Today I a faced a confusing problem in my project.
let me introduce my project briefly.
I am creating a shop with drupal 7 and commerce module.
In my site 2 kinds of people exist. some people are seller and the others are customer. I have created a role called "SELLER" for seller users.
as you know each member has a specific page in his client area called "orders". in this page a member is able to see his orders (it is history of user orders)
and in drupal 7 permission, it is defined that each person is able to see his/her orders only. there is no permission to see the other people's orders. (ONLY ADMINISTRATORS CAN SEE ALL ORDERS)
but in my project, I want to give permission to the sellers to see the other people' orders that contains at least a product that the current seller has introduced.
let me give you an example. Imagine that we have a seller user in our site. his id is "seller_1" seller_1 is selling product_1, product_2 and product_3 in site.
now a new user we called him "customer_1" wants to but product_1 . he make an order and complete it. imagine that order number is "100".
now an order is saved in database and "customer_1" is able to see this order (order number 100) in orders page.
but in my plan the user "seller_1" must be able to see the order number 100 in a specific page that is created via a view.
=============================================
I tried to run this scenario but I have not found a solution yet.
in permission page, I gave "ability to see all orders" permission to seller roles. this modification solved my problem but it really breaks the security of site. because if we grant ability to see all orders to "SELLER" roles, the seller people are able to see all orders in the site even though there is no related product in the orders.
Now, do you have any suggestion for me?
Thanks a lot for your helps.
