twenty

vynte-infra/twenty

Fork 0

Files

T

History

459c64f642 Prevent non-admin users from impersonating admin users (#20412 )

## Summary
- Adds a privilege check to workspace-level impersonation: non-admin
users can no longer impersonate users who have `canAccessFullAdminPanel`
or `canImpersonate` flags
- Adds the same check in JWT token validation as defense-in-depth
(invalidates existing impersonation sessions targeting admin users)
- Adds 3 unit tests covering: non-admin → admin blocked, non-admin →
canImpersonate blocked, admin → admin allowed

## Test plan
- [x] Unit tests pass (14/14 in `impersonation.service.spec.ts`)
- [x] Typecheck passes
- [ ] Verify workspace-level impersonation of regular users still works
normally
- [ ] Verify server-level impersonation by admins is unaffected

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-09 11:57:38 +02:00

create-twenty-app

Detail steps during create twenty app (#20374 )

2026-05-07 20:51:24 +00:00

twenty-apps

Isolate twenty apps from nx project (#20406 )

2026-05-08 13:16:25 +00:00

twenty-cli

…

twenty-client-sdk

feat: add email forwarding message channel (#19535 )

2026-05-09 11:00:57 +02:00