From ceef958265e605bc4737c9c7b8319d99160b81b9 Mon Sep 17 00:00:00 2001 From: Gilad Resisi Date: Wed, 1 Jul 2026 17:02:24 +0700 Subject: [PATCH] fix(admin): exclude the current admin from the impersonation search An admin could see and pick their own account in the impersonation list and "impersonate" themselves. getImpersonateUser now takes the requesting user id and excludes it from the results, so an admin can neither impersonate nor (via the same search) switch to themselves. Co-Authored-By: Claude Opus 4.8 --- apps/backend/src/api/routes/users.controller.ts | 2 +- .../database/prisma/organizations/organization.repository.ts | 4 +++- .../src/database/prisma/users/users.service.ts | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/apps/backend/src/api/routes/users.controller.ts b/apps/backend/src/api/routes/users.controller.ts index 98e888d72c..8557585ff5 100644 --- a/apps/backend/src/api/routes/users.controller.ts +++ b/apps/backend/src/api/routes/users.controller.ts @@ -153,7 +153,7 @@ export class UsersController { throw new HttpException('Unauthorized', 400); } - return this._userService.getImpersonateUser(name); + return this._userService.getImpersonateUser(name, user.id); } @Post('/impersonate') diff --git a/libraries/nestjs-libraries/src/database/prisma/organizations/organization.repository.ts b/libraries/nestjs-libraries/src/database/prisma/organizations/organization.repository.ts index a18bda09a6..3c6fba1978 100644 --- a/libraries/nestjs-libraries/src/database/prisma/organizations/organization.repository.ts +++ b/libraries/nestjs-libraries/src/database/prisma/organizations/organization.repository.ts @@ -103,9 +103,11 @@ export class OrganizationRepository { }); } - getImpersonateUser(name: string) { + getImpersonateUser(name: string, excludeUserId?: string) { return this._userOrg.model.userOrganization.findMany({ where: { + // Never let an admin impersonate (or switch to) themselves. + ...(excludeUserId ? { userId: { not: excludeUserId } } : {}), OR: [ { organizationId: { diff --git a/libraries/nestjs-libraries/src/database/prisma/users/users.service.ts b/libraries/nestjs-libraries/src/database/prisma/users/users.service.ts index 863949cbc2..bbae439e4d 100644 --- a/libraries/nestjs-libraries/src/database/prisma/users/users.service.ts +++ b/libraries/nestjs-libraries/src/database/prisma/users/users.service.ts @@ -20,8 +20,8 @@ export class UsersService { return this._usersRepository.getUserById(id); } - getImpersonateUser(name: string) { - return this._organizationRepository.getImpersonateUser(name); + getImpersonateUser(name: string, excludeUserId?: string) { + return this._organizationRepository.getImpersonateUser(name, excludeUserId); } getUserByProvider(providerId: string, provider: Provider) {