[OFBiz] Dev - order creation and view permissions

[Si Chen]

Hello everyone.

I'm thinking of the following changes and would like to know what you think:
1.  Adding a separate ORDERMGR_PO_VIEW permission so that only users (ie 
buyers) with this permission can view purchase orders.  I don't think we 
need a matching ORDERMGR_SO_VIEW to restrict viewing of sales orders.  
(I think most organizations would allow its buyers to view sales 
information.)

2.  Similarly, adding a new ORDERMGR_PO_CREATE permission so that only 
users with this permission can create a purchase order. 

3.  Changing the storeOrder service so that now it will check
(a) for sales orders, it will check if the userLogin's partyId is a 
Sales Representative of this product store
(b) for purchase orders, it will check if the userLogin's partyId has 
the ORDERMGR_PO_CREATE privilege

4.  Another change, for the b2b application, would entail:
(a) for sales orders, if the userLogin's partyId is not a sales 
representative of this product store, then check if the userLogin's 
partyId is related to the customer's partyId as a "Sales Representative".

Would this last change be ok for the rest of the project as well?

Thanks,

Si