What access do you suppose to give for plugins? Take into account once you allow someone to install new plugins – that person may get admin access to your blog easily.
I’m not really sure what access is needed for a support. I mean, if any plugin is not working proper, and I’m asking the developer for help I usual give him Admin access to look for the issue.
But I have a shop, and I don’t want to show the business reports and my customer addresses.
Usual support does not change anything, just saying do this or that…
I want to give them as much capability as necessary to check a problem but not even more.
You are an expert with roles, do you know what capability is necessary?
An extra plugin for Woocommerce would be great! Give the shop manager capability from only find information for prepare shipping to edit products. Hide for all, except me, the business reports and much more…
You are right, WooCommerce has no read-only access feature for this moment. It is possible to block access to the selected admin menu items, which you don’t wish to be accessed by the user, e.g. URE Pro does, for example:
https://www.role-editor.com/woocommerce-menu-manage-access/
Other roles access management URE Pro add-on may be useful, you can manage which roles user may select from WordPress drop-down menu when add/edit users:
https://www.role-editor.com/other-roles-access/
If you do not trust to the developer, never give him istall_plugins, install_themes, edit_files, edit_plugins, edit_themes capabilities. Give ‘edit_users’ with additional restrictions for the available roles only.
In general, if you have a serious problem with WooCommerce, full access is needed to resolve it. Make test purchase, change something in the settings, re-test purchase again, check reports, etc.
I see 2 decisions only:
1) work with trusted developer on long-term basis, sign ‘non disclosure agreement’ with him.
2) have site copy for the testing purpose with the fake database of customers where you give developer full access. You should transfer changes to the live server yourself in this case.
