From 71b552bf491a4f78d0c8bfde952a1ea885c1a15c Mon Sep 17 00:00:00 2001
From: Andrea Vos <andrea@avris.it>
Date: Sun, 2 Oct 2022 09:23:19 +0200
Subject: [PATCH] [admin] easier impersonation for debugging

---
 routes/profile.vue    | 11 +++++++++++
 server/routes/user.js |  7 ++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/routes/profile.vue b/routes/profile.vue
index d63302091..05c7186fd 100644
--- a/routes/profile.vue
+++ b/routes/profile.vue
@@ -116,6 +116,10 @@
                                 pronouns.page/u/{{user.username}}
                             </span>
                         </a>
+                        <a v-if="$isGranted('*')" href="#"
+                           class="list-group-item list-group-item-action list-group-item-hoverable small"
+                           @click.prevent="impersonate()"><Icon v="user-secret"/> Impersonate
+                        </a>
                     </div>
                 </div>
 
@@ -274,6 +278,13 @@
 
                 return bestKey >= 0 ? best[bestKey].slice(0, 3) : [];
             },
+            async impersonate() {
+                const { token } = await this.$axios.$get(`/admin/impersonate/${encodeURIComponent(this.username)}`);
+                this.$cookies.set('impersonator', this.$cookies.get('token'));
+                this.$cookies.set('token', token);
+                await this.$router.push('/' + this.config.user.route);
+                setTimeout(() => window.location.reload(), 500);
+            },
         },
         head() {
             return head({
diff --git a/server/routes/user.js b/server/routes/user.js
index 91d2665db..833827e5a 100644
--- a/server/routes/user.js
+++ b/server/routes/user.js
@@ -612,7 +612,12 @@ router.get('/admin/impersonate/:email', handleErrorAsync(async (req, res) => {
         return res.status(401).json({error: 'Unauthorised'});
     }
 
-    return res.json({token: await issueAuthentication(req.db, {email: req.params.email})});
+    let email = req.params.email;
+    if (!email.includes('@')) {
+        email = (await req.db.get(SQL`SELECT email FROM users WHERE usernameNorm = ${normalise(email)}`)).email;
+    }
+
+    return res.json({token: await issueAuthentication(req.db, {email: email})});
 }));
 
 export default router;