@10x-media/impersonation

Let an authorised account sign in as another user without their password, then return. Every session is recorded. After start, req.user is the target.

Part of the @10x-media Payload plugins collection. In beta: published under the beta dist-tag until a stable 1.0.

[!WARNING] Experimental. This plugin mints and revokes sessions. That is not a place where a subtle bug announces itself. It is covered by unit, integration and end-to-end tests against Payload's real routing on Mongo and Postgres, but auth surfaces differ a lot between projects. Try it in staging first, and report anything that looks off.

Quick start

pnpm add @10x-media/impersonation

import { impersonation } from '@10x-media/impersonation'

export default buildConfig({
  plugins: [
    impersonation({
      access: {
        impersonate: ({ req }) => req.user?.roles?.includes('admin') === true,
      },
    }),
  ],
})

access.impersonate is required. Only the literal true allows.

The admin header gets Impersonate. Confirm, and you are that user until you exit. A bar on every admin route (including /admin/unauthorized) shows Acting as and Return to.

Documentation

Full documentation at docs.10xmedia.de:

• Overview
• Quick start
• Configuration
• Security

License

MIT. Copyright 10x Media GmbH.