bert.hausmans
4df668b5b8
Replaces the insecure token-in-localStorage approach with a header-based impersonation system backed by cache sessions and MFA verification. Key changes: - New impersonation_sessions audit table (immutable, ULID PK) - MFA verification required to start impersonation (TOTP/email/backup) - X-Impersonate-User header + HandleImpersonation middleware - Per-request auth context swap (admin session never modified) - IP pinning, sensitive route blocking, no nesting, sliding 60-min TTL - Activity log auto-tagged with impersonated_by during sessions - Frontend: sessionStorage, BroadcastChannel sync, countdown timer - ImpersonateDialog with reason + MFA verification flow - 26 comprehensive tests covering core, middleware, audit, lifecycle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
63 lines
2.0 KiB
Vue
63 lines
2.0 KiB
Vue
<script setup lang="ts">
|
|
import { useTheme } from 'vuetify'
|
|
import ScrollToTop from '@core/components/ScrollToTop.vue'
|
|
import initCore from '@core/initCore'
|
|
import { initConfigStore, useConfigStore } from '@core/stores/config'
|
|
import { hexToRgb } from '@core/utils/colorConverter'
|
|
import { useAuthStore } from '@/stores/useAuthStore'
|
|
import { useImpersonationStore } from '@/stores/useImpersonationStore'
|
|
import { useNotificationStore } from '@/stores/useNotificationStore'
|
|
|
|
const { global } = useTheme()
|
|
|
|
initCore()
|
|
initConfigStore()
|
|
|
|
const configStore = useConfigStore()
|
|
const authStore = useAuthStore()
|
|
const impersonationStore = useImpersonationStore()
|
|
const notificationStore = useNotificationStore()
|
|
|
|
// Restore impersonation state and listen for cross-tab sync
|
|
impersonationStore.restoreFromStorage()
|
|
impersonationStore.listenForBroadcasts()
|
|
|
|
// Validate stored token on app startup — must complete before rendering protected content
|
|
authStore.initialize()
|
|
</script>
|
|
|
|
<template>
|
|
<VLocaleProvider :rtl="configStore.isAppRTL">
|
|
<VApp :style="`--v-global-theme-primary: ${hexToRgb(global.current.value.colors.primary)}`">
|
|
<!-- Show loading state while validating auth token -->
|
|
<template v-if="!authStore.isInitialized">
|
|
<div class="d-flex align-center justify-center" style="min-height: 100vh;">
|
|
<VProgressCircular indeterminate color="primary" size="48" />
|
|
</div>
|
|
</template>
|
|
|
|
<!-- Only render app shell after auth is resolved -->
|
|
<template v-else>
|
|
<RouterView />
|
|
<ScrollToTop />
|
|
</template>
|
|
</VApp>
|
|
|
|
<!-- Global notification snackbar -->
|
|
<VSnackbar
|
|
v-model="notificationStore.visible"
|
|
:color="notificationStore.type"
|
|
:timeout="notificationStore.timeout"
|
|
location="top end"
|
|
>
|
|
{{ notificationStore.message }}
|
|
|
|
<template #actions>
|
|
<VBtn variant="text" @click="notificationStore.hide()">
|
|
Close
|
|
</VBtn>
|
|
</template>
|
|
</VSnackbar>
|
|
</VLocaleProvider>
|
|
</template>
|