Customer groups and access control
Customer groups are the backbone of permissions in GrandNode. Every customer belongs to at least one group, and the group decides what the customer may do - see prices, use the cart, open the admin panel, edit products. Groups also drive business rules: free shipping, tax exemption, minimum and maximum order totals, and which products, categories or discounts a customer can see. Use this article to understand the built-in groups and to create your own, for example "Wholesale" or "VIP".
Where to find it
Go to Customers → Customer groups. The list shows each group with Free shipping, Tax exempt, Active and Is system group.
The built-in groups
| Group | Who is in it | Default permissions |
|---|---|---|
| Administrators | Operators of the whole installation. | Everything, including the admin panel, settings, plugins and permissions. |
| Registered | Every customer with an account. | Browse, see prices, use cart and wishlist, use the Web API. |
| Guests | Visitors without an account. | Browse, see prices, use cart and wishlist. |
| Vendors | Accounts that manage a vendor (a seller). | The vendor panel: own products, orders, shipments, merchandise returns, vendor reviews and reports. |
| Store manager | Accounts that run one store in a multi-store installation. | The store manager panel: products, categories, brands, collections, orders, payments, shipments, merchandise returns, customers and reports of that store. |
| Sales manager | Accounts linked to a sales employee. | The admin panel, limited to orders and customers assigned to their sales employee. |
System groups cannot be deleted or deactivated, and their System name cannot be changed - GrandNode finds them by that name. You can rename them and change their other settings.
How to create a customer group
- On Customers → Customer groups click Add new.
- Enter a Name, for example "Wholesale". A System name is optional - it matters only to plugins or custom code that look the group up.
- Set the options you need (see the table below) and keep Active on.
- Click Save and Continue Edit. The Recommended products and Access control list tabs become available.
- Add customers to the group on each customer's Customer Info tab, in Customer groups.
Fields and settings
| Field | What it does |
|---|---|
| Name | Name shown in the admin panel. |
| System name | Stable identifier for code. Read-only on system groups. |
| Free shipping | Members never pay for shipping. |
| Tax exempt | No tax is charged to members. |
| Active | An inactive group is ignored - its permissions and benefits do not apply. |
| Enable password lifetime | Members must change their password after the number of days set in Password lifetime in customer settings. |
| Min order total amount | Checkout is blocked until the cart reaches this total. If a customer is in several groups, the lowest minimum applies. |
| Max order total amount | Checkout is blocked above this total. With several groups, the highest maximum applies. |
The Recommended products tab lists products suggested to members of the group. They are ignored by default for performance; enable them in the performance section of catalog settings. The User fields tab stores extra key/value data for plugins and integrations.
The access control list
The Access control list tab shows every permission in GrandNode - Access Admin Panel, Access Store Manager Panel, Access Vendor Panel, Display Prices, Enable Shopping Cart, Manage Products, Manage Orders and so on - with a tick or a cross for this group.
- Click Edit on a row, tick or clear Access and save the row.
- For permissions with finer actions a gear icon appears. Click it to choose which actions the group may perform - for example allow List and Preview of products but not Delete or Export.
A customer's permissions are the sum of the permissions of all their active groups. The same matrix for all groups at once is under Configuration → Permissions.
Limiting content to groups
Products, categories, brands, collections, pages, news, knowledgebase articles, courses, documents and checkout attributes have a Limited to customer groups field. When you pick groups there, only members of those groups see the item. This is how you build a wholesale price list, members-only products or pages only approved B2B customers can read. (Discounts can be tied to groups with a discount rule instead.) The check can be switched off for the whole installation with AccessControl:IgnoreAcl in appsettings.json, which makes large catalogues faster when you do not need it.
Tips and common mistakes
- Removing Display Prices from Guests is the quickest way to hide prices until customers sign in.
- Do not take Access Admin Panel or Manage ACL away from Administrators - you can lock yourself out.
- Giving a group Access Store Manager Panel is not enough on its own: the account must also have Manager of store set. The same applies to vendors.
Related
Question not answered here? Ask the community on GitHub Discussions ↗