Admin kann Nutzer-Konto übernehmen (Impersonation) mit Rückwechsel
- sessions.impersonator_id: Admin-Session behält Token, schaltet user_id aufs Ziel, Admin bleibt in impersonator_id gespeichert (Stack, keine Verschachtelung). uid()/Config/Dateien laufen als Ziel-Nutzer. - Admin sieht in /admin pro Nutzer "Anmelden als"; Bestätigungsdialog. - Dauerhaftes amber Banner im Header mit "Zurück zum Admin" (POST, kein JS nötig) erscheint auf jeder Seite während Impersonation. - requireAdmin verweigert während Impersonation -> keine Admin-Aktionen als fremder Nutzer; Stop-Route prüft impersonator_id (kein Escalation-Pfad für Normalnutzer). Selbst-Imitation blockiert. - audit_log-Tabelle protokolliert Start/Stop persistent; Admin-Seite zeigt Audit-Liste (/admin/audit/impersonations). - Migration: idempotentes ALTER ADD COLUMN impersonator_id fuer Bestand. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Claude
@@ -77,6 +77,13 @@
|
||||
<a href="/jobsuche?user=<%= u.id %>"
|
||||
class="text-sm text-blue-600 dark:text-blue-400 hover:underline mr-3"
|
||||
title="Suchprofil und Zeitplan dieses Benutzers verwalten">Jobsuche</a>
|
||||
<% if (u.id !== currentUserId) { %>
|
||||
<form method="POST" action="/admin/users/<%= u.id %>/impersonate" class="inline"
|
||||
onsubmit="return confirm('Als „<%= u.username %>“ anmelden? Du siehst dann dessen Konto. Admin-Rechte sind dabei pausiert; über das Banner oben kannst du zurückwechseln.');">
|
||||
<button type="submit" class="text-sm text-emerald-600 dark:text-emerald-400 hover:underline mr-3"
|
||||
title="Dieses Konto übernehmen (Impersonation)">Anmelden als</button>
|
||||
</form>
|
||||
<% } %>
|
||||
<button type="button"
|
||||
onclick="document.getElementById('resetForm<%= u.id %>').classList.toggle('hidden')"
|
||||
class="text-sm text-blue-600 dark:text-blue-400 hover:underline mr-3">
|
||||
@@ -109,6 +116,57 @@
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Impersonations-Audit: wer hat als wen gehandelt, wann -->
|
||||
<div class="bg-white dark:bg-gray-800 rounded-lg shadow-md p-6 mt-8">
|
||||
<h3 class="text-lg font-semibold mb-1">Impersonationen (Audit)</h3>
|
||||
<p class="text-sm text-gray-500 dark:text-gray-400 mb-4">Nachvollziehbar protokolliert: jeder Wechsel auf ein anderes Konto und jeder Rückwechsel.</p>
|
||||
<div class="overflow-x-auto">
|
||||
<table class="w-full text-sm">
|
||||
<thead>
|
||||
<tr class="text-left text-gray-500 dark:text-gray-400 border-b border-gray-200 dark:border-gray-700">
|
||||
<th class="py-2 pr-4 font-medium">Admin</th>
|
||||
<th class="py-2 pr-4 font-medium">Aktion</th>
|
||||
<th class="py-2 pr-4 font-medium">Zeit</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="auditBody" class="divide-y divide-gray-100 dark:divide-gray-700">
|
||||
<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">… wird geladen</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<script>
|
||||
(function () {
|
||||
function esc(s) { var d = document.createElement('div'); d.textContent = s == null ? '' : String(s); return d.innerHTML; }
|
||||
fetch('/admin/audit/impersonations', { cache: 'no-store' })
|
||||
.then(function (r) { return r.json(); })
|
||||
.then(function (d) {
|
||||
var body = document.getElementById('auditBody');
|
||||
var items = (d && d.items) || [];
|
||||
if (!items.length) {
|
||||
body.innerHTML = '<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">Keine Impersonationen protokolliert.</td></tr>';
|
||||
return;
|
||||
}
|
||||
body.innerHTML = items.map(function (it) {
|
||||
var isStop = /stop/.test(it.action);
|
||||
var badge = isStop
|
||||
? '<span class="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300">Rückwechsel</span>'
|
||||
: '<span class="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300">Anmeldung als</span>';
|
||||
var ziel = isStop ? '' : ' <span class="text-gray-700 dark:text-gray-300">' + esc(it.action.replace(/^impersonate_start\s*→\s*/, '')) + '</span>';
|
||||
return '<tr>'
|
||||
+ '<td class="py-2 pr-4 font-medium text-gray-800 dark:text-gray-100">' + esc(it.actor || '?') + '</td>'
|
||||
+ '<td class="py-2 pr-4">' + badge + ziel + '</td>'
|
||||
+ '<td class="py-2 pr-4 text-gray-500 dark:text-gray-400">' + esc(it.created_at) + '</td>'
|
||||
+ '</tr>';
|
||||
}).join('');
|
||||
})
|
||||
.catch(function () {
|
||||
document.getElementById('auditBody').innerHTML = '<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">Audit konnte nicht geladen werden.</td></tr>';
|
||||
});
|
||||
})();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -212,6 +212,29 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<% if (typeof impersonator !== 'undefined' && impersonator) { %>
|
||||
<!-- Impersonation banner: unmistakable and always present while an admin is
|
||||
acting as another user. The "switch back" form is a real POST so it works
|
||||
without JS; admin rights are suspended until the switch back. -->
|
||||
<div class="border-t border-amber-300/60 bg-amber-50/95 backdrop-blur-md dark:border-amber-400/20 dark:bg-amber-500/10">
|
||||
<div class="container mx-auto flex flex-wrap items-center gap-x-3 gap-y-1 px-4 py-2 text-sm text-amber-800 dark:text-amber-200">
|
||||
<svg class="h-4 w-4 shrink-0" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M16 7a4 4 0 11-8 0 4 4 0 018 0zM12 14v7m-4-4h8"></path>
|
||||
</svg>
|
||||
<span class="font-medium">Impersonation aktiv:</span>
|
||||
<span>du handelst als <strong class="font-semibold"><%= user.username %></strong> (eingeloggt durch <strong class="font-semibold"><%= impersonator.username %></strong>). Admin-Aktionen sind pausiert.</span>
|
||||
<form method="POST" action="/admin/impersonate/stop" class="ml-auto">
|
||||
<button type="submit" class="inline-flex items-center gap-1.5 rounded-md bg-amber-600 hover:bg-amber-700 px-3 py-1.5 text-xs font-medium text-white transition-colors">
|
||||
<svg class="h-3.5 w-3.5" fill="none" stroke="currentColor" stroke-width="2.5" viewBox="0 0 24 24">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M10 19l-7-7m0 0l7-7m-7 7h18"></path>
|
||||
</svg>
|
||||
Zurück zum Admin
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<% } %>
|
||||
|
||||
<!-- Mobile navigation: the same structure, spelled out. The old header just
|
||||
dropped the labels and left seven unlabelled icons. -->
|
||||
<div id="mobileNav" class="hidden border-t border-gray-200/80 bg-gray-50 lg:hidden dark:border-white/5 dark:bg-gray-900">
|
||||
|
||||
Reference in New Issue
Block a user