Acting as a customer

When to use it

Acting as a customer is a short, time-limited session where you sign in to the site as one of your shoppers and do things on their behalf. You see exactly what they see, and any action you take is recorded as yours.

It's the right tool when:

• A shopper calls in and asks you to place an order for them using the card they already have on file.
• Someone reports a checkout problem and you need to reproduce what they see rather than guess from screenshots.
• A shopper is stuck partway through an order and wants you to finish it with them while they stay on the phone.

Who can act as a shopper

Acting as a customer is limited to market managers, who can act as any active shopper in their own market. For safety, a market manager can't act as another market manager. Growers, volunteers, and shoppers themselves can't use this feature at all—if a volunteer needs to help a shopper, a market manager has to do it.

How to start

There are two places you'll find the "Act as" button:

1. On the shoppers list at /users/list, every row has an "Act as" button on the right side. Use this when you already know who you're looking for.
2. Inside the shopper detail modal (the one that opens when you click a shopper's name), there's an "Act as" button at the top. Use this when you want to glance at their account or cart first.

Either button opens a small dialog with an optional Reason field (up to 250 characters). The reason is for your own records and lands in the audit log—something short like "phone order, Tuesday pickup" or "reproducing failed checkout" goes a long way when you're reviewing the log a week later.

When you submit the dialog, the site signs you in as that shopper and drops you on their storefront at /market.

The banner and countdown

While you're acting as a shopper, a persistent banner sits at the top of every page. It shows:

• The shopper's name, so you never forget whose seat you're in.
• A countdown timer showing how long the session has left.
• A "Stop acting as [name]" button that ends the session immediately.

Sessions have two time limits, and whichever hits first wins:

• A 30-minute sliding window. Every action you take resets the timer back to 30 minutes. Active work keeps the session alive.
• A 2-hour hard cap from the moment you started. Even if you're actively clicking, the session ends two hours in.

The sliding window means you won't get kicked out mid-checkout, and the hard cap means a forgotten session can't linger all day.

What you can do

Most of the site works exactly as it does for the shopper:

• Browse the storefront the way they see it—with their pickup location, their pricing, and their available products.
• Manage their cart: add, remove, or change quantities on items.
• Place an order on their behalf using a card they already have on file. The order lands in their order history with a note identifying you as the market manager who placed it.
• Edit profile fields that you could already edit directly from customer management—name, email, mailing address, phone number, default pickup location.

In short: if it's a normal shopping or profile-tidying action, you can do it from inside an act-as session.

What's off-limits

Some actions are deliberately blocked while you're acting as someone else. If you try, you'll see a message telling you the action isn't available during an act-as session, and the attempt is recorded in the audit log.

The blocked actions are:

• Changing their password.
• Adding, saving, or removing a saved credit card. You can use a card that's already on file, but you can't add or delete one.
• Adding funds to their account balance. Adding funds charges a card right away, so the shopper has to do that part themselves.
• Deactivating their account.
• Toggling their email or mailing preferences.

What the shopper sees

If the shopper happens to be signed in on their own device while you're acting as them, the site is upfront with them about it. A small banner on their side tells them:

• That "[Your first name] from your market is currently helping you" (filled in with your actual first name).
• When the session started.
• When it will auto-expire.

To keep the two of you from stepping on each other, their own cart and checkout writes are paused while the act-as session is active. They can browse, but they can't add to their cart or place an order of their own until you step out.

Orders you place during the session show up in their order history with a clear attribution note saying a market manager placed the order for them.

How to stop

You have three ways out of an act-as session:

• Click "Stop acting as [name]" in the banner at the top of the page. This is the normal way to end a session when you're done.
• Sign out. The signout flow notices you're acting as someone and pops a confirmation dialog that asks what you actually want: just stop acting as this shopper (and stay signed in as yourself), or sign out entirely.
• Do nothing. The session auto-expires after 30 minutes of inactivity or 2 hours total—whichever comes first.

The audit log

The audit log is what makes this feature trustworthy rather than spooky. Every act-as session is recorded from the moment it opens: when it started, when it stopped, every significant write made along the way, every off-limits action a manager tried, and whether the session ended cleanly or by timeout. If a shopper ever asks what happened while someone was helping them, you have a complete, neutral answer.

You can review your market's log at /admin/impersonation-audit.

Filters

All filters combine with AND. An empty field means "no restriction."

• Date range (from, to). Calendar dates are interpreted as start-of-day and end-of-day in your market's configured timezone, so "April 18 – April 18" gives you that one local day's events, not a UTC slice.
• Event type. One of start, stop, action, blocked, or expired — described below.
• Outcome. ok, blocked, or error. Most rows are ok; blocked appears on attempts at off-limits actions; error appears when the underlying request threw.
• Manager name or email. Substring match against the manager at the keyboard.
• Shopper name or email. Substring match against whose seat was taken.

Market managers see only their own market's log; superusers viewing the cross-market system dashboard also get an optional market ID filter.

Reading the events

The five event types are the building blocks every row reduces to:

• start — a session opened. Captures the reason the manager typed in the dialog.
• stop — the manager ended the session themselves, either via the "Stop acting as" banner button or through the sign-out confirmation dialog.
• action — a meaningful write made while acting as the shopper (placing an order, editing their profile, changing their pickup location, etc.). The path and action columns identify which one.
• blocked — the manager tried something off-limits (password change, saved-card add/delete, add-funds, deactivate account, email/mailing preference toggle). The attempt never reached the shopper's account; the row exists so you can see it was tried.
• expired — the 30-minute inactivity timer or the 2-hour hard cap ended the session on its own. No manager click involved.

A typical clean session is one start, zero or more actions, and one stop. A session that was abandoned shows start followed by expired. Any blocked row is always worth a glance.

Downloading the CSV

The Download CSV button pulls every row that matches your current filters into a single file named acting-as-customer-audit-YYYY-MM-DD.csv. It streams as you request it — there's no "email me when ready" step.

Each row has 15 columns:

1. created_at — ISO 8601 UTC timestamp of the event. Convert to your market timezone in your spreadsheet if you need local time in the output.
2. event — one of the five event types above.
3. outcome — ok, blocked, or error.
4. status_code — HTTP status when the event came from an API call; blank otherwise.
5. manager_name — full name of the manager at the keyboard.
6. manager_email — manager's account email.
7. customer_name — full name of the shopper whose seat was taken.
8. customer_email — shopper's account email.
9. market_name — which market the session ran in. Useful on the cross-market superuser export; always your market name on admin exports.
10. method — HTTP method (GET, POST, PUT, DELETE). Blank on non-HTTP events.
11. path — request path, e.g. /api/orders.
12. action — human-readable label for the action, e.g. place_order, update_profile, add_funds_blocked.
13. reason — the free-text reason the manager typed when starting the session. Only populated on start rows.
14. ip_address — client IP the event came from.
15. user_agent — browser/user-agent string.

Good habits

• Put the reason in when you start. A short phrase—"phone order," "checkout bug repro," "helping with membership"—makes the log readable when you or someone else reviews it later.
• Stop when you're done. Don't rely on auto-expiry. Hitting "Stop acting as [name]" is a one-click habit worth forming.
• Don't leave a session open while you walk away. Lock your screen at the very least, but ideally stop the session first.
• Confirm the order details out loud. If you're on the phone with a shopper, read the cart back to them before you place the order. It's easy to misread a quantity when you're typing for someone else.