Log in as another user in Rails
As an admin, there are times you want to see exactly what another user sees. Meet Pretender.
:boom: Rock on
Pretender is flexible and lightweight - less than 100 lines of code :-)
Works with any authentication system - Devise, Authlogic, and Sorcery to name a few.
:tangerine: Battle-tested at Instacart
Add this line to your application’s Gemfile:
gem "pretender"And add this to your ApplicationController:
class ApplicationController < ActionController::Base
impersonates :user
endSign in as another user with:
impersonate_user(user)The current_user method now returns the impersonated user.
You can access the true user with:
true_userAnd stop impersonating with:
stop_impersonating_userCreate a controller
class UsersController < ApplicationController
before_action :require_admin! # your authorization method
def index
@users = User.order(:id)
end
def impersonate
user = User.find(params[:id])
impersonate_user(user)
redirect_to root_path
end
def stop_impersonating
stop_impersonating_user
redirect_to root_path
end
endAdd routes
resources :users, only: [:index] do
post :impersonate, on: :member
post :stop_impersonating, on: :collection
endCreate an index view
<ul>
<% @users.each do |user| %>
<li>Sign in as <%= button_to user.name, impersonate_user_path(user), data: {turbo: false} %></li>
<% end %>
</ul>And show when someone is signed in as another user in your application layout
<% if current_user != true_user %>
You (<%= true_user.name %>) are signed in as <%= current_user.name %>
<%= button_to "Back to admin", stop_impersonating_users_path, data: {turbo: false} %>
<% end %>If you keep audit logs with a library like Audited, make sure it uses the true user.
Audited.current_user_method = :true_userAnd add this to your ApplicationCable::Connection:
module ApplicationCable
class Connection < ActionCable::Connection::Base
identified_by :current_user, :true_user
impersonates :user
def connect
self.current_user = find_verified_user
reject_unauthorized_connection unless current_user
end
private
def find_verified_user
env["warden"].user # for Devise
end
end
endThe current_user method now returns the impersonated user in channels.
Pretender is super flexible. You can change the names of methods and even impersonate multiple roles at the same time. Here’s the default configuration.
impersonates :user,
method: :current_user,
with: ->(id) { User.find_by(id: id) }Mold it to fit your application.
impersonates :account,
method: :authenticated_account,
with: ->(id) { EnterpriseAccount.find_by(id: id) }This creates three methods:
true_account
impersonate_account
stop_impersonating_accountView the changelog
Everyone is encouraged to help improve this project. Here are a few ways you can help:
To get started with development:
git clone https://github.com/ankane/pretender.git
cd pretender
bundle install
bundle exec rake testNo open issues yet, or sync has not completed.