Skip to content

Allow setting a different user class for backend users #6329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

Allow setting a different user class for backend users #6329

wants to merge 4 commits into from
+82 −41

Conversation

@elia
Copy link
Member

@elia elia commented Oct 5, 2025 •
edited
Loading

Disclaimer: this PR was entirely written by codex under my guidance, for good or for bad 😊

Summary

This change will open to having separate classes for customers and backend operators, this brings the following advantages:

  • Security It's impossible to do privilege escalation if the two sets are siloed
  • Authentication most of the time authentication rules for "admins" and customers are quite different, e.g. domain based Google signup for admins, vs. magic link for customers, etc.
  • Impersonation impersonating a customer becomes way easier if you can overlap the two authentication systems

Checklist

Check out our PR guidelines for more details.

The following are mandatory for all PRs:

The following are not always needed:

  • 📖 I have updated the README to account for my changes.
  • 📑 I have documented new code with YARD.
  • 🛣️ I have opened a PR to update the guides.
  • ✅ I have added automated tests to cover my changes.
  • 📸 I have attached screenshots to demo visual changes.

@elia elia self-assigned this Oct 5, 2025
@github-actions github-actions bot added changelog:solidus_backend Changes to the solidus_backend gem changelog:solidus_core Changes to the solidus_core gem changelog:solidus_admin labels Oct 5, 2025
@codecov
Copy link

codecov bot commented Oct 5, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 65.71429% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.31%. Comparing base (d070f94) to head (6d2dfbe).

Files with missing lines Patch % Lines
core/lib/spree/core.rb 33.33% 6 Missing ⚠️
core/lib/spree/testing_support/capybara_ext.rb 0.00% 5 Missing ⚠️
...app/controllers/solidus_admin/orders_controller.rb 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #6329      +/-   ##
==========================================
- Coverage   89.35%   89.31%   -0.05%     
==========================================
  Files         961      961              
  Lines       20195    20210      +15     
==========================================
+ Hits        18046    18051       +5     
- Misses       2149     2159      +10

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jarednorman
Copy link
Member

jarednorman commented Oct 7, 2025

This seems like a good idea to me. This separation could be useful for some marketplace stores we work on as well.

@elia
Copy link
Member Author

elia commented Oct 8, 2025

@jarednorman wanted to do this for a long time, and never got the time until I was able to delegate 😅
If there's buy in I'll give it some more (compute) time and finish this first iteration, later I think we can introduce to a better default for new apps.

cc @rainerdema @spaghetticode

elia added 4 commits October 9, 2025 17:24
@elia
Add Spree.admin_user_class and use it across admin/backend; default t…
21ed972 
…o user_class. Update initializer template, menu conditions, controllers, views, and helper.
@elia
Test env: fix ActionMailer preview_paths FrozenError and require fast…
235bf5e 
…_sqlite early for sqlite3 v2
@elia
Silence the puma server for admin specs
6e7eaca
@elia
Specs: make click_icon resilient to intercepted clicks (scroll + JS c…
6d2dfbe 
…lick) and update admin docs to use Spree.admin_user_class
@elia elia force-pushed the elia/admin-user branch from da9f17b to 6d2dfbe Compare October 9, 2025 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@elia elia

Labels

changelog:solidus_admin changelog:solidus_backend Changes to the solidus_backend gem changelog:solidus_core Changes to the solidus_core gem

Projects

Solidus Admin
Status: No status

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@elia @jarednorman