UPDATE :
multiple contacts creation limitation has been resolved. You can create as many contacts as u like per a single session.
NOTE - in case of anonymous users (i.e. not logged-in). the user.id will contain a meaningless value (encrypted value). in the upcoming days, this value will be updated after each createContact invocation.
Tom: Are you saying that an authenticated user (especially one with appropriate privileges can save to the crm and be given an existing id back - based upon loginEmail value?
If a contactCreate() call when not logged in with a pre-existing loginEmail is made then that should generate an error and not return any kind of id. This should be something that a crm-backend call should be able to override using a similar technique to wix-data with
“suppressAuth”: true/false
I would like to prevent duplication of crm records if at all possible and be able to control when they are created with the security of backend code.
Looking forward to trying this out.
Cheers
Tom, thank you for resolving this.
Hi stcroppe,
Are you saying that an authenticated user (especially one with appropriate privileges can save to the crm and be given an existing id back - based upon loginEmail value?
If a contactCreate() call when not logged in with a pre-existing loginEmail is made then that should generate an error and not return any kind of id
you’re right. fix will be deployed in a matter of hours.
Excellent!
Also some food for thought.
If you think about how REST APIs are implemented there are some well defined API verbs that are used that should be considered here. Since this interface is offering limited CRUD capabilities then it would be great to retain some of the principles:
Create should only really be a first time creation of the record and its key properties and there after any key property conflicts should result in an error.
How do I update something that I cannot see, especially if multiple people are potentially changing the data? I use read to get a current copy, modify the fields and use one of the update actions to make changes (assuming I have privileges todo so). Delete is the same.
The only way an update should fail is if someone has changed the record I started with (in the case of a modify (patch)) or the record doesn’t exist (most likely being it was deleted).
Trying to use create for multiple purposes will likely continue to generate forum and support issues for you.
Cheers
Steve
I may be incorrect, but I believe this change is causing an error on my end. Last week this worked fine, now it is not. I am wanting a wixCRM contact to be created and added to my Member Database simultaneously to a new user signing up.
Unfortunately, when this code runs, I get an Error 403 permission denied.
How am I supposed to create and subsequently save a newContact() upon a new user registering?
//New user has just been created
wixCRM.createContact( {
"emails": [userEmail],
} )
.then( (contactId) => {
const toInsert = {
"_id": userId,
"email": userEmail,
"contact_id": contactId
};
// add the item to the collection
wixData.insert("Member_Database", toInsert)
.then ( () => {
wixLocation.to(`/Members/${wixUsers.currentUser.id}/Update`);
})
.catch( (err) => {
console.log(err);
} );
} );
Hi David:
Have you tried putting some console.log statements in before you set up toInsert?
Just to make sure that the createContact is failing.
Also it might be worth re-arranging your code a little to stream line the promises and verify the data you are using. For example
wixCreateContact(...)
.then((contactId) => {
console.log(...);
if (!userId || !contactId || !userEmail) {
throw Error('bad parameter'); // Force the catch to process error
}
// All required paramaters valid
return wixData.insert(...); // Pass promise back to the next then
})
.then( () => {
wixLocation.to(...);
})
.catch((err) => {
console.log(err);
});
It is possible that any crm changes have resulted in the problem you are dealing with. The change I proposed should only fail if you already have a contact in your crm with the same loginEmail you are trying to create. My request was to prevent duplicate records with the same email key. This would be a security issue if changing or duplicating a pre-existing record was allowed without appropriate privileges. Also I proposed permitting an override in backend code using an override such as
"suppressAuth": true/false
Be good to get some feedback from Tom.
Hi David:
I ran some test on this myself today. I get the 403 error when I test my page using the editor preview mode but I don’t get it when I load the same page on my live site. So it may be something to do with how the Editor works with the CRM back end?
Steve - I will have someone relevant address your suggestions. I can only respond to bugs or API issues.
David - can u better clarify from which line of code you’re getting the 403 error from? the change mentioned in my last update only affects the error code response, not a logical change. So i doubt if you’re affected by it. moreover, wix-data and wix-crm/users are not directly related in your case.
Hey Tom –
It is specifically the wixCRM create contact that is causing the error. If I grey this out, the code works fine and creates a new Member in the dataset. When I leave it in the code I get the following error:
Uncaught (in promise) permission_denied, details: {“RequiredRole”:“Anonymous User”,“GivenIds”:“66ad7fa8-4486-44a8-aff5-6e46d56c8b29”} (403)
wixCRM.createContact( { "emails": [userEmail], } )
.then( (contactId) => {
// ... Creates new member and inserts into database, along with the ContactId, if that code worked.
});
Hi David,
you’re trying to create a contact when you’re already logged in as a member - which we block for security purposes.
we will document it properly, it’s a relatively new fix.
Ok – That makes sense. So I would need to re-write the code to create a contact after the user is logged in, then add that contact ID to the member record.
Hi David:
I think Tom is saying that you need to be logged out to create a new contact.
Tom: That doesn’t make much sense if you can createContact() when not logged in. The real problem, as I see it, is in the area I have mentioned before. This is the problem created by using createContact() for update as well as create. The update capability of the wix-crm.createContact() function call is the real problem and security issue. This is why I have advocated modifying the CRM API to use a CRUD style api which would make these problems easier to manage and keep secure.
Tom can you clarify using a matrix what the expected outcomes are with createContact()?
for example:
Logged In | Logged Out
Anonymous N/A | Can Create
Member Cannot Create | Can Create (essentially anonymous)
Can update own info?
Admin Can Create/Update | Can Create (essentially anonymous)
Also can you clarify the relationship with wix-users? As an example my assumption is the the column above that says ‘Logged In’ is essentially dependent on the wix-users API. So developers should examine the currentUser state in wix-users before executing any wix-crm commands. Does that make sense? Worth documenting this.
1.5 yrs later this API is still not working. I have posted why here https://www.wix.com/corvid/forum/community-discussion/calling-createcontact-with-logged-in-user-returns-403-error