From 9195f623a29bcfec4f345b5d6a40dc439a02f38b Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Mon, 9 Feb 2026 22:01:56 -0500 Subject: [PATCH 01/14] #863 Fix controller dash navbar formatting --- resources/views/inc/dashboard_head.blade.php | 37 +++++++++----------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/resources/views/inc/dashboard_head.blade.php b/resources/views/inc/dashboard_head.blade.php index 6fde59c0..4739899e 100644 --- a/resources/views/inc/dashboard_head.blade.php +++ b/resources/views/inc/dashboard_head.blade.php @@ -1,25 +1,22 @@ - + + + From 75dcc41de0c1ada7a3937674d778334fa7065a5f Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Mon, 9 Feb 2026 23:45:45 -0500 Subject: [PATCH 02/14] #863 Lay framework for impersonation --- app/Providers/AppServiceProvider.php | 2 ++ app/User.php | 12 ++++++++ app/View/Composers/ImpersonationComposer.php | 31 ++++++++++++++++++++ resources/views/inc/dashboard_head.blade.php | 21 ++++++++----- 4 files changed, 59 insertions(+), 7 deletions(-) create mode 100644 app/View/Composers/ImpersonationComposer.php diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php index c7df652b..9e0904ec 100644 --- a/app/Providers/AppServiceProvider.php +++ b/app/Providers/AppServiceProvider.php @@ -4,6 +4,7 @@ use App\Enums\FeatureToggles; use App\Enums\SessionVariables; +use App\View\Composers\ImpersonationComposer; use Illuminate\Pagination\LengthAwarePaginator; use Illuminate\Pagination\Paginator; use Illuminate\Support\Collection; @@ -29,6 +30,7 @@ public function boot(): void { View::share('FeatureToggles', FeatureToggles::class); View::share('SessionVariables', SessionVariables::class); + View::composer('inc.dashboard_head', ImpersonationComposer::class); /** * Paginate a standard Laravel Collection. diff --git a/app/User.php b/app/User.php index 08bb784f..d2525010 100644 --- a/app/User.php +++ b/app/User.php @@ -73,6 +73,18 @@ public function getFullNameRatingAttribute() { return $this->full_name . ' - ' . $this->rating_short; } + public function getImpersonationNameAttribute() { + $roles = array_reduce($this->roles->toArray(), function ($role_string, $role) { + return $role_string . $role['name'] . ', '; + }, ''); + + if ($roles != '') { + $roles = ' (' . trim($roles, ', ') . ')'; + } + + return $this->full_name . ' ' . $this->id . ' - ' . $this->rating_short . $roles; + } + public static $RatingShort = [ 0 => 'N/A', 1 => 'OBS', 2 => 'S1', diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php new file mode 100644 index 00000000..95568562 --- /dev/null +++ b/app/View/Composers/ImpersonationComposer.php @@ -0,0 +1,31 @@ +isAbleTo('snrStaff')) { + $users = User::get()->pluck('impersonation_name', 'id'); + } + + $view->with('users', $users)->with('is_impersonating', $is_impersonating); + } +} diff --git a/resources/views/inc/dashboard_head.blade.php b/resources/views/inc/dashboard_head.blade.php index 4739899e..c11ae741 100644 --- a/resources/views/inc/dashboard_head.blade.php +++ b/resources/views/inc/dashboard_head.blade.php @@ -3,20 +3,27 @@ @include('inc.logo', ['color' => 'black']) -
- {{ html()->form()->route('searchAirport')->class(['row','row-cols-lg-auto'])->open() }} +
    + {{ html()->form()->route('searchAirport')->class(['form-inline'])->open() }}
    {{ html()->text('apt', null)->placeholder('Search Airport ICAO')->class(['form-control']) }}  
    {{ html()->form()->close() }} -
