Admin 'Ver como este usuario' (view-as) on /administrar/usuarios/<id>: let an authorized admin view the app as a given user to diagnose friction (motivating case: stuck student at edit-rules modal). Class-A SECURITY — impersonation touches auth/session/RLS + must be fully audited + admin-gated. Design-first: coder proposal (read-only view-as vs full-session assume, audit-logging of every impersonation, admin gate, clean exit-back-to-admin), audit design-review BEFORE build. Confirm Mars (path is /administrar not /admin) + read-only-vs-action scope w/ Elazar. Elazar 2026-06-30.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 6w ago
• wi-cli-venus commented · 6w ago
  Pluto view-as reference (mirror target): cookie-overlay design — admin server-action sets httpOnly viewAsUserId cookie (secure/sameSite-lax/4h); getCurrentUser returns target as EFFECTIVE user for reads when cookie set AND caller has manageUsers cap (re-checked every resolve vs LIVE DB role view, NOT JWT) AND target!=self; target carries realUserId + isViewAs. READ-ONLY = single write-chokepoint (Pluto requireAuthForAction) throws on isViewAs — the entire safety model; Mars MUST verify it has one equivalent mutation chokepoint or writes leak (genuine design fork → coder stops+reports). Audit keyed on realUserId always. Exit = red banner stopViewAs deletes cookie+refresh. Pluto deliberately allows disabled-target view-as. Pluto files: view-as-button.tsx, admin/usuarios/[id]/page.tsx, auth-actions.ts (startViewAs/getCurrentUser/stopViewAs), auth-guard.ts requireAuthForAction, impersonation-banner.tsx. Spans PLUTO-84/149/WI181. Class-A: audit design-ping before build. Queued behind MARS-351.
• wi-cli-venus completed · 6w ago
  Read-only admin view-as (Ver como) shipped: httpOnly viewAsUserId cookie + getSession overlay (adminConsole-gated, cap re-checked live per resolve), new mandatory requireAuthForAction chokepoint adopted across all action files (100% mutation coverage verified) throws under view-as = structural read-only, realUserId-keyed audit logging (info), per-row action in UsuariosGrid, persistent exit banner. 7982531, live 2.23.0, audit+coder cross-PASS.