Impersonation

public function execute(StartImpersonationData $data): string
{
    $impersonator = User::findOrFail($data->impersonatorId);
    $target = User::findOrFail($data->targetUserId);

    if ($impersonator->id === $target->id) {
        throw ImpersonationException::cannotImpersonateSelf();
    }

    if (! $impersonator->canImpersonate()) {
        throw ImpersonationException::unauthorizedToImpersonate();
    }

    if (! $target->canBeImpersonated()) {
        throw ImpersonationException::cannotImpersonateAdmin();
    }

    if ($this->manager->isImpersonating()) {
        throw ImpersonationException::alreadyImpersonating();
    }

    if (! $target->belongsToTenant(Tenant::findOrFail($data->tenantId))) {
        throw ImpersonationException::targetNotInTenant();
    }

    // ... proceed with impersonation
}

// 1. Use the lab404 package to switch identities
$impersonator->impersonate($target);

// 2. lab404 uses quietLogin() which doesn't fire Login events.
//    Do a proper login() so AuthenticateSession middleware works.
auth()->guard('web')->login($target);

// 3. Restore lab404 session keys (cleared by the Login event listener)
session()->put($this->manager->getSessionKey(), $savedImpersonatorId);
session()->put($this->manager->getSessionGuard(), $savedGuard);
session()->put($this->manager->getSessionGuardUsing(), $savedGuardUsing);

// 4. Store tenant context and impersonated user ID
session()->put('current_tenant_id', $data->tenantId);
session()->put('impersonated_user_id', $data->targetUserId);

// 5. Fire domain event for audit logging
event(new ImpersonationStarted(
    impersonatorId: $data->impersonatorId,
    impersonatedId: $data->targetUserId,
    tenantId: $data->tenantId,
    ipAddress: $data->ipAddress,
    userAgent: $data->userAgent,
));

public function execute(StopImpersonationData $data): User
{
    if (! $this->manager->isImpersonating()) {
        throw ImpersonationException::notImpersonating();
    }

    // 1. Leave impersonation (lab404)
    $data->currentUser->leaveImpersonation();

    // 2. Proper login for the admin (same reason as start)
    $admin = User::findOrFail($data->impersonatorId);
    auth()->guard('web')->login($admin);

    // 3. Clear impersonation session data
    session()->forget('current_tenant_id');
    session()->forget('impersonated_user_id');

    // 4. Fire domain event for audit logging
    event(new ImpersonationEnded(...));

    return $admin;
}

public function me(Request $request, TenantContext $tenantContext, ImpersonateManager $manager): JsonResponse
{
    $user = $request->user();

    $response = [
        'user' => new UserResource($user->load('tenants')),
        'currentTenant' => $tenantContext->get() ? new TenantResource($tenantContext->get()) : null,
    ];

    if ($manager->isImpersonating()) {
        $impersonatorId = $manager->getImpersonatorId();
        $impersonator = User::find($impersonatorId);

        $response['impersonation'] = [
            'is_impersonating' => true,
            'impersonator_id' => $impersonatorId,
            'impersonator_name' => $impersonator?->name,
        ];
    }

    return response()->json($response);
}

const { startImpersonating, stopImpersonating, isStarting, isStopping, error } = useImpersonation()

// From the admin panel — start impersonating a tenant user
await startImpersonating(userId, tenantId)
// 1. Saves current URL to sessionStorage ('impersonation:returnUrl')
// 2. Calls POST /admin/impersonation/start
// 3. Refreshes auth store via refreshAfterSessionChange()
// 4. Shows success toast
// 5. Navigates to /dashboard

// From the impersonation banner — stop impersonating
await stopImpersonating()
// 1. Calls POST /admin/impersonation/stop
// 2. Refreshes auth store via refreshAfterSessionChange()
// 3. Retrieves saved URL from sessionStorage
// 4. Shows success toast
// 5. Navigates to saved URL (or /manager as fallback)

<template>
  <div v-if="authStore.isImpersonating" ref="bannerRef" class="...">
    <span>Viewing as {{ authStore.user?.name }}</span>
    <UButton @click="stopImpersonating" :loading="isStopping">
      Leave
    </UButton>
  </div>
</template>

public function handle(Request $request, Closure $next): Response
{
    if ($this->manager->isImpersonating()) {
        abort(403, __('impersonation.blocked_during_impersonation'));
    }

    return $next($request);
}

public function handle(Request $request, Closure $next): Response
{
    if (! $this->manager->isImpersonating()) {
        abort(400, __('impersonation.impersonation_required'));
    }

    return $next($request);
}

public function handle(ImpersonationStarted|ImpersonationEnded $event): void
{
    ImpersonationLog::create([
        'impersonator_id' => $event->impersonatorId,
        'impersonated_id' => $event->impersonatedId,
        'tenant_id' => $event->tenantId,
        'action' => $event instanceof ImpersonationStarted ? 'started' : 'ended',
        'ip_address' => $event->ipAddress,
        'user_agent' => $event->userAgent,
    ]);
}

public function canBeImpersonated(): bool
{
    return ! $this->isPlatformAdmin();
}

public function canImpersonate(): bool
{
    return $this->isPlatformAdmin();
}