AbsoluteJS

Admin Impersonation

Scoped, audited "log in as user" for support and ops. Short-lived, step-up-gated, fully audit-logged, with a one-click return to the admin's own session.

#Start (audited, step-up)

startImpersonation:

1
Mint the target session
Mints a short-lived session for the target, stamped with an impersonator (RFC 8693 actor semantics: who, and a required reason).
2
Capture the return session
Captures the admin's session to return to afterwards.
3
Emit the audit event
Emits an impersonation_started event.
Gate it behind your admin auth and a step-up — it's privileged.
TS
import { startImpersonation } from '@absolutejs/auth';

// In your own admin route — gate it behind admin auth AND a step-up
// (requireRecentAuth); 'reason' is required and recorded.
await startImpersonation({
  authSessionStore,
  cookie: user_session_id,
  getUserId: (user) => user.sub,
  impersonator: {
    actorId: admin.id,
    actorEmail: admin.email,
    reason: 'Support ticket #4821'
  },
  inMemorySession: session,
  user: targetUser, // resolved from your store
  emit: auditEmit // optional: emits 'impersonation_started'
});

// The session is now the target user, stamped with the impersonator (RFC 8693
// actor semantics) and time-boxed. The admin's original session is preserved so
// endImpersonation can return them to it.

#Exit & detect

endImpersonation restores the admin's original session (or clears the cookie) and emits impersonation_ended. isImpersonating flags any impersonated session so your UI can show a banner.

TS
import { endImpersonation, isImpersonating } from '@absolutejs/auth';

// One-click exit — restores the admin's original session if it's still valid,
// otherwise clears the cookie. Emits an 'impersonation_ended' audit event.
const { restored } = await endImpersonation({
  authSessionStore,
  cookie: user_session_id,
  inMemorySession: session,
  emit: auditEmit
});

// Detect an impersonated session anywhere (e.g. to show a banner) — userStatus
// surfaces the same 'impersonator' field:
if (isImpersonating(session)) {
  // render: "Viewing as alice@acme.com — exit impersonation"
}