- + From 6e39399c031ffb25e1c7df5b8513284093e5aeb1 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Tue, 10 Feb 2026 10:23:03 -0500 Subject: [PATCH 03/14] #863 Add routes for impersonation and set session var --- app/Enums/SessionVariables.php | 1 + .../Controllers/ImpersonationController.php | 25 +++++++++++++++++++ app/User.php | 2 +- app/View/Composers/ImpersonationComposer.php | 2 +- resources/views/inc/dashboard_head.blade.php | 6 ++--- routes/web.php | 5 ++++ 6 files changed, 36 insertions(+), 5 deletions(-) create mode 100644 app/Http/Controllers/ImpersonationController.php diff --git a/app/Enums/SessionVariables.php b/app/Enums/SessionVariables.php index b50691b0..61eb4114 100644 --- a/app/Enums/SessionVariables.php +++ b/app/Enums/SessionVariables.php @@ -8,4 +8,5 @@ enum SessionVariables: string { case VATSIM_AUTH_STATE = 'vatsimauthstate'; case REALOPS_PILOT_REDIRECT = 'pilot_redirect'; case REALOPS_PILOT_REDIRECT_PATH = 'pilot_redirect_path'; + case IMPERSONATE = 'impersonate'; } diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php new file mode 100644 index 00000000..3610f562 --- /dev/null +++ b/app/Http/Controllers/ImpersonationController.php @@ -0,0 +1,25 @@ +user_id); + if (is_null($user)) { + return redirect()->back()->with(SessionVariables::ERROR->value, 'That user does not exist'); + } + + session()->put(SessionVariables::IMPERSONATE->value, $user->id); + return redirect('/dashboard'); + } + + public function stop() { + session()->forget(SessionVariables::IMPERSONATE->value); + return redirect('/dashboard'); + } +} diff --git a/app/User.php b/app/User.php index d2525010..b3168e93 100644 --- a/app/User.php +++ b/app/User.php @@ -82,7 +82,7 @@ public function getImpersonationNameAttribute() { $roles = ' (' . trim($roles, ', ') . ')'; } - return $this->full_name . ' ' . $this->id . ' - ' . $this->rating_short . $roles; + return $this->backwards_name . ' ' . $this->id . ' - ' . $this->rating_short . $roles; } public static $RatingShort = [ diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php index 95568562..e67529d5 100644 --- a/app/View/Composers/ImpersonationComposer.php +++ b/app/View/Composers/ImpersonationComposer.php @@ -23,7 +23,7 @@ public function compose(View $view): void { $is_impersonating = false; if (Auth::user()->isAbleTo('snrStaff')) { - $users = User::get()->pluck('impersonation_name', 'id'); + $users = User::orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); } $view->with('users', $users)->with('is_impersonating', $is_impersonating); diff --git a/resources/views/inc/dashboard_head.blade.php b/resources/views/inc/dashboard_head.blade.php index c11ae741..bea5436d 100644 --- a/resources/views/inc/dashboard_head.blade.php +++ b/resources/views/inc/dashboard_head.blade.php @@ -15,11 +15,11 @@
    Dashboard Home @if($is_impersonating) - End Impersonation + End Impersonation @endif @if(Auth::user()->isAbleTo('snrStaff')) - {{ html()->form()->route('searchAirport')->class(['form-inline'])->open() }} - {{ html()->select('student', $users, Auth::id())->class(['form-select']) }} + {{ html()->form()->route('startImpersonation')->class(['form-inline'])->open() }} + {{ html()->select('user_id', $users, Auth::id())->class(['form-select'])->attributes(['onchange' => 'this.form.submit()']) }} {{ html()->form()->close() }} @else {{ Auth::user()->full_name }} - {{ Auth::user()->rating_short }} diff --git a/routes/web.php b/routes/web.php index 43187cca..24707364 100644 --- a/routes/web.php +++ b/routes/web.php @@ -333,6 +333,11 @@ Route::prefix('monitor')->middleware('permission:staff')->group(function () { Route::get('/', 'AdminDash@backgroundMonitor'); }); + + Route::prefix('impersonation')->group(function() { + Route::post('/', 