[NaysKutzu]

Summary

• Upgrades admin "view as user" from read-only to write-capable impersonation (admin.users.impersonate), with a clear banner and Stop button.
• Every mutating request and activity row is attributed as admin X as user Y via new actor_uuid on featherpanel_activity (migration included); audit log UI/CSV show the actor.
• Blocks self-impersonation, nested impersonation, privilege escalation onto root staff, and account deletion while impersonating. Session-only (no API-key impersonation).

Test plan

• As admin with admin.users.impersonate, open a user → Impersonate → land on dashboard with red banner
• Perform a write as that user (e.g. update a preference) → audit log shows actor + "admin X as user Y"
• Account deletion while impersonating returns IMPERSONATION_ACTION_BLOCKED and is audit logged
• Cannot impersonate yourself; cannot start a second impersonation without stopping; non-root cannot impersonate staff/root
• Stop impersonating returns to the user edit page; logout clears impersonation cookie

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 2 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: MythicalLTD/FeatherPanel
• Branch: feat/admin-impersonate-audit
• File: .coderabbit.yaml
• Commit: f1369b5
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ca32d2f2-e745-44c3-9c5f-f0cf41f28ed4

Commits

Reviewing files that changed from the base of the PR and between caff192 and f1369b5.

Files selected for processing: 12

• CHANGELOG.md
• backend/app/Chat/Activity.php
• backend/app/Controllers/Admin/AuditLogController.php
• backend/app/Controllers/Admin/ImpersonationController.php
• backend/app/Helpers/Impersonation.php
• backend/app/Middleware/AuthMiddleware.php
• backend/app/Runtime/RequestContext.php
• backend/storage/migrations/2026-11-06.02.40-activity-actor-uuid.sql
• frontendv2/public/locales/en.json
• frontendv2/src/app/(app)/admin/audit-log/page.tsx
• frontendv2/src/components/layout/ImpersonationBanner.tsx
• permission_nodes.fpperm

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn