Skip to main content

Support & Admin Impersonation

The Impersonation module (src/features/impersonation/) allows authorized administrators (EMPLOYEE_IMPERSONATE permission) to view the application as another employee to troubleshoot issues or perform authorized support actions.

Security & Implementation Architecture​

[ Admin initiates Impersonation ]
               │
               â–¼
[ Stores target in sessionStorage(IMPERSONATION_STORAGE_KEY) ]
               │
               â–¼
[ ImpersonationProvider updates Context state ]
               │
               â–¼
[ apiClient Request Interceptor adds 'X-On-Behalf-Of: <targetEmployeeId>' ]
               │
               â–¼
[ MainLayout displays top sticky Impersonation Banner with 'Exit' button ]

Audit Logging (ImpersonationAuditPage.tsx)​

Every action taken during an active impersonation session is logged on the backend with:

  • Initiating Administrator ID and Name
  • Impersonated Target Employee ID
  • Exact Timestamp and Endpoint Accessed
  • Changes / Mutated Data Snapshot

Administrators with IMPERSONATION_AUDIT_READ permission can review complete session logs at /impersonation-audit.