Impersonation
Impersonation
Let an authorised account sign in as another user, then return. Every session is recorded.
@10x-media/impersonation lets an authorised account sign in as another user without that user's password. After start, req.user is the target. This is not a view-as overlay. Exit, logout, or remote terminate ends it. Every start is a closed-never-deleted row.
Experimental. This plugin mints and revokes sessions. It is covered by unit, integration and end-to-end tests against Payload's real routing on Mongo and Postgres, but auth surfaces differ a lot between projects. Try it in staging first.
What it does
- A host
access.impersonatefunction is mandatory. The plugin never compares roles. - Start mints a real target session (prefixed sid + JWT + cookie). Payload then authenticates the target on every request.
req.user._impersonationis set on the target session only (the minted sid). Parallel admin requests stay the impersonator.- Active means an open row whose
targetSidmatches this request, or (for the admin bar) whoseimpersonatorSidmatches in parallel mode. - Swap replaces the shared auth cookie. Parallel writes an isolated cookie only when
@10x-media/dual-sessionisolated the target. - List this plugin after any plugin that adds auth collections.
onInitthrows if a live auth collection was missing at plugin-build time.