Which user does the Rules module execute as?

Question

I've set up a rule which is triggered by "after saving a new user account". This rule simply sends an e-mail. The e-mail contains various tokens, one of them is the field [account:field_country].

I've enabled "custom permission" for this field, and through the Field Permissions module I've configured the following permissions :

All users (selected permissions):

• Create own value for field Country
• View own value for field country.

Moderators (all permissions) :

• Create own value for field Country
• Edit own value for field Country.
• Edit anyone's value for field country.
• View own value for field Country.
• View anyone's value for field Country.

The problem is : the [account:field_country] gets replaced with an empty string when the rule sends the e-mail. Only when I let all users View anyone's value for field Country does the rule properly replace the token with the actually selected country value.

Why do I need to do this? Which user does the rule module run as since the rule apparently need to View anyone's value for field Country to be able to get the value for that field.

Answer 1

And here is a module that could assist:

Rules switch user

This module adds two new Rules actions:

• Switch to another user
• Switch back from another user

These actions could be useful when you have an operation that you want an unprivileged user to use but it fails because the user doesn't have sufficient permissions.

Create a fictitious user with sufficient permissions and switch to this user when performing the Rules action and switch back again when done.

EDIT This answer is just a workaround and does not speak to the question directly, namely why the current permissions doled out are not allowing the Rule to execute successfully.

Answer 2

IMO your "issue" (that the value of your field is blank) is because of the event (= "after saving a new user account") you are using, which might simply not be the right event. If this user is still "blocked" (= in case your registration procedure requires admin approval), it could make sense for the Rules module to not show the content of this field yet.

Moreover, have a look at issue # 430274, about an event which is a variation of your event here, and somehow explains that "after saving something" actually happens ... "before saving something" (which is not a bug, simply how Rules works ...).

A possible compromise to avoid these kind of issues, is to transform sending your eMail into a Rules Component, so that your original Rule "schedules the execution" (using the Rules Scheduler submodule) of that Rules Component (eg X secs or mins "after saving that new user account" ... if your cron job runs frequent enough, if not it'll be next time cron runs). This compromise will ensure that at the time the Rules Component is executed, the new user account is for sure saved ... (so that can't be the reason anymore then why that field would still be blank ...).

Using this Rules Component approach, you might even take into consideration that you only want to have this eMail send if the user account is "no longer blocked" (if it is still blocked, add some extra Rules logic to reschedule the same component to re-execute somewhere later on).

And by the way: anything about Rules that uses the Rules Scheduler, runs for sure with "Anonymous" authorizations. There are cases (Rules Actions) for which that auth is insufficient of course (eg: create a new nod is not allowed by Anonymous). Even for these cases there is a way to resolve that also (if you want to know how to do that: post a followup question about it).