solidus icon indicating copy to clipboard operation
solidus copied to clipboard

Allow setting a different user class for backend users

Open elia opened this issue 3 months ago • 3 comments

Disclaimer: this PR was entirely written by codex under my guidance, for good or for bad 😊

Summary

This change will open to having separate classes for customers and backend operators, this brings the following advantages:

  • Security It's impossible to do privilege escalation if the two sets are siloed
  • Authentication most of the time authentication rules for "admins" and customers are quite different, e.g. domain based Google signup for admins, vs. magic link for customers, etc.
  • Impersonation impersonating a customer becomes way easier if you can overlap the two authentication systems

Checklist

Check out our PR guidelines for more details.

The following are mandatory for all PRs:

The following are not always needed:

  • 📖 I have updated the README to account for my changes.
  • 📑 I have documented new code with YARD.
  • 🛣️ I have opened a PR to update the guides.
  • ✅ I have added automated tests to cover my changes.
  • 📸 I have attached screenshots to demo visual changes.

elia avatar Oct 05 '25 22:10 elia

Codecov Report

:x: Patch coverage is 65.71429% with 12 lines in your changes missing coverage. Please review. :white_check_mark: Project coverage is 89.31%. Comparing base (d070f94) to head (6d2dfbe).

Files with missing lines Patch % Lines
core/lib/spree/core.rb 33.33% 6 Missing :warning:
core/lib/spree/testing_support/capybara_ext.rb 0.00% 5 Missing :warning:
...app/controllers/solidus_admin/orders_controller.rb 0.00% 1 Missing :warning:
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6329      +/-   ##
==========================================
- Coverage   89.35%   89.31%   -0.05%     
==========================================
  Files         961      961              
  Lines       20195    20210      +15     
==========================================
+ Hits        18046    18051       +5     
- Misses       2149     2159      +10     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:
  • :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codecov[bot] avatar Oct 05 '25 22:10 codecov[bot]

This seems like a good idea to me. This separation could be useful for some marketplace stores we work on as well.

jarednorman avatar Oct 07 '25 20:10 jarednorman

@jarednorman wanted to do this for a long time, and never got the time until I was able to delegate 😅 If there's buy in I'll give it some more (compute) time and finish this first iteration, later I think we can introduce to a better default for new apps.

cc @rainerdema @spaghetticode

elia avatar Oct 08 '25 11:10 elia