I have gathered as much
Yes you can already do authentication
Yes, this is true, and I believe from reading the documentation, you will have uncovered that in order to authenticate as a user, you need the email and password.
It would not.
In order to authenticate an API call we can do as App Admin by sending in the APP ADMIN API Token, or as a User by sending in email and password.
When we are authenticated as an App Admin by the use of the App Admin API Token, we have secured the API call. When this happens, because the App Admin is authenticated, Bubble allows the actions to run ignoring privacy rules and creating the data with the created by field being App Admin.
When we are in our app editor, we are basically authenticated as the App Admin. We when in the app editor can create data, and if we do the created by is filled in as App Admin. When we are in our app editor, we can do a run as Action to login as a user without their password.
So there is no material difference in terms of security between using the app editor to run as user and login as a user without their password, or authenticating an API call as the App Admin and having an action to run that would be akin to run as user.
We can also send a magic link in an email that creates a login token of sorts that provides a function to send a URL that allows a user to login as a specific user without the password, or even entering the email address or unique ID of that specific user. This functionality is possible because when running server side actions like this, the server is secure and the user would be authenticated as the App Admin, in the same way as if they were in the app editor itself, or if they were authenticated as App Admin via an API call using the App Admin API Token.
If we can do the magic link feature and the run as feature securely, it is 100% without a doubt possible to add a run as user action in a backend workflow that would only be possible to run if the API call is authenticated as the App Admin using the App Admin API Token.
In terms of you not seeing a need for that, I can understand that, not everybody would, which is why I linked the post that gave me the idea that it is a useful and needed function to be added, as at least 1 user has an immediate use case for it, and I’m sure lots of other developers have some in mind (I do) and others may 2-4 years from now, have some that they could come up with.
Yes, but in order for your approach to do what I am talking about (ie: sign the user in through backend workflow and allow the created data be created by that user) you still need to in the backend workflow run the log the user in action, which as per the documentation still requires the email and password of the user. With your approach, we would need to save to the database the user password. And yes, I know, you can have privacy rules, but there is a reason why Bubble doesn’t do that already and in fact, password is the only piece of data not ever made available to the developer, unless the developer fails to follow best practices and decides to save the password to the database.
And yes, as you pointed out, a flaw in your approach would add to the WUs involved since a search is needed to be performed.
Absolutely correct. But something I think you are not understanding, is that with the ability to have a user authenticated on backend workflows we can manage everything as we would everywhere else, as in utilizing the privacy rules to help manage things on a per user basis.
So, your suggestions, although fine, they do cost more money to operate, take more time to implement and open up potential security flaws. Now, I understand ultimately what I believe the point you are trying to make here, which is, we can already do something similar, so no need for a new idea, which, yes, for some people that may be a fine approach to commenting on the idea post as they may not have seen a way that is essentially the same as their idea already being available to them.
For me though, I’m fully aware of all the possibilities you have been suggesting. My idea comes from a pretty deep understanding of how Bubble operates and I see a potential new feature as a way to not only add the to the flexibility of the platform, but also to reduce our costs in operating the function.
But, I thank you for taking the time to highlight the existing ways we can achieve a somewhat similar function of logging the user in via backend workflow and creating data as that user in backend workflow triggered via API.
