52 lines
1.8 KiB
PHP
52 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\Customer;
|
|
use App\Models\Operator;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Support\Facades\Auth;
|
|
|
|
/**
|
|
* Admin impersonation: an admin can log in as a customer's portal account to
|
|
* inspect their portal during an incident, then return to the admin session.
|
|
*
|
|
* Both guards are named explicitly throughout, never the ambient default: the
|
|
* operator and the customer are two different models on two different guards
|
|
* now, and this is exactly the code that swaps which one is "the" signed-in
|
|
* user for the request. The full signed-link rewrite (for hosts that do not
|
|
* share a cookie at all) is a separate piece of work; this keeps today's
|
|
* same-session handover correct across the split identity in the meantime.
|
|
*/
|
|
class ImpersonationController extends Controller
|
|
{
|
|
/** Admin-gated: become the customer. */
|
|
public function start(Customer $customer): RedirectResponse
|
|
{
|
|
$this->authorize('customers.impersonate');
|
|
$user = $customer->ensureUser();
|
|
|
|
session(['impersonator_id' => Auth::guard('operator')->id()]);
|
|
Auth::guard('web')->login($user);
|
|
|
|
return redirect()->route('dashboard');
|
|
}
|
|
|
|
/** Return to the admin session (available while impersonating). */
|
|
public function leave(): RedirectResponse
|
|
{
|
|
$operatorId = session()->pull('impersonator_id');
|
|
|
|
if ($operatorId !== null && ($operator = Operator::query()->find($operatorId)) !== null) {
|
|
// Ends the customer session rather than leaving it dangling
|
|
// alongside the restored operator one.
|
|
Auth::guard('web')->logout();
|
|
Auth::guard('operator')->login($operator);
|
|
|
|
return redirect()->route('admin.overview');
|
|
}
|
|
|
|
return redirect()->route('dashboard');
|
|
}
|
|
}
|