Hello,
I want to build a feature where an admin user can enter another user’s account and perform action on their behalf.
When I try to do it, I get the “Action cannot be completed” message.
Is it because these types of actions are not possible due to security? or am I doing sth wrong?
thank you
is it possible to update the user’s password from an action? I can’t find the pattern of when this action fails…
Hey @axme,
In my opinion, there are 2 different questions mixed here.
First question is about “Action can’t be completed”. In such cases as yours, this usually happens because of the collection permissions issues. In Users collection, but default Password is not readable by anyone (“nobody can view”) and editable only by the “owner” user (“only record creator can edit”).
So if you’re trying to update another user’s password, the operation will fail. You can see the logs in browser console, by the way.
However, the 2nd question is different: as I see you would like to switch user accounts in the app “on-the-fly”. My question would be why do you want to force “admin user” enter the password for “target user”. In your setup, if you ever change the password for the “target user”, you won’t be able to change it back to the original one.
In theory, you can set up the flow like “logout admin, enter target user credentials, perform action, logout target user, login admin”, but this will require entering target user password and admin user password afterwards.
What I would suggest is using a single-item list to get “Current User” (which is your target user), and then create/update/etc. orders using this Current User record.
If you’re worried that the admin should enter an extra confirmation for such actions, you can use some kind of pin code (separate field) for that.
Hope this helps.
Best,
Victor.
Thank you very much @Victor for this detailed answer, very appreciated. I’ve solved the accessing part for the other users by changing the collection permission as you suggested.
The reason I need one user to access another user’s account is so that the admin user can charge the customer’s card that’s on file on their behalf.
I’m not sure if this is the only way to do it, but since I need to access the saved credit card from another user I thought I could only do it by having an admin logging in to the other user’s account, charge them and then log them out again and back into the admin account.
The use case is for a medical clinic, where patients are subscribed to a treatment.
Sometimes they need to pay on top and the nurse then needs to charge the patient on their behalf.
For that, the nurse needs to access the card on file from another user.
From what I tried with the Stripe component, this seemed like the only option.
do you know if there’s a safer/better option to do this?
thank you,
Axel
Hi @axme,
Thanks for the explanation, now I better understand the issue.
Frankly speaking, it seems there is no good way doing it in Adalo. Stripe component protects the card of the user (which it must do) - if it allowed to proceed with payments initiated by other users, that’d be a big security flaw.
You could explore an opportunity doing this directly via Stripe API calls. However I can expect you will have to store private key somewhere in Adalo/integration platform, which is not good and also poses a huge security risk if the key is stolen.
As an alternative, you could try to modify the user workflow in this case. E.g. a nurse does not charge the patient directly, but issues an invoice for a certain amount. This invoice appears in patient’s account and patient proceeds with payment using a regular Stripe component.
Such approach will require patient’s interaction but it is more secure.
Best,
Victor.
