fix: run View as policy checks as the target user

Keep the admin JWT subject for logout/refresh/control-plane, but stamp
impUid on the access token so overlay (and Agent Bearer fallback) evaluate
as the viewed-as user. Never provision the admin session JWT into an Agent
profile while impersonating, and forward the effective username to the
Agent API instead of hardcoding admin.

Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>

Author: cursoragent

CLAUDE.md

@@ -210,7 +210,13 @@ returns a number).
 5. **Design**: Minimal black/white/grey palette, Inter font, subtle transitions. See UX guidelines in full CLAUDE.md.
 
 ### Admin profile switch
-Admins can **View as** a sub-user from the top-right of the home layout (`ProfileSwitch`) to verify connection ACLs, chat/editor policies, and role-gated nav. The admin JWT stays on the session; `ImpersonationService` sets an httpOnly `impersonate_user` cookie and `JwtAuthenticationFilter` overlays the target principal. `POST|DELETE|GET /api/admin/impersonate` are excluded from the overlay so stop/list still run as the real admin. Cannot target another ADMIN, self, or a non-ACTIVE account. `/auth/me` returns the **effective** user plus `impersonating` / `impersonatorUsername`.
+Admins can **View as** a sub-user from the top-right of the home layout (`ProfileSwitch`) to verify connection ACLs, chat/editor policies, and role-gated nav.
+
+The admin JWT **subject** stays the administrator so logout, refresh, and `/admin/impersonate` still own the real session. Policy identity is the target: an httpOnly `impersonate_user` cookie plus an `impUid` claim on the access token. `JwtAuthenticationFilter` overlays that principal onto the SecurityContext for every request except the impersonation control plane, logout, and session refresh. Chat, Editor, schema listing, and Agent MCP calls then run `AccessControlService` / `ConnectionChatAccessPolicyService` as the target (`actorIsAdmin` is false, so policies apply).
+
+The Agent tab must not inherit the admin MCP token. `/api/agent/session` mints an MCP token for the effective user and never falls back to the admin session JWT while View as is active. nginx `auth_request` on `/agent-api` forwards `/api/auth/me`'s `X-Remote-User` (the overlaid username) instead of hardcoding `admin`.
+
+`POST|DELETE|GET /api/admin/impersonate` are excluded from the overlay so stop/list still run as the real admin. Cannot target another ADMIN, self, or a non-ACTIVE account. `/auth/me` returns the **effective** user plus `impersonating` / `impersonatorUsername`.
 
 ### Git Rules
 - Do NOT commit automatically — wait for explicit user instruction.

backend/src/main/java/com/dbaagent/controller/AuthController.java

@@ -207,11 +207,21 @@ public ResponseEntity<?> refreshSession(HttpServletRequest httpRequest, HttpServ
         User effectiveUser = impersonationService.resolveFromCookie(httpRequest, user)
             .map(ImpersonationContext.State::target)
             .orElse(user);
-        // Keep the user's agent token alive for as long as the UI session lives.
-        // The SPA refreshes on access-token expiry (~every 15 min of activity), so
-        // this slides the agent token forward on each active interval — a logged-in
-        // UI never ends up with a dead agent.
+        if (effectiveUser != user && effectiveUser.getId() != null) {
+            authSessionService.reissueAccessToken(
+                httpResponse,
+                session.getId(),
+                user,
+                effectiveUser.getId()
+            );
+        }
+        // Keep agent tokens alive for as long as the UI session lives.
+        // During View as the SPA still refreshes the *admin* session; also
+        // slide the target user's minted MCP token or their Agent tab dies.
         agentBridgeService.extendAgentTokens(user.getUsername());
+        if (!effectiveUser.getUsername().equals(user.getUsername())) {
+            agentBridgeService.extendAgentTokens(effectiveUser.getUsername());
+        }
         Map<String, Object> payload = toAuthPayload(
             effectiveUser,
             effectiveUser.getRoleEnum(),

backend/src/main/java/com/dbaagent/security/ImpersonationContext.java

@@ -5,11 +5,12 @@
 import java.util.Optional;
 
 /**
- * Request-scoped impersonation overlay. The admin JWT stays on the session;
+ * Request-scoped impersonation overlay. The admin JWT subject stays on the
+ * session so logout/refresh/control-plane still own the real administrator;
  * {@link JwtAuthenticationFilter} swaps the SecurityContext principal to the
- * target user and records both identities here so {@code /auth/me} can show a
- * banner and {@code AccessControlService} can honour the target even when
- * {@code security.auth.enabled} is false.
+ * target user (from {@code impersonate_user} cookie or {@code impUid} claim)
+ * so policy evaluation, {@code /auth/me}, and {@code AccessControlService}
+ * honour the viewed-as user — including when {@code security.auth.enabled} is false.
  */
 public final class ImpersonationContext {
 

backend/src/main/java/com/dbaagent/security/JwtAuthenticationFilter.java

@@ -143,12 +143,30 @@ private void applyImpersonation(HttpServletRequest request, HttpServletResponse
             throws ServletException, IOException {
         try {
             impersonationService.applyToRequest(request);
+            stampEffectiveUser(response);
             chain.doFilter(request, response);
         } finally {
             ImpersonationContext.clear();
         }
     }
 