'ImpersonationController@start')->middleware('permission:snrStaff')->name('startImpersonation'); + Route::get('/stop', 'ImpersonationController@stop')->name('stopImpersonation'); + }); }); }); /* From bd206574779b74076fd1fba83b7f6053bef46f12 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Tue, 10 Feb 2026 10:31:41 -0500 Subject: [PATCH 04/14] #863 Implement impersonation --- app/Http/Kernel.php | 1 + app/Http/Middleware/Impersonation.php | 26 ++++++++++++++++++++ app/View/Composers/ImpersonationComposer.php | 3 ++- 3 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 app/Http/Middleware/Impersonation.php diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 869e64d7..a8608452 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -35,6 +35,7 @@ class Kernel extends HttpKernel { \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, \App\Http\Middleware\VerifyCsrfToken::class, \Illuminate\Routing\Middleware\SubstituteBindings::class, + \App\Http\Middleware\Impersonation::class, ], 'api' => [ diff --git a/app/Http/Middleware/Impersonation.php b/app/Http/Middleware/Impersonation.php new file mode 100644 index 00000000..9762c777 --- /dev/null +++ b/app/Http/Middleware/Impersonation.php @@ -0,0 +1,26 @@ +has(SessionVariables::IMPERSONATE->value) && Auth::user()->isAbleTo('snrStaff')) { + Auth::onceUsingId(session(SessionVariables::IMPERSONATE->value)); + } + + return $next($request); + } +} diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php index e67529d5..cf297683 100644 --- a/app/View/Composers/ImpersonationComposer.php +++ b/app/View/Composers/ImpersonationComposer.php @@ -2,6 +2,7 @@ namespace App\View\Composers; +use App\Enums\SessionVariables; use App\User; use Auth; use Illuminate\View\View; @@ -20,7 +21,7 @@ public function __construct( */ public function compose(View $view): void { $users = null; - $is_impersonating = false; + $is_impersonating = session()->has(SessionVariables::IMPERSONATE->value); if (Auth::user()->isAbleTo('snrStaff')) { $users = User::orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); From 2ba80028f03bf69117dc7949bb7efef33dc63cbf Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Tue, 10 Feb 2026 10:35:30 -0500 Subject: [PATCH 05/14] #863 Add warning to users when impersonating --- app/Enums/SessionVariables.php | 1 + app/Http/Controllers/ImpersonationController.php | 2 +- resources/views/inc/messages.blade.php | 7 +++++++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/app/Enums/SessionVariables.php b/app/Enums/SessionVariables.php index 61eb4114..f54609d6 100644 --- a/app/Enums/SessionVariables.php +++ b/app/Enums/SessionVariables.php @@ -4,6 +4,7 @@ enum SessionVariables: string { case SUCCESS = 'success'; + case WARNING = 'warning'; case ERROR = 'error'; case VATSIM_AUTH_STATE = 'vatsimauthstate'; case REALOPS_PILOT_REDIRECT = 'pilot_redirect'; diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php index 3610f562..f303af54 100644 --- a/app/Http/Controllers/ImpersonationController.php +++ b/app/Http/Controllers/ImpersonationController.php @@ -15,7 +15,7 @@ public function start(Request $request) { } session()->put(SessionVariables::IMPERSONATE->value, $user->id); - return redirect('/dashboard'); + return redirect('/dashboard')->with(SessionVariables::ERROR->value, 'Successfully started impersonationg ' . $user->full_name . '. CAUTION: Impersonating actively logs you into the user\'s REAL account. Changes made while impersonating will be reflected on the user\'s actual account. PROCEED WITH CARE.'); } public function stop() { diff --git a/resources/views/inc/messages.blade.php b/resources/views/inc/messages.blade.php index 5b696ce7..99321fa1 100644 --- a/resources/views/inc/messages.blade.php +++ b/resources/views/inc/messages.blade.php @@ -16,6 +16,13 @@ @endif +@if(session()->has($SessionVariables::WARNING->value)) +
