Admin kann Nutzer-Konto übernehmen (Impersonation) mit Rückwechsel
- sessions.impersonator_id: Admin-Session behält Token, schaltet user_id aufs Ziel, Admin bleibt in impersonator_id gespeichert (Stack, keine Verschachtelung). uid()/Config/Dateien laufen als Ziel-Nutzer. - Admin sieht in /admin pro Nutzer "Anmelden als"; Bestätigungsdialog. - Dauerhaftes amber Banner im Header mit "Zurück zum Admin" (POST, kein JS nötig) erscheint auf jeder Seite während Impersonation. - requireAdmin verweigert während Impersonation -> keine Admin-Aktionen als fremder Nutzer; Stop-Route prüft impersonator_id (kein Escalation-Pfad für Normalnutzer). Selbst-Imitation blockiert. - audit_log-Tabelle protokolliert Start/Stop persistent; Admin-Seite zeigt Audit-Liste (/admin/audit/impersonations). - Migration: idempotentes ALTER ADD COLUMN impersonator_id fuer Bestand. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Claude
@@ -79,6 +79,12 @@ async function runMigration({ db, dbAll, dbGet, dbRun }) {
|
||||
)
|
||||
`);
|
||||
await exec('CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)');
|
||||
// Impersonation support: the admin's session keeps its token but switches
|
||||
// user_id to the target, storing the original admin in impersonator_id so the
|
||||
// admin can switch back. Added after the fact for existing installs.
|
||||
if (!(await hasColumn('sessions', 'impersonator_id'))) {
|
||||
await exec('ALTER TABLE sessions ADD COLUMN impersonator_id INTEGER');
|
||||
}
|
||||
|
||||
// 2. Ensure admin user (idempotent) -----------------------------------
|
||||
let admin = await dbGet('SELECT id, password_hash FROM users WHERE username = ?', [ADMIN_USERNAME]);
|
||||
|
||||
@@ -158,9 +158,16 @@ app.set('views', path.join(__dirname, 'views'));
|
||||
app.use(async (req, res, next) => {
|
||||
try {
|
||||
const cookies = parseCookies(req.headers.cookie);
|
||||
const user = await loadSessionUser(cookies[SESSION_COOKIE]);
|
||||
const token = cookies[SESSION_COOKIE];
|
||||
const user = await loadSessionUser(token);
|
||||
req.user = user;
|
||||
req.sessionToken = token;
|
||||
res.locals.user = user;
|
||||
// impersonator is set when an admin is acting as another user; the header
|
||||
// shows a banner and the "switch back" action uses it.
|
||||
const impersonator = user && user.impersonator ? user.impersonator : null;
|
||||
req.impersonator = impersonator;
|
||||
res.locals.impersonator = impersonator;
|
||||
// The header highlights the section you are in; it needs the current path.
|
||||
res.locals.pfad = req.path;
|
||||
// Warm this user's cfg rows before anything reads them: config.get() is
|
||||
@@ -681,12 +688,22 @@ async function destroySession(token) {
|
||||
// enforces the server-side absolute session expiry: a cookie is only valid for
|
||||
// SESSION_MAX_AGE after the last activity, regardless of the client-side
|
||||
// maxAge (which a client can tamper with). Expired rows are deleted.
|
||||
//
|
||||
// When the session is an impersonation (an admin "logging in as" a user), the
|
||||
// returned user is the *target*; `impersonator` carries the original admin so
|
||||
// the app can show a banner and offer a "switch back" action. While
|
||||
// impersonating, the effective user has no admin rights (see requireAdmin) —
|
||||
// the admin is debugging the user's account, not escalating.
|
||||
async function loadSessionUser(token) {
|
||||
if (!token) return null;
|
||||
const row = await dbGet(
|
||||
`SELECT u.id AS id, u.username AS username, u.is_admin AS is_admin,
|
||||
s.created_at AS created_at, s.last_seen AS last_seen
|
||||
FROM sessions s JOIN users u ON u.id = s.user_id
|
||||
s.created_at AS created_at, s.last_seen AS last_seen,
|
||||
s.impersonator_id AS impersonator_id,
|
||||
i.username AS impersonator_username, i.is_admin AS impersonator_is_admin
|
||||
FROM sessions s
|
||||
JOIN users u ON u.id = s.user_id
|
||||
LEFT JOIN users i ON i.id = s.impersonator_id
|
||||
WHERE s.token = ?`,
|
||||
[token]
|
||||
);
|
||||
@@ -698,7 +715,11 @@ async function loadSessionUser(token) {
|
||||
return null;
|
||||
}
|
||||
await dbRun('UPDATE sessions SET last_seen = CURRENT_TIMESTAMP WHERE token = ?', [token]).catch(() => {});
|
||||
return { id: row.id, username: row.username, is_admin: !!row.is_admin };
|
||||
const user = { id: row.id, username: row.username, is_admin: !!row.is_admin };
|
||||
if (row.impersonator_id) {
|
||||
user.impersonator = { id: row.impersonator_id, username: row.impersonator_username, is_admin: !!row.impersonator_is_admin };
|
||||
}
|
||||
return user;
|
||||
}
|
||||
|
||||
// Find a user by username + password (login check). Returns the user object or null.
