Cascading, Contextual & Granular User Permissions (access and restrictions) & Privacy by extending WordPress's core user roles & capabilities API

While thinking about the best way to implement #420, I got a little distracted and ended up exploring WordPress's user roles and capabilities to figure out a good way to manage privacy of questions, answers and notes.

Adding all my findings here as notes for future reference.

The current user object is initialised way before the default WP_Query is loaded in https://github.com/WordPress/WordPress/blob/master/wp-blog-header.php#L16 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/functions.php#L1027 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp.php#L734 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp.php#L607 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/pluggable.php#L69 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/user.php#L2662-L2681 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/pluggable.php#L38

In the end an instance of WP_User is created for the current user. When creating the user object, the user is assigned all the capabilities available for them:

https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L133-L156 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L171 ->

This step generates the usermeta key for capabilities specific to the user: https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L820 ->

This step pulls in all the capabilities that the user has individually (specific to the user id):
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L822 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L846

This step pulls in all the capabilities that the user has on account of having a particular role:
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L824 ->
https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L495-L508

All the capabilities specific to the user are found in `WP_User->caps` and all the capabilities including those not specific to the individual user but the Role are found in `WP_User->all_caps`.

Roles behave like Personas which are just collections of capabilities.

So, by the time the default query runs, a users' capabilities are all already in place. Here onwards, we can check if a user has a certain capability using various wrappers of `WP_User->has_cap( $capability )`. What is not well known is that this functionality takes another parameter called `$object_id` that can represent the current object (lesson, post, course, etc): https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-user.php#L720