirect using wp_redirect($dashboard_url) and exit
- Allow profile.php (providers can edit their profile)
- Allow admin-ajax.php (needed for AJAX requests from frontend)

Hook this to 'init' action in main class.

DO NOT block all admin access - allow profile.php so providers can change their password and email.
DO NOT redirect on AJAX requests (admin-ajax.php must remain accessible).
  </action>
  <verify>Provider user accessing wp-admin/ gets redirected to /anbieter-dashboard/, but wp-admin/profile.php remains accessible</verify>
  <done>WP-Admin redirect implemented, profile access preserved, dashboard redirect functional</done>
</task>

<task type="auto">
  <name>Task 2: Protect dashboard page (logged-in providers only)</name>
  <files>includes/class-access-control.php</files>
  <action>
In class-access-control.php, add static method protect_dashboard():

Hook into 'template_redirect' action:
- Check if current page is dashboard page (using get_option('ddhh_jm_dashboard_page_id'))
- If yes:
  - Check if user is logged in: is_user_logged_in()
  - Check if user has ddhh_provider role
  - If NOT logged in OR NOT ddhh_provider: redirect to login page (get_option('ddhh_jm_login_page_id'))

This ensures only logged-in providers can access the dashboard.

DO NOT use wp_die() - use wp_redirect() to login page with a friendly redirect flow.
  </action>
  <verify>Non-logged-in users accessing /anbieter-dashboard/ get redirected to /anbieter-login/, logged-in providers see dashboard</verify>
  <done>Dashboard protected, only providers can access, redirects to login page if unauthorized</done>
</task>

</tasks>

<verification>
Before declaring plan complete:
- [ ] Provider accessing wp-admin/ gets redirected to dashboard
- [ ] Provider CAN access wp-admin/profile.php
- [ ] Non-logged-in users accessing dashboard get redirected to login
- [ ] Logged-in providers CAN access dashboard
- [ ] Admin users are not affected by redirects
</verification>

<success_criteria>

- All tasks completed
- Provider role properly restricted from WP-Admin
- Dashboard protected and accessible only to providers
- Profile access preserved for providers
- Phase 2 complete - ready for Phase 3 (job submission forms)
</success_criteria>

<output>
After completion, create `.planning/phases/02-provider-registration-auth/02-04-SUMMARY.md`:

# Phase 2 Plan 4: Access Control & Redirects Summary

**Access control enforcing provider restrictions and dashboard protection**

## Accomplishments

- WP-Admin redirect for providers (except profile.php)
- Dashboard page protection (logged-in providers only)
- Login redirect for unauthorized dashboard access
- Profile access preserved for providers

## Files Created/Modified

- `includes/class-access-control.php` - Redirect hooks and protection logic
- `includes/class-ddhh-job-manager.php` - Hook access control setup

## Decisions Made

[Document redirect approach, exceptions made]

## Issues Encountered

[Problems and resolutions, or "None"]

## Next Step

Phase 2 complete. Ready for Phase 3 (Job Management Core).
</output>