This might have come up before, but I can't seem to find it.
If I wanted to be a good Moodle citizen, at what level should I be checking capabilities? I'm thinking specifically about code that does something you will always need a capability for (like updating a record) and might be called from several places. What's the done thing?
I could leave it up to each of those places to check the capability, but I feel like that's leaving a lot of surface area for bugs. I could integrate the capability check into the function, but I feel like that's adding complexity and possibly messing myself up in the future for things like unit tests. Is it the responsibility of the questionnaire to know whether the entity currently trying to edit a question has the capability to do so in this context?
Any help or feedback appreciated. Cheers!
It might be more information than you're looking for, but it would be worth having a look at https://docs.moodle.org/dev/Communication_Between_Components (particularly the diagram in "Ideal Plugin Design" which should explain what you want to know).
Regarding questionnaire, we need to check capability before display 'edit' option and also need to check capability using require_capability function before enable the edit mode.