Adding the Order Statuses to the Magento Permission Rules

Question

How to add the order statuses to the permission rules in order to be able to assign a particular order status of a state to a user where he/she is able to change the status for an order only if the permission of that particular order status is granted to them.

Answer 1

Magento does not support the desired behaviour natively.

You can achieve it using the following solution though it isn't the most tidy of approaches.

You'll need to override an admin theme template, or edit the base template file though this is not recommended as it will prevent your ability to upgrade in future.

app/design/adminhtml/base/default/template/sales/order/view/history.phtml, replace lines 34 through 36 from:

<?php foreach ($this->getStatuses() as $_code=>$_label): ?>
    <option value="<?php echo $_code ?>"<?php if($_code==$this->getOrder()->getStatus()): ?> selected="selected"<?php endif; ?>><?php echo $_label ?></option>
<?php endforeach; ?>

to:

<?php
  $admin_user_role = Mage::getSingleton('admin/session')->getUser()->getRole()->getData();
  $restricted_statuses = array('Restricted Status 1', 'Restricted Status 2'); //etc
?>
<?php foreach ($this->getStatuses() as $_code=>$_label): ?>
    <?php if(in_array($_label, $restricted_statuses)): ?>
    <?php //restricted role ?>
        <?php if ($admin_user_role['role_name'] == 'Your Restricted Role'): ?>
        <?php //in which case the user has permission to access this role ?>
            <option value="<?php echo $_code ?>"<?php if($_code==$this->getOrder()->getStatus()): ?> selected="selected"<?php endif; ?>><?php echo $_label ?></option>
        <?php endif; ?>
    <?php else: ?>
    <?php //unrestricted status ?>
        <option value="<?php echo $_code ?>"<?php if($_code==$this->getOrder()->getStatus()): ?> selected="selected"<?php endif; ?>><?php echo $_label ?></option>
    <?php endif; ?>
<?php endforeach; ?>

This way, you're able to specify the restricted statuses using the $restricted_statuses array, and only provide access to the "Your Restricted Role" user.

This obviously isn't ideal as it's hard coded, but using a bit of intuition you'd be able to set up a table in the database to handle this.