+    /**
+     * nginx {@code auth_request} on {@code /agent-api} forwards this as
+     * {@code X-Remote-User}. It must be the <em>effective</em> principal so
+     * View as (and non-admin Agent users) do not run the shared admin profile.
+     */
+    private void stampEffectiveUser(HttpServletResponse response) {
+        var authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication == null || !authentication.isAuthenticated()) {
+            return;
+        }
+        String name = authentication.getName();
+        if (name == null || name.isBlank() || "anonymousUser".equals(name)) {
+            return;
+        }
+        response.setHeader("X-Remote-User", name);
+    }
+
     private String extractUsernameSafely(String token) {
         if (token == null || token.isBlank()) {
             return null;

backend/src/main/java/com/dbaagent/security/JwtUtil.java

@@ -134,6 +134,17 @@ public String generateAccessToken(
         Role role,
         Set<Permission> permissions,
         Duration ttl
+    ) {
+        return generateAccessToken(username, sessionId, role, permissions, ttl, null);
+    }
+
+    public String generateAccessToken(
+        String username,
+        String sessionId,
+        Role role,
+        Set<Permission> permissions,
+        Duration ttl,
+        Long impersonateUserId
     ) {
         Map<String, Object> claims = new HashMap<>();
         claims.put("role", role.name());
@@ -145,10 +156,36 @@ public String generateAccessToken(
         if (sessionId != null && !sessionId.isBlank()) {
             claims.put("sid", sessionId);
         }
+        if (impersonateUserId != null && impersonateUserId > 0) {
+            claims.put("impUid", impersonateUserId);
+        }
 
         return createToken(claims, username, ttl);
     }
 
+    /**
+     * Target user id stamped onto an admin access token during View as.
+     * The JWT subject stays the administrator so logout/refresh/control-plane
+     * still own the real session; policy evaluation overlays this user.
+     */
+    public Long extractImpersonateUserId(String token) {
+        Claims claims = extractAllClaims(token);
+        Object raw = claims.get("impUid");
+        if (raw instanceof Number number) {
+            long value = number.longValue();
+            return value > 0 ? value : null;
+        }
+        if (raw instanceof String text && !text.isBlank()) {
+            try {
+                long value = Long.parseLong(text.trim());
+                return value > 0 ? value : null;
+            } catch (NumberFormatException e) {
+                return null;
+            }
+        }
+        return null;
+    }
+
     /**
      * Generate token with role string and permissions set.
      */

backend/src/main/java/com/dbaagent/service/AgentBridgeService.java

@@ -1,5 +1,6 @@
 package com.dbaagent.service;
 
+import com.dbaagent.security.ImpersonationContext;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -142,9 +143,19 @@ public record ProfileBootstrap(String profile, String token) {}
     public ProfileBootstrap ensureProfile(String username, String authToken, String connectionId) {
         String profile = profileFor(username);
         if (!provisionEnabled) {
+            if (ImpersonationContext.isActive()) {
+                throw new ProvisioningException(
+                    "Agent provisioning is disabled; View as cannot bind a user-scoped Agent token"
+                );
+            }
             return new ProfileBootstrap(profile, authToken);
         }
         if (provisionSecret == null || provisionSecret.isBlank()) {
+            if (ImpersonationContext.isActive()) {
+                throw new ProvisioningException(
+                    "Agent provisioning is not configured; View as cannot bind a user-scoped Agent token"
+                );
+            }
             log.warn("agent.provision-secret is unset — skipping per-user provisioning for {}", username);
             return new ProfileBootstrap(profile, authToken);
         }
@@ -154,9 +165,15 @@ public ProfileBootstrap ensureProfile(String username, String authToken, String
         // every MCP call. Mint a dedicated, user-scoped, revocable MCP token
         // instead (authenticated by McpTokenAuthenticationFilter, not the session
         // filter). Fall back to the session token only if minting fails so the
-        // tab still opens.
+        // tab still opens — except during View as, where the session JWT is the
+        // administrator's and would skip the target user's policy.
         String agentToken = mintAgentToken(username);
         if (agentToken == null) {
+            if (ImpersonationContext.isActive()) {
+                throw new ProvisioningException(
+                    "Could not mint an MCP token for " + username + " while viewing as that user"
+                );
+            }
             agentToken = authToken == null ? "" : authToken;
         }
         callProvisioner(username, profile, agentToken, connectionId);

backend/src/main/java/com/dbaagent/service/AgentChatClient.java

@@ -136,7 +136,7 @@ private void switchProfile(String profile) throws Exception {
             throw new IllegalArgumentException("agent profile is required");
         }
         // Profiles are provisioned as u-<username>; the trusted-auth header is the
-        // bare username (nginx hard-codes X-Remote-User: admin for the browser path).
+        // bare username (browser /agent-api gets this from /api/auth/me via nginx).
         remoteUser = profile.startsWith("u-") ? profile.substring(2) : profile;
         postJson("/api/profile/switch", Map.of("name", profile));
     }

backend/src/main/java/com/dbaagent/service/AuthSessionService.java

@@ -155,6 +155,32 @@ public void writeSessionCookies(HttpServletResponse response, SessionAuthenticat
         response.addHeader(HttpHeaders.SET_COOKIE, buildRefreshCookie(sessionAuthentication.refreshToken()).toString());
     }
 
