How do trade eosio token and other token (NFT) in contract?

Question

I'm trying to develop NFT's contract with reference to unicoeos/eosio.nft.
Also I'm trying to develop NFT's shop contract in order to trade NFT and eosio.token.

The logic trading NFT and eosio.token is:

1. Dealer registers his NFT in a table for the shop's contract.
2. Buyer sends transaction to buy dealer's NFT in the table.
3. The shop's contract validate some parameters in the transaction.
4. The shop's contract run transfer action for eosio.token contract as inline action to send EOS to Dealer from Buyer.
5. The shop's contract run transfer action for NFT' contract as inline action to send NFT to Buyer from Dealer.

I think it is a normal trade with two other token. But transfer action for both eosio.token's and NFT's contract have to require sender authority.
In above case, it is required the authority for Buyer to run transfer for eosio.token (in the list 4)
and the authority for Dealer to run transfer for NFT (in the list 5).

When buyer sends transaction to buy dealer's NFT, it is possible to permit buyer's authority but not possible to permit dealer's authority.

So how do shop's contract send NFT without dealer's authority ? Thank you for your help!

Answer 1

You should use your contract account owner as a mediator. Then you have full permission to do all actions.

Instead of sending EOS between Dealer and Buyer, Dealer will send token to shop's contract account with message "deal propose", Contract will read this message, and do indicated action and vice versa ...

To work with this method, you need catch up the transactions which sending by Dealer and Buyner. Use following method:

#define EOSIO_ABI_EX(TYPE, MEMBERS)                                            \
extern "C" {                                                                 \
  void apply(uint64_t receiver, uint64_t code, uint64_t action) {              \
    if (action == N(onerror)) {                                                \
      /* onerror is only valid if it is for the "eosio" code account and       \
       * authorized by "eosio"'s "active permission */                         \
      eosio_assert(code == N(eosio), "onerror action's are only valid from "   \
                                     "the \"eosio\" system account");          \
    }                                                                          \
    auto self = receiver;                                                      \
    if (code == self || code == N(eosio.token) || action == N(onerror)) {      \
      TYPE thiscontract(self);                                                 \
      switch (action) { EOSIO_API(TYPE, MEMBERS) }                             \
      /* does not allow destructor of thiscontract to run: eosio_exit(0); */   \
    }                                                                          \
  }                                                                            \
}

refer: https://github.com/quoxoft/eoscreator/blob/master/contract/new_account/new_account.hpp