Login to other user's account with Devise+Active Admin+Switch User

Question

I'm trying to implement switch_user gem in my existing rails 3.0.9 application. There are two models on my application, they are

1. User - for my customer accounts and it has_one Account
2. AdminUser - This was created by ActiveAdmin

I have already enabled devise authentication for Users and ActiveAdmin also working pretty much well with AdminUser. Now from my Active Admin interface I'd like to select the Accounts and login to those account just like the account owner does. Switch user is working fine but the problem is anyone can simply login to the user accounts now if they know the urls.

http://localhost:3000/switch_user?scope_identifier=user_1

All I need is allow only an AdminUser (i.e if there is an ActiveAdmin session) to access the User's accounts.

This is how my /config/initializers/switch_user.rb looks like

SwitchUser.setup do |config|
  config.controller_guard = lambda { |current_user, request| current_admin_user.nil?}
  config.redirect_path = lambda { |request, params| "/dashboard" }
end

But I get this error

NameError in SwitchUserController#set_current_user

undefined local variable or method `current_admin_user' for main:Object

Is there anyway I can access the active admin session?

Code for /config/initializers/active_admin.rb

ActiveAdmin.setup do |config|
  config.site_title = "MyAppName"
  config.authentication_method = :authenticate_admin_user!
  config.current_user_method = :current_admin_user
end

btw in my application controller I haven't created any methods for authenticate_admin_user , current_admin_user active admin works fine without them.

Answer 1

You need modify local config/initializers/switch_user.rb:

config.controller_guard = lambda { |current_user, request, original_user, controller|
    controller.admin_user_signed_in?
}

Original lambda has 2 arguments. Just append more (up to 4) and use it.

Don't forget restart rails server :)

Answer 2

OK I think I found a solution to secure the switch_user. All I did is moving the routes inside the admin_users scope

  ActiveAdmin.routes(self)

  devise_for :admin_users, ActiveAdmin::Devise.config do
    match '/admin/switch_user', :controller => 'switch_user', :action => 'set_current_user'
  end