Since no one came up with a good reason not to do what I was asking I assume that my method is kind of safe. So, in order not to leave this question open, I decided to add the code as an answer and mark it as accepted.
So I have a new extension called Easylife_Simulate with the following files:
app/etc/modules/Easylife_Simulte.xml - the declaration file:
<?xml version="1.0"?>
<config>
<modules>
<Easylife_Simulate>
<codePool>local</codePool>
<active>true</active>
<depends>
<Mage_Customer />
</depends>
</Easylife_Simulate>
</modules>
</config>
app/code/local/Easylife/Simulte/etc/config.xml - the configuration file
<?xml version="1.0"?>
<config>
<modules>
<Easylife_Simulate>
<version>0.0.1</version>
</Easylife_Simulate>
</modules>
<global>
<helpers>
<easylife_simulate>
<class>Easylife_Simulate_Helper</class>
</easylife_simulate>
</helpers>
<models>
<easylife_simulate>
<class>Easylife_Simulate_Model</class>
</easylife_simulate>
</models>
<resources>
<easylife_simulate_setup>
<setup>
<module>Easylife_Simulate</module>
<class>Mage_Customer_Model_Resource_Setup</class>
</setup>
</easylife_simulate_setup>
</resources>
</global>
<frontend>
<routers>
<easylife_simulate>
<use>standard</use>
<args>
<module>Easylife_Simulate</module>
<frontName>simulate</frontName>
</args>
</easylife_simulate>
</routers>
</frontend>
<adminhtml>
<events>
<controller_action_layout_render_before_adminhtml_customer_edit>
<observers>
<easylife_simulate>
<class>easylife_simulate/observer</class>
<method>addAutoLoginButton</method>
</easylife_simulate>
</observers>
</controller_action_layout_render_before_adminhtml_customer_edit>
</events>
</adminhtml>
<admin>
<routers>
<adminhtml>
<args>
<modules>
<Easylife_Simulate before="Mage_Adminhtml">Easylife_Simulate_Adminhtml</Easylife_Simulate>
</modules>
</args>
</adminhtml>
</routers>
</admin>
</config>
app/code/local/Easylife/Simulate/sql/easylife_simulate_setup/install-0.0.1.php - install script - adds a new customer attribute:
<?php
$this->addAttribute('customer', 'login_key', array(
'type' => 'text',
'label' => 'Auto login key',
'input' => 'text',
'position' => 999,
'required' => false
));
app/code/local/Easylife/Simulate/Model/Observer.php - observer to add a button in the customer admin edit form
<?php
class Easylife_Simulate_Model_Observer extends Mage_ProductAlert_Model_Observer{
public function addAutoLoginButton($observer){
$block = Mage::app()->getLayout()->getBlock('customer_edit');
if ($block){
$customer = Mage::registry('current_customer');
$block->addButton('login', array(
'label' => Mage::helper('customer')->__('Login as this customer'),
'onclick' => 'window.open(\''.Mage::helper('adminhtml')->getUrl('adminhtml/simulate/login', array('id'=>$customer->getId())).'\')',
), 100);
}
}
}
app/code/local/Easylife/Simulate/controllers/Adminhtml/SimulateController.php - the admin controller that handles the click on the button generated above.
<?php
class Easylife_Simulate_Adminhtml_SimulateController extends Mage_Adminhtml_Controller_Action{
public function loginAction(){
$id = $this->getRequest()->getParam('id');
$customer = Mage::getModel('customer/customer')->load($id);
if (!$customer->getId()){
Mage::getSingleton('adminhtml/session')->addError(Mage::helper('easylife_simulate')->__('Customer does not exist'));
$this->_redirectReferer();
}
else {
$key = Mage::helper('core')->uniqHash();
$customer->setLoginKey($key)->save();
$this->_redirect('simulate/index/index', array('id'=>$customer->getId(), 'login_key'=>$key));
}
}
}
app/code/local/Easylife/Simulate/controllers/IndexController.php - the frontend controller that makes the autologin.
<?php
class Easylife_Simulate_IndexController extends Mage_Core_Controller_Front_Action{
public function indexAction(){
$id = $this->getRequest()->getParam('id');
$key = $this->getRequest()->getParam('login_key');
if (empty($key)){
$this->_redirect('');
}
else{
$customer = Mage::getModel('customer/customer')->load($id);
if ($customer->getId() && $customer->getLoginKey() == $key){
$customer->setLoginKey('')->save();
Mage::getSingleton('customer/session')->setCustomerAsLoggedIn($customer);
Mage::getSingleton('customer/session')->renewSession();
}
$this->_redirect('customer/account/index');
}
}
}
app/code/local/Easylife/Simulte/Helper/Data.php - the module helper
<?php
class Easylife_Simulate_Helper_Data extends Mage_Core_Helper_Abstract{
}
That's it. It seams to work for me. Like I said in the question, the downside is that if 2 admins press the login button for the same customer at (approximately) the same time, one of them will not be logged in. But he can repeat the process a few seconds later.
