Appearance
Sign In As
Support signs in as a customer from the users list and sees the shop, bookings and account as they do.
kitloom/impersonate · admins: kitloom/impersonate-filament, kitloom/impersonate-nova
Video lessons
Recorded in the Filament admin; the Nova admin works the same way.
Sign in as a customer from the admin and see the site exactly as they do: their account page, orders, bookings, courses, saved cart. When someone writes "my order isn't there" or "the booking button does nothing", you look at the page they look at instead of guessing. A red bar at the foot of every page says whose account you are in and brings you back with one click. The action is on the users of kitloom/impersonate-filament or kitloom/impersonate-nova. WordPress has the same thing as the User Switching plugin.
Who may sign in as whom
| Rule | Why |
|---|---|
The permission Sign in as another user (impersonate_users, under Users on the roles screen) | Administrators get it when the module is installed; give it to a support role on Users → Roles |
| Only users who hold no permission you lack | A support role cannot become an editor or an administrator this way |
| Only users without a way into the admin: customers, subscribers, students | Colleagues are out of reach unless staff is on in the config |
| Not yourself, and not while already signed in as someone | One account at a time; come back first |
The action is shown only where these rules allow it.
While you are signed in as them
- The site, its account sections and its REST routes see that user and nothing more. A draft that you could open as an admin is a 404 for them, and the admin itself is closed.
- Everything you do is real and is done as them. An order you place is their order, a booking you cancel is cancelled, and the emails go to them. Look; act only when you mean to.
- Your own session is set aside: you start with an empty session and the customer's saved cart, and your own cart, flashes and half-filled forms do not travel into their account (or back).
- Return to … in the bar signs you back in and opens the user's page in the admin.
- After
minutes(60 by default) the next page brings you back on its own, so a forgotten tab does not stay in someone else's account. - If your own account changes meanwhile (deleted, password changed, permission taken away), the next page signs you out of both.
- Log Out while signed in as them signs you out of both; sign in again with your own password.
Their two-factor step is not asked: you have passed your own. Nothing about the switch reaches their account: no sign-in is recorded for them, and their sessions elsewhere stay as they are.
The log
With kitloom/activity-log, two entries in the sign-in log (auth) mark each visit: "admin signed in as customer" and "admin stopped signing in as customer" with the reason (left, expired, gone, logout, revoked), both by the admin. What is done in between is logged as the customer's, as it happened on the site under their name. These two entries say who was behind it.
Configuration
config/kitloom-impersonate.php (php artisan vendor:publish --tag=kitloom-impersonate-config):
| Key | Default | |
|---|---|---|
staff (KITLOOM_IMPERSONATE_STAFF) | false | Let users with a way into the admin be signed in as too, still only those who hold no permission you lack |
minutes (KITLOOM_IMPERSONATE_MINUTES) | 60 | How long before the next page brings you back |
filament.register, nova.register | true | The action on one admin's users |
For the application
Kitloom\Impersonate\Impersonation: allows($actor, $user) / denial() (why not), start($actor, $user, $back), active(), impersonator(), end(). A module that should treat the switch as a sign-in listens to Events\ImpersonationStarted and Events\ImpersonationEnded: Laravel's Login and Logout are not fired, so a saved cart is not merged and no sign-in is logged that nobody made. kitloom/shop brings back the saved carts and kitloom/site-inertia clears the browser's history this way.
The session's guard must be a session guard (web). The check that ends a stale switch is a middleware of the web group (Http\EndsImpersonation); the way back is POST /wp-json/impersonate/v1/leave.