Hi all! Is there a recommended best practice for requiring all shoppers to authenticate? Basically, I want logged-in users to behave like a

:default_customer

but I want anyone who is not authenticated to have no permissions. I've currently got a prototype running where I add a custom PermissionSet with

cannot :manage, :all

to the

:default_customer

category. And that seems to generally work...but now I think I have to basically re-implement the original

:default_customer

in a custom role. Am I missing a more elegant solution?

That seems fine, but I’d investigate if you could just modify whatever selects that default customer role to choose between your “can’t do anything “ permission set and the default one depending if the user has authenticated. I don’t recall off the top of my head what that code looks like though.

Thanks! Yeah it would be great to override the default directly but I haven't yet been able to pin that down. It looks like

role_configuration

sets the default, but it just sets a token...not a value from the DB or a class...and I haven't figured out yet how/where the token

'default'

gets connected to the

DefaultCustomer

permission set... https://github.com/solidusio/solidus/blob/4e7fe981df11040441f111e90f64c155243909b1/core/lib/spree/core/role_configuration.rb#L43