Hey folks,
So I've got an app that does some series of financial calculations. In its current state, all of the generated records/ models, etc. that are used in the calculations "belong" to Users. This of course requires that someone registers for the app before I can show them outputs.
I've been asked to provide a way to see outputs without having to register. I think it's a fair ask as many use cases are short lived and the burden of registering prevents users from using the app altogether.
What I'd like to do is allow visitors to access the "backend" of my app as if they were a user, but only show them what they've created, as if they were a registered user. For the sake of argument, lets call is Scenarios and Scenarios->belongsTo(User::class)
I had two thoughts as how this might work:
1 - Since I don't want to change any of the actual logic of the app, I continue to use the User model for my "temporary" users. I add a column to the User model that tracks if a User is temporary, and make password nullable. When a scenario is created, I "login" the visitor to this "temporary" user just based on a dynamic URL with some uuid. This also works because then you can share a public URL that effectively "logs" you into this temp user that has access to the Scenario. I then log the last_login_date of users, and if a temp user hasn't had a login over some threshold, I purge the account.
This approach keeps most of my codebase the same, but merges "regular" users with "temporary" users in the same table.
...
2 - Another approach is to make Scenarios independent from Users. I could keep my logic that says if you're a logged in user, you can only see your Scenarios, but now Scenarios has no dependency on the User. So I'd add a uuid to the Scenario and allow it to be accessed via a unique URL. Since that Scenario doesn't belong to a User there's no auth needed, it's just a freely accessible URL, but this will require me to really vet the security/ access permissions on "personal" (non-public) Scenarios.
One downside to this approach is that I never really "remember" any temporary users (there is no session for that temp user), so if that visitor forgets the uuid / URL, then the Scenario will be somewhat lost.
...
I am not convinced either approach is perfect, but maybe someone has thought about this before?
