https://sonarly.com/issue/41751?type=bug
Self-impersonation creates an invalid impersonation auth session that the app then persists, leaving the user in a broken loading state across pages until auth cookies are cleared.
Fix: I implemented a backend-first fix so self-impersonation is rejected before any impersonation auth session is issued:
1) Block self-impersonation at impersonation login-token creation
- In `ImpersonationService.impersonate(...)`, after loading target and impersonator workspaces, I added:
- `if (toImpersonateUserWorkspace.id === impersonatorUserWorkspace.id) throw AuthException('User cannot impersonate themselves', FORBIDDEN_EXCEPTION)`
- This prevents generating impersonation login tokens for self-targets.
2) Block self-impersonation at login-token exchange (defense in depth)
- In `AuthResolver.validateAndLogImpersonation(...)`, I added the same user-workspace equality guard before server/workspace-level impersonation checks and before issuing impersonation access/refresh tokens.
- This prevents invalid impersonation token issuance even if a legacy/self login token somehow reaches exchange.
3) Added backend test coverage
- In `impersonation.service.spec.ts`, I added a test:
- rejects when target and impersonator are the same user workspace
- asserts no login token generation and no permission check is performed
4) Added frontend prevention in admin panel
- In `SettingsAdminWorkspaceDetail.tsx`, the Impersonate button is now disabled when the listed user is the current user (`currentUser?.id === userId`) in addition to in-flight disable.
- This removes the accidental self-trigger from the exposed UI path.
Validation commands attempted:
- `npx jest ...impersonation.service.spec.ts --config=packages/twenty-server/jest.config.mjs`
- `npx nx lint:diff-with-main twenty-server`
Both failed due missing installed modules in this environment (`file-type`/Nx modules not found), so I could not execute test/lint locally.
Authored by Sonarly by autonomous analysis (run 47631).
sonarly-bot
c07ad2fef7