Skip to content

Conversation

elia
Copy link
Member

@elia elia commented Oct 5, 2025

Disclaimer: this PR was entirely written by codex under my guidance, for good or for bad 😊

Summary

This change will open to having separate classes for customers and backend operators, this brings the following advantages:

  • Security It's impossible to do privilege escalation if the two sets are siloed
  • Authentication most of the time authentication rules for "admins" and customers are quite different, e.g. domain based Google signup for admins, vs. magic link for customers, etc.
  • Impersonation impersonating a customer becomes way easier if you can overlap the two authentication systems

Checklist

Check out our PR guidelines for more details.

The following are mandatory for all PRs:

The following are not always needed:

  • 📖 I have updated the README to account for my changes.
  • 📑 I have documented new code with YARD.
  • 🛣️ I have opened a PR to update the guides.
  • ✅ I have added automated tests to cover my changes.
  • 📸 I have attached screenshots to demo visual changes.

@elia elia self-assigned this Oct 5, 2025
@github-actions github-actions bot added changelog:solidus_backend Changes to the solidus_backend gem changelog:solidus_core Changes to the solidus_core gem changelog:solidus_admin labels Oct 5, 2025
Copy link

codecov bot commented Oct 5, 2025

Codecov Report

❌ Patch coverage is 65.71429% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.31%. Comparing base (d070f94) to head (6d2dfbe).

Files with missing lines Patch % Lines
core/lib/spree/core.rb 33.33% 6 Missing ⚠️
core/lib/spree/testing_support/capybara_ext.rb 0.00% 5 Missing ⚠️
...app/controllers/solidus_admin/orders_controller.rb 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6329      +/-   ##
==========================================
- Coverage   89.35%   89.31%   -0.05%     
==========================================
  Files         961      961              
  Lines       20195    20210      +15     
==========================================
+ Hits        18046    18051       +5     
- Misses       2149     2159      +10     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jarednorman
Copy link
Member

This seems like a good idea to me. This separation could be useful for some marketplace stores we work on as well.

@elia
Copy link
Member Author

elia commented Oct 8, 2025

@jarednorman wanted to do this for a long time, and never got the time until I was able to delegate 😅
If there's buy in I'll give it some more (compute) time and finish this first iteration, later I think we can introduce to a better default for new apps.

cc @rainerdema @spaghetticode

elia added 4 commits October 9, 2025 17:24
…o user_class. Update initializer template, menu conditions, controllers, views, and helper.
…lick) and update admin docs to use Spree.admin_user_class
@elia elia force-pushed the elia/admin-user branch from da9f17b to 6d2dfbe Compare October 9, 2025 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog:solidus_admin changelog:solidus_backend Changes to the solidus_backend gem changelog:solidus_core Changes to the solidus_core gem

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

2 participants