From a1f589379253bc9f7adb56af837d39bb696e38a3 Mon Sep 17 00:00:00 2001
From: Dhrupo <dhrupo@gmail.com>
Date: Sun, 8 Nov 2026 11:33:34 +0600
Subject: [PATCH] Keep denied capabilities when cloning a role

---
 features/roles.feature | 22 ++++++++++++++++++++++
 src/Role_Command.php   | 10 +++-------
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/features/roles.feature b/features/roles.feature
index 17c1c59f..59643757 100644
--- a/features/roles.feature
+++ b/features/roles.feature
@@ -180,3 +180,25 @@ Feature: Manage WordPress roles
       """
       10
       """
+
+  Scenario: Cloning a role keeps denied capabilities denied
+    When I run `wp cap add author spectate --grant=false`
+    And I run `wp role create reporter Reporter --clone=author`
+    Then STDOUT should be:
+      """
+      Success: Role with key 'reporter' created. Cloned capabilities from 'author'.
+      """
+
+    When I run `wp cap list reporter --show-grant`
+    Then STDOUT should contain:
+      """
+      spectate,false
+      """
+    And STDOUT should not contain:
+      """
+      spectate,true
+      """
+    And STDOUT should contain:
+      """
+      upload_files,true
+      """
diff --git a/src/Role_Command.php b/src/Role_Command.php
index 2a48cc44..7b6df3d4 100644
--- a/src/Role_Command.php
+++ b/src/Role_Command.php
@@ -178,21 +178,17 @@ public function create( $args, $assoc_args ) {
 			WP_CLI::error( "Can't create role, insufficient information provided." );
 		}
 
-		$capabilities = false;
+		$capabilities = array();
 		if ( ! empty( $assoc_args['clone'] ) ) {
 			$role_obj = $wp_roles->get_role( $assoc_args['clone'] );
 			if ( ! $role_obj ) {
 				WP_CLI::error( "'{$assoc_args['clone']}' role not found." );
 			}
-			$capabilities = array_keys( $role_obj->capabilities );
+			$capabilities = $role_obj->capabilities;
 		}
 
-		if ( add_role( $role_key, $role_name ) ) {
+		if ( add_role( $role_key, $role_name, $capabilities ) ) {
 			if ( ! empty( $capabilities ) ) {
-				$role_obj = $wp_roles->get_role( $role_key );
-				foreach ( $capabilities as $cap ) {
-					$role_obj->add_cap( $cap );
-				}
 				WP_CLI::success( "Role with key '{$role_key}' created. Cloned capabilities from '{$assoc_args['clone']}'." );
 			} else {
 				WP_CLI::success( "Role with key '{$role_key}' created." );