Command Palette: "Edit post type" command is available to non-admin users

[ockham]

The "Edit post type" command takes the user to SCF's "Post Type" screen, where properties of a CPT can be modified (e.g. singular/plural labels, associated taxonomies, etc).

It is currently registered unconditionally, meaning that it's available not only to admins, but also to users with lesser privileges -- who cannot actually modify a post type. Those users, when selecting that command, will be presented with an error message:

Sorry, you are not allowed to edit this item.

While WordPress makes sure that users cannot escalate their privileges this way, the command should not show up for users that lack the required permissions.

[ockham]

Since the command is CPT related, it makes sense for it to live in custom-post-type-commands.js (rather than admin-commands.js, which is only enqueued for admin-level users).

A permissions check on the client side could solve this; however, there is no dedicated WP capability for creating a post type (AFAIK). Internally, SCF has its own "meta" CPT (acf-post-type) to manage user-created post types, so we could theoretically check that CPT's edit_post capability. However, that CPT is registered with show_in_rest set to false, so we don't have any information about it available on the client side.