Restricting Subscriber user (self-hosted) access to the app

It was reported in 3864798-zd-woothemes that a Subscriber user on a self-hosted WordPress site was able to access the Blog Posts menu in the app and create a post. The post wasn't able to be uploaded to the site but it'll be saved in the app locally.

Expected behavior

I would expect the Subscriber user will not be able to log in to the app since they're not able to manage the site.

Actual behavior

The Subscriber user is able to log in to the app, access the Blog Posts menu, and create a post. Though the post will not get uploaded to the site, I'm able to view the comments published on the site through My Site > Comments.

Steps to reproduce the behavior

1. Create a Subscriber user on a self-hosted WordPress site
2. Log in as the Subscriber user to the app with the "Enter your existing site address" login option
3. Once logged in, the user will see Stats, Blog Posts, Media, Comments, Settings, View Site, and View Admin options.
4. Tap the floating button to create a new blog post.
5. Tapping the "PUBLISH" button to upload the post, an error will occur and says the post can't be uploaded.
6. Go to My Site > Comment will see the list of comments published on the site.

Tested on OPPO Reno 4, Android 11, WPAndroid 17.1-rc-2

Start by reproducing the self-hosted WordPress login with a Subscriber account and trace how the app determines which users may access site features. Check the login, Blog Posts, Media, and Comments entry points for role or capability enforcement. Done means Subscribers cannot log in or access site content, while permitted roles retain normal access.