introduce yiew buyable info permission, consider buyable related permissions in buyable controls, docs, comments