|
||||
@@ -1161,10 +1182,27 @@ async function initializeDatabase() {
|
||||
user_id INTEGER NOT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
last_seen DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
||||
impersonator_id INTEGER,
|
||||
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
|
||||
FOREIGN KEY (impersonator_id) REFERENCES users(id) ON DELETE SET NULL
|
||||
)
|
||||
`);
|
||||
await exec('CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)');
|
||||
// Audit trail for admin actions that act on another user's account (today:
|
||||
// impersonation start/stop). Persistent so a later review can reconstruct who
|
||||
// acted as whom and when — a plain console.log would not survive a restart.
|
||||
await exec(`
|
||||
CREATE TABLE IF NOT EXISTS audit_log (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
actor_user_id INTEGER,
|
||||
target_user_id INTEGER,
|
||||
action TEXT NOT NULL,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
|
||||
FOREIGN KEY (actor_user_id) REFERENCES users(id) ON DELETE SET NULL,
|
||||
FOREIGN KEY (target_user_id) REFERENCES users(id) ON DELETE SET NULL
|
||||
)
|
||||
`);
|
||||
await exec('CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_log(created_at)');
|
||||
|
||||
// Upgrade legacy single-user installs BEFORE the per-user CREATE/INDEX
|
||||
// statements below: the migration adds the user_id column to every existing
|
||||
@@ -3473,7 +3511,10 @@ initializeDatabase().then(async () => {
|
||||
// alle seine Daten (Bewerbungen, E-Mails, Termine, Chat, Dateien liegen in
|
||||
// data/<dir>/<userId>/ und müssen separat entfernt werden — siehe unten).
|
||||
function requireAdmin(req, res, next) {
|
||||
if (req.user && req.user.is_admin) return next();
|
||||
// Admin rights are suspended while impersonating another user: the admin is
|
||||
// reviewing that user's account, not exercising admin powers. This also
|
||||
// keeps the impersonated session from reaching admin endpoints at all.
|
||||
if (req.user && req.user.is_admin && !req.impersonator) return next();
|
||||
if (req.path.startsWith('/admin/') || req.xhr || (req.get('accept') || '').includes('application/json')) {
|
||||
return res.status(403).send('Zugriff verweigert – nur für Administratoren.');
|
||||
}
|
||||
@@ -3552,6 +3593,97 @@ initializeDatabase().then(async () => {
|
||||
}
|
||||
});
|
||||
|
||||
// --- Impersonation: admin "logs in as" a user --------------------------
|
||||
// Best practice (Django/Flask-impersonate style): the admin's own session
|
||||
// keeps its cookie token, but its user_id switches to the target and the
|
||||
// original admin is preserved in sessions.impersonator_id. Everything the app
|
||||
// does (DB queries via uid(), per-user config, file dirs) then runs as the
|
||||
// target — the admin sees exactly the user's account. Admin rights are
|
||||
// suspended while impersonating (requireAdmin), and a banner + "switch back"
|
||||
// action are always one click away. Every start/stop is recorded in audit_log.
|
||||
|
||||
async function auditLog(actorId, targetId, action) {
|
||||
await dbRun(
|
||||
'INSERT INTO audit_log (actor_user_id, target_user_id, action) VALUES (?, ?, ?)',
|
||||
[actorId || null, targetId || null, action]
|
||||
).catch((e) => console.error('audit_log write failed:', e.message));
|
||||
}
|
||||
|
||||
// Start impersonating a user. Admin-only, and never while already
|
||||
// impersonating (no nesting — switch back first).
