bert.hausmans
4df668b5b8
Replaces the insecure token-in-localStorage approach with a header-based impersonation system backed by cache sessions and MFA verification. Key changes: - New impersonation_sessions audit table (immutable, ULID PK) - MFA verification required to start impersonation (TOTP/email/backup) - X-Impersonate-User header + HandleImpersonation middleware - Per-request auth context swap (admin session never modified) - IP pinning, sensitive route blocking, no nesting, sliding 60-min TTL - Activity log auto-tagged with impersonated_by during sessions - Frontend: sessionStorage, BroadcastChannel sync, countdown timer - ImpersonateDialog with reason + MFA verification flow - 26 comprehensive tests covering core, middleware, audit, lifecycle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
50 lines
1.3 KiB
PHP
50 lines
1.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Database\Factories;
|
|
|
|
use App\Models\ImpersonationSession;
|
|
use App\Models\User;
|
|
use Illuminate\Database\Eloquent\Factories\Factory;
|
|
|
|
/** @extends Factory<ImpersonationSession> */
|
|
final class ImpersonationSessionFactory extends Factory
|
|
{
|
|
protected $model = ImpersonationSession::class;
|
|
|
|
/** @return array<string, mixed> */
|
|
public function definition(): array
|
|
{
|
|
return [
|
|
'admin_id' => User::factory(),
|
|
'target_user_id' => User::factory(),
|
|
'reason' => fake()->sentence(),
|
|
'mfa_method' => 'totp',
|
|
'ip_address' => fake()->ipv4(),
|
|
'user_agent' => fake()->userAgent(),
|
|
'started_at' => now(),
|
|
'expires_at' => now()->addMinutes(60),
|
|
'actions_count' => 0,
|
|
];
|
|
}
|
|
|
|
public function ended(string $reason = 'manual'): static
|
|
{
|
|
return $this->state(fn () => [
|
|
'ended_at' => now(),
|
|
'end_reason' => $reason,
|
|
]);
|
|
}
|
|
|
|
public function expired(): static
|
|
{
|
|
return $this->state(fn () => [
|
|
'started_at' => now()->subHours(2),
|
|
'expires_at' => now()->subHour(),
|
|
'ended_at' => now()->subHour(),
|
|
'end_reason' => 'expired',
|
|
]);
|
|
}
|
|
}
|