only allow the user to view purchase list