|
||||
app.post('/admin/users/:id/impersonate', requireAdmin, async (req, res) => {
|
||||
try {
|
||||
const targetId = Number(req.params.id);
|
||||
if (!targetId || targetId === Number(req.user.id)) {
|
||||
return res.status(400).send('Man kann sich nicht selbst imitieren.');
|
||||
}
|
||||
const target = await dbGet('SELECT id, username FROM users WHERE id = ?', [targetId]);
|
||||
if (!target) return res.status(404).send('Benutzer nicht gefunden.');
|
||||
const token = req.sessionToken;
|
||||
if (!token) return res.status(400).send('Keine Sitzung.');
|
||||
await dbRun(
|
||||
'UPDATE sessions SET user_id = ?, impersonator_id = ?, last_seen = CURRENT_TIMESTAMP WHERE token = ?',
|
||||
[target.id, req.user.id, token]
|
||||
);
|
||||
await auditLog(req.user.id, target.id, `impersonate_start → ${target.username}`);
|
||||
console.log(`Impersonation: Admin #${req.user.id} (${req.user.username}) → User #${target.id} (${target.username})`);
|
||||
res.redirect('/');
|
||||
} catch (error) {
|
||||
console.error('Admin impersonate error:', error);
|
||||
res.status(500).send('Serverfehler');
|
||||
}
|
||||
});
|
||||
|
||||
// Switch back to the original admin. This is intentionally NOT requireAdmin:
|
||||
// it runs while impersonating, when req.user is the target (non-admin). The
|
||||
// guard is the session's impersonator_id — only an actual impersonation can
|
||||
// stop one, so a normal user session (impersonator_id NULL) cannot use it.
|
||||
app.post('/admin/impersonate/stop', async (req, res) => {
|
||||
try {
|
||||
const token = req.sessionToken;
|
||||
if (!token) return res.redirect('/');
|
||||
const row = await dbGet(
|
||||
'SELECT user_id, impersonator_id FROM sessions WHERE token = ?',
|
||||
[token]
|
||||
);
|
||||
if (!row || !row.impersonator_id) {
|
||||
return res.status(403).send('Keine aktive Impersonation.');
|
||||
}
|
||||
const adminId = row.impersonator_id;
|
||||
const targetId = row.user_id;
|
||||
await dbRun(
|
||||
'UPDATE sessions SET user_id = ?, impersonator_id = NULL, last_seen = CURRENT_TIMESTAMP WHERE token = ?',
|
||||
[adminId, token]
|
||||
);
|
||||
await auditLog(adminId, targetId, 'impersonate_stop');
|
||||
console.log(`Impersonation: Admin #${adminId} switched back from User #${targetId}`);
|
||||
res.redirect('/admin');
|
||||
} catch (error) {
|
||||
console.error('Admin impersonate stop error:', error);
|
||||
res.status(500).send('Serverfehler');
|
||||
}
|
||||
});
|
||||
|
||||
// Recent impersonation audit entries for the admin dashboard.
|
||||
app.get('/admin/audit/impersonations', requireAdmin, async (req, res) => {
|
||||
try {
|
||||
const rows = await dbAll(
|
||||
`SELECT a.action, a.created_at,
|
||||
au.username AS actor, tu.username AS target
|
||||
FROM audit_log a
|
||||
LEFT JOIN users au ON au.id = a.actor_user_id
|
||||
LEFT JOIN users tu ON tu.id = a.target_user_id
|
||||
WHERE a.action LIKE 'impersonate_%'
|
||||
ORDER BY a.created_at DESC
|
||||
LIMIT 25`
|
||||
);
|
||||
res.json({ items: rows });
|
||||
} catch (error) {
|
||||
console.error('Audit list error:', error);
|
||||
res.status(500).json({ error: 'Serverfehler' });
|
||||
}
|
||||
});
|
||||
|
||||
// ----- Conversational KI-Chat (Ollama, streaming) -----
|
||||
// Gated behind OLLAMA_API_KEY. Threads + messages persist in SQLite; the
|
||||
// assistant answer is streamed back via Server-Sent Events.
|
||||
|
||||
@@ -77,6 +77,13 @@
|
||||
<a href="/jobsuche?user=<%= u.id %>"
|
||||
class="text-sm text-blue-600 dark:text-blue-400 hover:underline mr-3"
|
||||
title="Suchprofil und Zeitplan dieses Benutzers verwalten">Jobsuche</a>
|
||||
<% if (u.id !== currentUserId) { %>
|
||||
<form method="POST" action="/admin/users/<%= u.id %>/impersonate" class="inline"
|
||||
onsubmit="return confirm('Als „<%= u.username %>“ anmelden? Du siehst dann dessen Konto. Admin-Rechte sind dabei pausiert; über das Banner oben kannst du zurückwechseln.');">
|
||||
<button type="submit" class="text-sm text-emerald-600 dark:text-emerald-400 hover:underline mr-3"
|
||||
title="Dieses Konto übernehmen (Impersonation)">Anmelden als</button>
|
||||
</form>
|
||||
<% } %>
|
||||
<button type="button"
|
||||
onclick="document.getElementById('resetForm<%= u.id %>').classList.toggle('hidden')"
|
||||
class="text-sm text-blue-600 dark:text-blue-400 hover:underline mr-3">
|
||||
@@ -109,6 +116,57 @@
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Impersonations-Audit: wer hat als wen gehandelt, wann -->
|
||||
