Well, the first 2 items on your list are already done for you by sessions.
Just create a session upon login and start writing their shopping cart into their session. You can also have the session based shopping cart be an object, read up on objects in the manual. Global objects are nice, that way you could have a global cart you could access from any function and the cart properties would of course be completely encapsulated from the rest of the code, so $item['itemID'] would be a different entity than $GLOBALS['myCart']->item['itemID'];
///if you set it up as a class can create global functions...
like $GLOBALS['myCart']->addItem();
//Either way, you can set object vars from anywhere...
$GLOBALS['myCart']->items['itemID']++;
And of course, the entire cart would be held in a single variable referenced solely as $GLOBALS['myCart'], which makes managing large amounts of data over several page requests very easy.
As far as the other two, you're going to have to code those yourself. The concepts you outline there speak of something very custom to the clients needs and arent' something you're going to find just laying around on some script repository... though I may be wrong. But, I doubt you'd find a free solution for that. I know Oracle9i-as has some nice stuff for groups and sub-groups as it operates as a portal and allows various domains to be tracked and referenced, but that's gonna cost some $change$ to get into that.
I have something capable of doing that though, it allows for infinite portals (which can all be easily customized for branding) and scalability as a single source directory can service any number of domains and cnames on any given host machine and all access their own database and $DOC_ROOT. Additionally, it can be run as it's own forking server and spawn child processes on the host machine. I haven't bothered writing an HTTP server object for it, but it's very feasible if I wanted to do so. But I'm not just handing it out, as I offer that as a service and charge per license to my clients.
But, if I wrote one, you could too.