    +
    + {{ session($SessionVariables::WARNING->value) }} +
    +@endif + @if(session()->has($SessionVariables::ERROR->value))
    From 6e5571a1097b20cb58c0cb757b98b0d5ad285445 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Tue, 10 Feb 2026 11:32:55 -0500 Subject: [PATCH 06/14] #863 Filter out inactive users from impersonation --- app/View/Composers/ImpersonationComposer.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php index cf297683..29068b9f 100644 --- a/app/View/Composers/ImpersonationComposer.php +++ b/app/View/Composers/ImpersonationComposer.php @@ -24,7 +24,7 @@ public function compose(View $view): void { $is_impersonating = session()->has(SessionVariables::IMPERSONATE->value); if (Auth::user()->isAbleTo('snrStaff')) { - $users = User::orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); + $users = User::where('status', 1)->orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); } $view->with('users', $users)->with('is_impersonating', $is_impersonating); From 7ce78ece68d0e52fd9480b72d6ab10c0781c3e35 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Tue, 10 Feb 2026 11:34:28 -0500 Subject: [PATCH 07/14] #863 Add visitor flag to impersonation list --- app/User.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/User.php b/app/User.php index b3168e93..837ac01e 100644 --- a/app/User.php +++ b/app/User.php @@ -78,6 +78,10 @@ public function getImpersonationNameAttribute() { return $role_string . $role['name'] . ', '; }, ''); + if ($this->visitor) { + $roles = 'visitor'; + } + if ($roles != '') { $roles = ' (' . trim($roles, ', ') . ')'; } From 66d1c7b6e38c842b0f2b1893225fef4eb0f3af31 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Tue, 10 Feb 2026 17:18:45 -0500 Subject: [PATCH 08/14] #863 Put impersonation behind feature toggle --- app/Enums/FeatureToggles.php | 1 + app/Enums/SessionVariables.php | 1 + app/Http/Middleware/Impersonation.php | 7 ++++--- app/View/Composers/ImpersonationComposer.php | 15 +++++++++------ resources/views/inc/dashboard_head.blade.php | 4 ++-- routes/web.php | 2 +- 6 files changed, 18 insertions(+), 12 deletions(-) diff --git a/app/Enums/FeatureToggles.php b/app/Enums/FeatureToggles.php index 75e56334..b5b7852f 100644 --- a/app/Enums/FeatureToggles.php +++ b/app/Enums/FeatureToggles.php @@ -10,4 +10,5 @@ enum FeatureToggles: string { case CUSTOM_THEME_LOGO = 'custom_theme_logo'; case LOCAL_HERO = 'local-hero'; case AUTO_SUPPORT_EVENTS = 'auto_support_events'; + case IMPERSONATION = 'impersonation'; } diff --git a/app/Enums/SessionVariables.php b/app/Enums/SessionVariables.php index f54609d6..028406d4 100644 --- a/app/Enums/SessionVariables.php +++ b/app/Enums/SessionVariables.php @@ -10,4 +10,5 @@ enum SessionVariables: string { case REALOPS_PILOT_REDIRECT = 'pilot_redirect'; case REALOPS_PILOT_REDIRECT_PATH = 'pilot_redirect_path'; case IMPERSONATE = 'impersonate'; + case IMPERSONATING_USER = 'impersonating_user'; } diff --git a/app/Http/Middleware/Impersonation.php b/app/Http/Middleware/Impersonation.php index 9762c777..8dc4c917 100644 --- a/app/Http/Middleware/Impersonation.php +++ b/app/Http/Middleware/Impersonation.php @@ -2,6 +2,7 @@ namespace App\Http\Middleware; +use App\Enums\FeatureToggles; use App\Enums\SessionVariables; use Closure; use Illuminate\Http\Request; @@ -15,9 +16,9 @@ class Impersonation * * @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next */ - public function handle(Request $request, Closure $next): Response - { - if (session()->has(SessionVariables::IMPERSONATE->value) && Auth::user()->isAbleTo('snrStaff')) { + public function handle(Request $request, Closure $next): Response { + if (toggleEnabled(FeatureToggles::IMPERSONATION) && session()->has(SessionVariables::IMPERSONATE->value) && Auth::user()->isAbleTo('snrStaff')) { + session()->put(SessionVariables::IMPERSONATING_USER->value, Auth::id()); Auth::onceUsingId(session(SessionVariables::IMPERSONATE->value)); } diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php index 29068b9f..587c1ea5 100644 --- a/app/View/Composers/ImpersonationComposer.php +++ b/app/View/Composers/ImpersonationComposer.php @@ -2,6 +2,7 @@ namespace App\View\Composers; +use App\Enums\FeatureToggles; use App\Enums\SessionVariables; use App\User; use Auth; @@ -20,13 +21,15 @@ public function __construct( * Bind data to the view. */ public function compose(View $view): void { - $users = null; - $is_impersonating = session()->has(SessionVariables::IMPERSONATE->value); + if (toggleEnabled(FeatureToggles::IMPERSONATION)) { + $users = null; + $is_impersonating = session()->has(SessionVariables::IMPERSONATE->value); - if (Auth::user()->isAbleTo('snrStaff')) { - $users = User::where('status', 1)->orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); - } + if (Auth::user()->isAbleTo('snrStaff')) { + $users = User::where('status', 1)->orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); + } - $view->with('users', $users)->with('is_impersonating', $is_impersonating); + $view->with('users', $users)->with('is_impersonating', $is_impersonating); + } } } diff --git a/resources/views/inc/dashboard_head.blade.php b/resources/views/inc/dashboard_head.blade.php index bea5436d..cd9c04ef 100644 --- a/resources/views/inc/dashboard_head.blade.php +++ b/resources/views/inc/dashboard_head.blade.php @@ -14,10 +14,10 @@
    Dashboard Home - @if($is_impersonating) + @if(toggleEnabled($FeatureToggles::IMPERSONATION) && $is_impersonating) End Impersonation @endif - @if(Auth::user()->isAbleTo('snrStaff')) + @if(toggleEnabled($FeatureToggles::IMPERSONATION) && Auth::user()->isAbleTo('snrStaff')) {{ html()->form()->route('startImpersonation')->class(['form-inline'])->open() }} {{ html()->select('user_id', $users, Auth::id())->class(['form-select'])->attributes(['onchange' => 'this.form.submit()']) }} {{ html()->form()->close() }} diff --git a/routes/web.php b/routes/web.php index 24707364..3a6a1e7f 100644 --- a/routes/web.php +++ b/routes/web.php @@ -334,7 +334,7 @@ Route::get('/', 'AdminDash@backgroundMonitor'); }); - Route::prefix('impersonation')->group(function() { + Route::prefix('impersonation')->middleware('toggle:impersonation')->group(function () { Route::post('/', 'ImpersonationController@start')->middleware('permission:snrStaff')->name('startImpersonation'); Route::get('/stop', 'ImpersonationController@stop')->name('stopImpersonation'); }); From 44aa20bf26e7d2fa145edbd1f49066170e8db249 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Sun, 15 Feb 2026 10:36:04 -0500 Subject: [PATCH 09/14] #863 Fix formatting --- app/Http/Controllers/ImpersonationController.php | 3 +-- app/Http/Middleware/Impersonation.php | 5 ++--- app/View/Composers/ImpersonationComposer.php | 1 - 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php index f303af54..9849fc41 100644 --- a/app/Http/Controllers/ImpersonationController.php +++ b/app/Http/Controllers/ImpersonationController.php @@ -6,8 +6,7 @@ use App\User; use