Restrict login for blocked user

dimitri2 · 2024-09-07T20:42:05.483Z

I’m trying to restrict login for a user who’s status is “Cancelled”. I’ve tried reading other forum discussions, but I can’t get this to work.

I created a custom state for the page called “isCancelled” yes/no.

I’ve set up this workflow:

image746×268 11.3 KB

The first step I’m hoping would set the custom state to Yes when searching for the user’s email and find the user status is Cancelled.

image713×353 15.3 KB

It then displays an error text and terminates the flow.

However, I can’t get this to work. It doesn’t seem to be doing the search and just logs in the user. Note, I’m still on a free plan and testing this functionality.

aleemansari97 · 2024-09-07T21:00:33.932Z

Why are you making it so complicated by involving states?

Just apply the condition on “Log the user in” step. Make it, Only when: Current user’s User Role is not Cancelled (to prevent the login). <<If this doesn’t work, only then should you attempt searching (getting current user is way faster than searching)

Once you’ve prevented the login, you can then show the user whatever you want later on

dimitri2 · 2024-09-07T21:43:48.395Z

I’ve tried both options, and it still allows through a login…

image706×358 16.4 KB

davidb · 2024-09-08T01:07:21.661Z

I think that referencing the current user in the login condition wouldn’t work since the user attempting to login isn’t the current user until after being logged in.

Review the debugger for your workflow that uses search in the login condition. I would expect that to work.

Alternatively, follow the login action immediately with a logout action that has the necessary condition.

mghatiya · 2024-09-08T01:59:57.062Z

dimitri2:

I’ve tried both options, and it still allows through a login…

I don’t think ‘current user’ would work. And custom state may not be needed.

Your method of searching user with email and checking user role of first item should work.

If this one is not working, I would check what is the search returning. Is search having right criteria? Are any privacy rules preventing you from getting data?

dimitri2 · 2024-09-08T14:22:37.778Z

I suspect my privacy settings are too restrictive. Should I modify this?

image1178×720 36.1 KB

adamhholmes · 2024-09-08T15:09:41.967Z

Your privacy rules don’t allow access to the User Role field, so it’s not possible to access that value in the expression: Search for Users: first item’s User Role is Not Cancelled.

(it will never be cancelled, as no value is ever returned).

So instead, add User Role is cancelled as a constraint on the Search, then check that the count of returned items is less than 1.

mghatiya · 2024-09-08T17:36:14.894Z

dimitri2:

Should I modify this?

Yes, either you modify this or make change in your query as @adamhholmes suggested.

dimitri2 · 2024-09-10T01:00:08.091Z

Sorry, can you clarify the setup? Am I using this action?

image887×450 32.3 KB

randomanon · 2024-09-10T01:41:43.508Z

As a bonus this is also more WU-efficient.

But I don’t like having everyone be able to search the users.

Here is an alternative using 2 workflows that’s actually more secure IMO:

Workflow 1: When user is logged in → Log the user out (1 action)

Condition: User’s role is Cancelled

Workflow 2: When page is loaded → Go to page (1 action)

Condition 2: User’s role is Cancelled

Both of these workflows operate serverside.

You should also have role-based conditions on EVERY workflow (backend included).

dimitri2 · 2024-09-12T16:47:54.873Z

This solution worked. Here is my setup:

image702×383 16 KB

randomanon · 2024-09-13T10:38:37.233Z

Just FYI, anyone can publicly find out how many users your app has, how many admins, how many cancelled users, etc. using this method. You may not find this to be problematic, but a heads-up to those who want to use this method.

system · 2024-11-16T20:42:36.326Z

This topic was automatically closed after 70 days. New replies are no longer allowed.