Backend workflows: In what situations do you allow to run without authentication?

[randomanon]

@boston85719

Additionally, the use if ‘ignore privacy rules’ should be used in this example in my opinion, since the User data type should have privacy rules on it, and the schedule of backend workflow to send in the parameter of company should be set to ‘current users company’ and when in the backend, the current user may not be recognized if not logged in when the backend workflow runs, so having the ignore privacy rules on the schedule of backend workflow action as well as on the backend workflow trigger itself, to ensure the correct company is sent to the backend workflow as a parameter and all of the correct related data entries are found based on the parameter of ‘company’.

This is a good point. If a backend workflow schedules itself with the current user as a parameter, the second one would be ran by “the system,” right? Meaning it wouldn’t recognize it as Thing’s Creator.

[boston85719]

@randomanon

If a backend workflow schedules itself with the current user as a parameter, the second one would be ran by “the system,” right? Meaning it wouldn’t recognize it as Thing’s Creator.

I’m not 100% sure, but it is likely, since the user is not the one to schedule that second backend workflow and instead would be ‘the system’, although, Bubble may have smartly made it work in such a way as to recognize that the first schedule workflow was done by a user, so maybe they made it that any other backend workflows schedule in the chain would inherit the user, but I don’t know for sure.

Definitely is the case with webhooks though. I generally try to do the same type of thing regardless of the situation, which would mean, that if I need to do it a certain way for chains of backend workflows initiated by webhooks to function properly, I’ll use the same approach for the chains of backend workflows initiated by the user…but of course there are going to be times when there are needs to alter an approach.

As an example of webhooks, when I work with Stripe, I often need to search for a User based on an incoming webhook, so something like subscription id or customer id, which are under privacy rules, but I need to access the user data type in webhook backend action to then schedule other backend workflows in the chain. Or if working with a system that connects Zoom with Google Calendars. The google calendars details are hidden by privacy rules, but the webhook from zoom requires me to search for the User to get their google calendar details to add the event they have been invited to via zoom. When zoom webhook is received in the app, I need to ignore privacy rules in order to find the user.

[randomanon]

OK, so I actually created a test workflow and discovered the following:

You don’t have to pass the User as a parameter, and you don’t need to ignore authentication or ignore privacy rules, the “Current user” authentication is passed along as long as the original trigger is from a logged in Current User. It also obeys any conditions related to the Current User (e.g., Current User’s Role is ___).

This actually is better than using a “user” parameter since theoretically if you’re passing this from the client they can input whatever user they want.

You can see this in the scheduler itself:

I also confirmed that “Current user is logged in” succeeds as a condition, even if you’re logged out, assuming again that you triggered the initial workflow while logged in. It just keeps carrying over.

[boston85719]

Thanks for making the test and confirming this.