Illuminate\Http\Request; -class ImpersonationController extends Controller -{ +class ImpersonationController extends Controller { public function start(Request $request) { $user = User::find($request->user_id); if (is_null($user)) { diff --git a/app/Http/Middleware/Impersonation.php b/app/Http/Middleware/Impersonation.php index 8dc4c917..7433dcc0 100644 --- a/app/Http/Middleware/Impersonation.php +++ b/app/Http/Middleware/Impersonation.php @@ -4,13 +4,12 @@ use App\Enums\FeatureToggles; use App\Enums\SessionVariables; +use Auth; use Closure; use Illuminate\Http\Request; use Symfony\Component\HttpFoundation\Response; -use Auth; -class Impersonation -{ +class Impersonation { /** * Handle an incoming request. * diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php index 587c1ea5..c6c86e7e 100644 --- a/app/View/Composers/ImpersonationComposer.php +++ b/app/View/Composers/ImpersonationComposer.php @@ -7,7 +7,6 @@ use App\User; use Auth; use Illuminate\View\View; -use Laratrust\Models\Role; class ImpersonationComposer { /** From d9bc82ab04872895826c17d81d116abc4562a203 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Sun, 15 Feb 2026 10:51:07 -0500 Subject: [PATCH 10/14] #863 Add impersonation to audit log --- app/Audit.php | 14 +++++++++- ...e_audits_add_impersonated_by_id_column.php | 27 +++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 database/migrations/2026_02_23_141539_update_audits_add_impersonated_by_id_column.php diff --git a/app/Audit.php b/app/Audit.php index 86769df9..23758faf 100644 --- a/app/Audit.php +++ b/app/Audit.php @@ -2,6 +2,7 @@ namespace App; +use App\Enums\SessionVariables; use Auth; use Illuminate\Database\Eloquent\Model; @@ -17,10 +18,21 @@ public function getTimeDateAttribute() { } public static function newAudit(string $message): void { + $impersonated_by_id = null; + $impersonation_string = ''; + if (session()->has(SessionVariables::IMPERSONATING_USER->value)) { + $impersonated_by_id = session(SessionVariables::IMPERSONATING_USER->value); + $impersonation_user = User::find($impersonated_by_id); + + $impersonation_string = 'IMPERSONATED BY ' . (is_null($impersonation_user) ? 'UNKNOWN' : $impersonation_user->full_name) . ': '; + } + $impersonated_by_id = session()->has(SessionVariables::IMPERSONATING_USER->value) ? session(SessionVariables::IMPERSONATING_USER->value) : null; + $audit = new Audit; $audit->cid = Auth::id(); + $audit->impersonated_by_id = $impersonated_by_id; $audit->ip = $_SERVER['REMOTE_ADDR']; - $audit->what = Auth::user()->full_name . ' ' . $message; + $audit->what = $impersonation_string . Auth::user()->full_name . ' ' . $message; $audit->save(); } } diff --git a/database/migrations/2026_02_23_141539_update_audits_add_impersonated_by_id_column.php b/database/migrations/2026_02_23_141539_update_audits_add_impersonated_by_id_column.php new file mode 100644 index 00000000..8e409dd0 --- /dev/null +++ b/database/migrations/2026_02_23_141539_update_audits_add_impersonated_by_id_column.php @@ -0,0 +1,27 @@ +integer('impersonated_by_id')->nullable(); + + $table->foreign('impersonated_by_id')->references('id')->on('roster')->nullOnDelete(); + }); + } + + /** + * Reverse the migrations. + */ + public function down(): void { + Schema::table('audits', function (Blueprint $table) { + $table->dropColumn('impersonated_by_id'); + }); + } +}; From 1a512872444f2ad230c6bfdc2cce447c6f7c8c86 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Sun, 15 Feb 2026 10:53:51 -0500 Subject: [PATCH 11/14] #863 Disable changing impersonation when impersonating --- app/Http/Controllers/ImpersonationController.php | 5 +++++ resources/views/inc/dashboard_head.blade.php | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php index 9849fc41..c5e7d997 100644 --- a/app/Http/Controllers/ImpersonationController.php +++ b/app/Http/Controllers/ImpersonationController.php @@ -9,10 +9,15 @@ class ImpersonationController extends Controller { public function start(Request $request) { $user = User::find($request->user_id); + $is_impersonating = session()->has(SessionVariables::IMPERSONATE->value); if (is_null($user)) { return redirect()->back()->with(SessionVariables::ERROR->value, 'That user does not exist'); } + if ($is_impersonating) { + return redirect()->back()->with(SessionVariables::ERROR->value, 'You must first stop impersonating your current user before beginning a new session'); + } + session()->put(SessionVariables::IMPERSONATE->value, $user->id); return redirect('/dashboard')->with(SessionVariables::ERROR->value, 'Successfully started impersonationg ' . $user->full_name . '. CAUTION: Impersonating actively logs you into the user\'s REAL account. Changes made while impersonating will be reflected on the user\'s actual account. PROCEED WITH CARE.'); } diff --git a/resources/views/inc/dashboard_head.blade.php b/resources/views/inc/dashboard_head.blade.php index cd9c04ef..78805905 100644 --- a/resources/views/inc/dashboard_head.blade.php +++ b/resources/views/inc/dashboard_head.blade.php @@ -19,7 +19,7 @@ @endif @if(toggleEnabled($FeatureToggles::IMPERSONATION) && Auth::user()->isAbleTo('snrStaff')) {{ html()->form()->route('startImpersonation')->class(['form-inline'])->open() }} - {{ html()->select('user_id', $users, Auth::id())->class(['form-select'])->attributes(['onchange' => 'this.form.submit()']) }} + {{ html()->select('user_id', $users, Auth::id())->class(['form-select'])->attributes(['onchange' => 'this.form.submit()'])->disabled($is_impersonating) }} {{ html()->form()->close() }} @else {{ Auth::user()->full_name }} - {{ Auth::user()->rating_short }} From 99cee5c6e1b69071001f8719fac919bd3e5d18c3 Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Sun, 15 Feb 2026 10:55:36 -0500 Subject: [PATCH 12/14] #863 Track impersonation start/end in audit log --- app/Http/Controllers/ImpersonationController.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php index c5e7d997..182d8dab 100644 --- a/app/Http/Controllers/ImpersonationController.php +++ b/app/Http/Controllers/ImpersonationController.php @@ -3,6 +3,7 @@ namespace App\Http\Controllers; use App\Enums\SessionVariables; +use App\Audit; use App\User; use Illuminate\Http\Request; @@ -19,10 +20,14 @@ public function start(Request $request) { } session()->put(SessionVariables::IMPERSONATE->value, $user->id); + Audit::newAudit('started impersonating user ' . $user->impersonation_name . '.'); + return redirect('/dashboard')->with(SessionVariables::ERROR->value, 'Successfully started impersonationg ' . $user->full_name . '. CAUTION: Impersonating actively logs you into the user\'s REAL account. Changes made while impersonating will be reflected on the user\'s actual account. PROCEED WITH CARE.'); } public function stop() { + Audit::newAudit('impersonation session ending...'); + session()->forget(SessionVariables::IMPERSONATE->value); return redirect('/dashboard'); } From ec3d26052f1eeabbf2ee1ad3038649f39df0456e Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Sun, 22 Feb 2026 22:41:41 -0500 Subject: [PATCH 13/14] Fix formatting --- app/Http/Controllers/ImpersonationController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Http/Controllers/ImpersonationController.php