bert.hausmans
4df668b5b8
Replaces the insecure token-in-localStorage approach with a header-based impersonation system backed by cache sessions and MFA verification. Key changes: - New impersonation_sessions audit table (immutable, ULID PK) - MFA verification required to start impersonation (TOTP/email/backup) - X-Impersonate-User header + HandleImpersonation middleware - Per-request auth context swap (admin session never modified) - IP pinning, sensitive route blocking, no nesting, sliding 60-min TTL - Activity log auto-tagged with impersonated_by during sessions - Frontend: sessionStorage, BroadcastChannel sync, countdown timer - ImpersonateDialog with reason + MFA verification flow - 26 comprehensive tests covering core, middleware, audit, lifecycle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
592 B
PHP
26 lines
592 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Requests\Admin;
|
|
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
|
|
class StartImpersonationRequest extends FormRequest
|
|
{
|
|
public function authorize(): bool
|
|
{
|
|
return true; // Authorization handled in service
|
|
}
|
|
|
|
/** @return array<string, mixed> */
|
|
public function rules(): array
|
|
{
|
|
return [
|
|
'reason' => ['required', 'string', 'min:5', 'max:500'],
|
|
'mfa_code' => ['required', 'string'],
|
|
'mfa_method' => ['required', 'string', 'in:totp,email,backup_code'],
|
|
];
|
|
}
|
|
}
|