<div class="bg-white dark:bg-gray-800 rounded-lg shadow-md p-6 mt-8">
|
||||
<h3 class="text-lg font-semibold mb-1">Impersonationen (Audit)</h3>
|
||||
<p class="text-sm text-gray-500 dark:text-gray-400 mb-4">Nachvollziehbar protokolliert: jeder Wechsel auf ein anderes Konto und jeder Rückwechsel.</p>
|
||||
<div class="overflow-x-auto">
|
||||
<table class="w-full text-sm">
|
||||
<thead>
|
||||
<tr class="text-left text-gray-500 dark:text-gray-400 border-b border-gray-200 dark:border-gray-700">
|
||||
<th class="py-2 pr-4 font-medium">Admin</th>
|
||||
<th class="py-2 pr-4 font-medium">Aktion</th>
|
||||
<th class="py-2 pr-4 font-medium">Zeit</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="auditBody" class="divide-y divide-gray-100 dark:divide-gray-700">
|
||||
<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">… wird geladen</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
|
||||
<script>
|
||||
(function () {
|
||||
function esc(s) { var d = document.createElement('div'); d.textContent = s == null ? '' : String(s); return d.innerHTML; }
|
||||
fetch('/admin/audit/impersonations', { cache: 'no-store' })
|
||||
.then(function (r) { return r.json(); })
|
||||
.then(function (d) {
|
||||
var body = document.getElementById('auditBody');
|
||||
var items = (d && d.items) || [];
|
||||
if (!items.length) {
|
||||
body.innerHTML = '<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">Keine Impersonationen protokolliert.</td></tr>';
|
||||
return;
|
||||
}
|
||||
body.innerHTML = items.map(function (it) {
|
||||
var isStop = /stop/.test(it.action);
|
||||
var badge = isStop
|
||||
? '<span class="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300">Rückwechsel</span>'
|
||||
: '<span class="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300">Anmeldung als</span>';
|
||||
var ziel = isStop ? '' : ' <span class="text-gray-700 dark:text-gray-300">' + esc(it.action.replace(/^impersonate_start\s*→\s*/, '')) + '</span>';
|
||||
return '<tr>'
|
||||
+ '<td class="py-2 pr-4 font-medium text-gray-800 dark:text-gray-100">' + esc(it.actor || '?') + '</td>'
|
||||
+ '<td class="py-2 pr-4">' + badge + ziel + '</td>'
|
||||
+ '<td class="py-2 pr-4 text-gray-500 dark:text-gray-400">' + esc(it.created_at) + '</td>'
|
||||
+ '</tr>';
|
||||
}).join('');
|
||||
})
|
||||
.catch(function () {
|
||||
document.getElementById('auditBody').innerHTML = '<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">Audit konnte nicht geladen werden.</td></tr>';
|
||||
});
|
||||
})();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -212,6 +212,29 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<% if (typeof impersonator !== 'undefined' && impersonator) { %>
|
||||
<!-- Impersonation banner: unmistakable and always present while an admin is
|
||||
acting as another user. The "switch back" form is a real POST so it works
|
||||
without JS; admin rights are suspended until the switch back. -->
|
||||
<div class="border-t border-amber-300/60 bg-amber-50/95 backdrop-blur-md dark:border-amber-400/20 dark:bg-amber-500/10">
|
||||
<div class="container mx-auto flex flex-wrap items-center gap-x-3 gap-y-1 px-4 py-2 text-sm text-amber-800 dark:text-amber-200">
|
||||
<svg class="h-4 w-4 shrink-0" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M16 7a4 4 0 11-8 0 4 4 0 018 0zM12 14v7m-4-4h8"></path>
|
||||
</svg>
|
||||
<span class="font-medium">Impersonation aktiv:</span>
|
||||
<span>du handelst als <strong class="font-semibold"><%= user.username %></strong> (eingeloggt durch <strong class="font-semibold"><%= impersonator.username %></strong>). Admin-Aktionen sind pausiert.</span>
|
||||
<form method="POST" action="/admin/impersonate/stop" class="ml-auto">
|
||||
<button type="submit" class="inline-flex items-center gap-1.5 rounded-md bg-amber-600 hover:bg-amber-700 px-3 py-1.5 text-xs font-medium text-white transition-colors">
|
||||
<svg class="h-3.5 w-3.5" fill="none" stroke="currentColor" stroke-width="2.5" viewBox="0 0 24 24">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M10 19l-7-7m0 0l7-7m-7 7h18"></path>
|
||||
</svg>
|
||||
Zurück zum Admin
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<% } %>
|
||||
|
||||
<!-- Mobile navigation: the same structure, spelled out. The old header just
|
||||
dropped the labels and left seven unlabelled icons. -->
|
||||
<div id="mobileNav" class="hidden border-t border-gray-200/80 bg-gray-50 lg:hidden dark:border-white/5 dark:bg-gray-900">
|
||||
|
||||
Reference in New Issue
Block a user