b/app/Http/Controllers/ImpersonationController.php index 182d8dab..ea0a800f 100644 --- a/app/Http/Controllers/ImpersonationController.php +++ b/app/Http/Controllers/ImpersonationController.php @@ -2,8 +2,8 @@ namespace App\Http\Controllers; -use App\Enums\SessionVariables; use App\Audit; +use App\Enums\SessionVariables; use App\User; use Illuminate\Http\Request; From 6796661388b1446e1be85d22eba7bf6ed60585ef Mon Sep 17 00:00:00 2001 From: Ian Cowan Date: Mon, 23 Feb 2026 09:28:27 -0500 Subject: [PATCH 14/14] #863 Impersonation for web staff only --- app/Http/Middleware/Impersonation.php | 2 +- app/View/Composers/ImpersonationComposer.php | 2 +- resources/views/inc/dashboard_head.blade.php | 2 +- routes/web.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/Http/Middleware/Impersonation.php b/app/Http/Middleware/Impersonation.php index 7433dcc0..96d40193 100644 --- a/app/Http/Middleware/Impersonation.php +++ b/app/Http/Middleware/Impersonation.php @@ -16,7 +16,7 @@ class Impersonation { * @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next */ public function handle(Request $request, Closure $next): Response { - if (toggleEnabled(FeatureToggles::IMPERSONATION) && session()->has(SessionVariables::IMPERSONATE->value) && Auth::user()->isAbleTo('snrStaff')) { + if (toggleEnabled(FeatureToggles::IMPERSONATION) && session()->has(SessionVariables::IMPERSONATE->value) && Auth::user()->hasRole('wm') || Auth::user()->hasRole('awm')) { session()->put(SessionVariables::IMPERSONATING_USER->value, Auth::id()); Auth::onceUsingId(session(SessionVariables::IMPERSONATE->value)); } diff --git a/app/View/Composers/ImpersonationComposer.php b/app/View/Composers/ImpersonationComposer.php index c6c86e7e..78d757db 100644 --- a/app/View/Composers/ImpersonationComposer.php +++ b/app/View/Composers/ImpersonationComposer.php @@ -24,7 +24,7 @@ public function compose(View $view): void { $users = null; $is_impersonating = session()->has(SessionVariables::IMPERSONATE->value); - if (Auth::user()->isAbleTo('snrStaff')) { + if (Auth::user()->hasRole('wm') || Auth::user()->hasRole('awm')) { $users = User::where('status', 1)->orderBy('lname', 'ASC')->get()->pluck('impersonation_name', 'id'); } diff --git a/resources/views/inc/dashboard_head.blade.php b/resources/views/inc/dashboard_head.blade.php index 78805905..4b1ba0d1 100644 --- a/resources/views/inc/dashboard_head.blade.php +++ b/resources/views/inc/dashboard_head.blade.php @@ -17,7 +17,7 @@ @if(toggleEnabled($FeatureToggles::IMPERSONATION) && $is_impersonating) End Impersonation @endif - @if(toggleEnabled($FeatureToggles::IMPERSONATION) && Auth::user()->isAbleTo('snrStaff')) + @if(toggleEnabled($FeatureToggles::IMPERSONATION) && (Auth::user()->hasRole('wm') || Auth::user()->hasRole('awm'))) {{ html()->form()->route('startImpersonation')->class(['form-inline'])->open() }} {{ html()->select('user_id', $users, Auth::id())->class(['form-select'])->attributes(['onchange' => 'this.form.submit()'])->disabled($is_impersonating) }} {{ html()->form()->close() }} diff --git a/routes/web.php b/routes/web.php index 3a6a1e7f..39f42f6c 100644 --- a/routes/web.php +++ b/routes/web.php @@ -335,7 +335,7 @@ }); Route::prefix('impersonation')->middleware('toggle:impersonation')->group(function () { - Route::post('/', 'ImpersonationController@start')->middleware('permission:snrStaff')->name('startImpersonation'); + Route::post('/', 'ImpersonationController@start')->middleware('role:wm|awm')->name('startImpersonation'); Route::get('/stop', 'ImpersonationController@stop')->name('stopImpersonation'); }); });