What you’re building

A Staff Manager screen where a vendor admin can see their store’s staff, invite a new staff member by email, and change an existing member’s role — all from the app, all scoped to vendors the acting user actually manages.

Step 1 — Assign the screen

Add the WC PV – Staff Manager content class (mam_pv_staff_manager) to a tab or screen in the app builder. It lists the staff of the acting user’s current vendor account.

Step 2 — Map the form

Set the Staff Manager form id (option mam_pv_mam_pv_staff_manager_form) in the Product Vendors form settings, and map its fields (name, email, role, restaurant = vendor picker, userid, delete). Submissions dispatch to mam_wc_pv_manage_staff::edit_staff_manager().

Step 3 — Understand the roles

How the form is secured (what admins should know)

Every staff submission is authorized server-side; the request can never pick its own privileges:

• Editing an existing user: the target user must belong to a vendor the acting user manages (or the actor must be a store manager with manage_woocommerce). Otherwise the request is rejected.
• Adding a new user: the restaurant (vendor) the new user is added to must be a vendor the acting user manages. The new user is created with a generated password and an invitation, then added to the vendor’s vendor_data admins list.
• The role being assigned must pass mam_wc_pv_user_can_assign_role, which enforces the mam_pv_assignable_roles whitelist:
  • Default whitelist: wc_product_vendors_manager_vendor, wc_product_vendors_pending_vendor, driver, customer.
  • administrator, shop_manager, editor, and wc_product_vendors_admin_vendor are never grantable through the whitelist — even if a site filter adds them, they are stripped.
  • wc_product_vendors_admin_vendor has one extra path: a store manager, or an existing vendor admin acting on their own vendor’s staff, may grant it.

To add a custom role (say, a kitchen role) to the whitelist:

add_filter( 'mam_pv_assignable_roles', function ( array $roles ) {
    $roles[] = 'kitchen';
    return $roles;
} );

See Hook: mam_pv_assignable_roles for the full contract.

Tips

• A user can belong to more than one vendor; the screens act on the user’s mam_current_vendor_account selection.
• Staff membership lives in the vendor term’s vendor_data meta (admins array) — the same list used for order-complete notifications and payout routing.
• Store managers (manage_woocommerce) pass all vendor-membership checks, so site staff can manage any vendor’s team from the same screen.

Related articles

• Plugin: mam-woocommerce-product-vendors
• Recipe: Vendor onboarding and registration
• Hook: mam_pv_assignable_roles
• Hooks: `mam_wc_pv_usercan` authorization filters*
• Hook: mam_pv_check_user

Metadata