+    /**
+     * Rewrite the access cookie in place (same session id) so View as can stamp
+     * or clear {@code impUid} without rotating the refresh token. {@code impersonateUserId}
+     * null clears the claim.
+     */
+    public void reissueAccessToken(
+        HttpServletResponse response,
+        String sessionId,
+        User sessionOwner,
+        Long impersonateUserId
+    ) {
+        if (response == null || sessionId == null || sessionId.isBlank() || sessionOwner == null) {
+            return;
+        }
+        Role role = sessionOwner.getRoleEnum();
+        String accessToken = jwtUtil.generateAccessToken(
+            sessionOwner.getUsername(),
+            sessionId,
+            role,
+            role.getPermissions(),
+            Duration.ofMinutes(accessMinutes),
+            impersonateUserId
+        );
+        response.addHeader(HttpHeaders.SET_COOKIE, buildAccessCookie(accessToken).toString());
+    }
+
     public void writeImpersonationCookie(HttpServletResponse response, String cookieName, long targetUserId) {
         response.addHeader(HttpHeaders.SET_COOKIE, ResponseCookie.from(cookieName, Long.toString(targetUserId))
             .httpOnly(true)

backend/src/main/java/com/dbaagent/service/ImpersonationService.java

@@ -7,6 +7,7 @@
 import com.dbaagent.repository.UserRepository;
 import com.dbaagent.security.CustomUserDetailsService;
 import com.dbaagent.security.ImpersonationContext;
+import com.dbaagent.security.JwtUtil;
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
@@ -33,10 +34,18 @@
 import static org.springframework.http.HttpStatus.NOT_FOUND;
 
 /**
- * Admin-only profile switch. The admin session (JWT cookies) is unchanged;
- * a separate httpOnly cookie names the user to evaluate as. The JWT filter
- * overlays that principal onto the SecurityContext for every request except
- * the impersonation control plane, logout, and session refresh.
+ * Admin-only profile switch so an administrator can verify another user's
+ * connection ACLs and chat/editor policies.
+ *
+ * <p>The admin session stays the real session (logout/refresh/control-plane).
+ * Identity for policy is the target user: an httpOnly {@code impersonate_user}
+ * cookie plus an {@code impUid} claim on the access JWT. The JWT filter overlays
+ * that principal onto the SecurityContext for every request except the
+ * impersonation control plane, logout, and session refresh.
+ *
+ * <p>The {@code impUid} claim matters for callers that send the access token as
+ * a Bearer credential without cookies (Agent MCP fallback). Cookie-only overlay
+ * left those paths running as the administrator, which skipped policy.
  */
 @Service
 @RequiredArgsConstructor
@@ -49,13 +58,17 @@ public class ImpersonationService {
     private final CustomUserDetailsService userDetailsService;
     private final AuthSessionService authSessionService;
     private final SecurityEventService securityEventService;
+    private final JwtUtil jwtUtil;
 
     @Value("${security.auth.enabled:true}")
     private boolean authEnabled;
 
     @Value("${security.cookie.impersonate-name:" + DEFAULT_COOKIE_NAME + "}")
     private String impersonateCookieName;
 
+    @Value("${security.cookie.name:auth_token}")
+    private String accessCookieName;
+
     public ImpersonationContext.State start(
         User actor,
         Long targetUserId,
@@ -65,6 +78,7 @@ public ImpersonationContext.State start(
         requireAdminActor(actor);
         User target = requireAllowedTarget(actor, targetUserId);
         authSessionService.writeImpersonationCookie(response, impersonateCookieName, target.getId());
+        rewriteAccessToken(request, response, actor, target.getId());
         securityEventService.log(SecurityEventService.EventRequest.builder()
             .eventType(SecurityEventType.IMPERSONATION_STARTED)
             .outcome(SecurityEventOutcome.SUCCESS)
@@ -91,6 +105,7 @@ public User stop(
         requireAdminActor(actor);
         Optional<User> target = readTargetUser(request);
         authSessionService.clearImpersonationCookie(response, impersonateCookieName);
+        rewriteAccessToken(request, response, actor, null);
         ImpersonationContext.clear();
         target.ifPresent(stopped -> securityEventService.log(SecurityEventService.EventRequest.builder()
             .eventType(SecurityEventType.IMPERSONATION_STOPPED)
@@ -145,6 +160,10 @@ public void decorateAuthPayload(HttpServletRequest request, User sessionUser, Ma
      * Overlay the target principal when the admin JWT (or the auth-disabled
      * synthetic admin) is already in the SecurityContext. No-ops on the
      * impersonation control-plane, logout/refresh, MCP tokens, and invalid cookies.
+     *
+     * <p>The target is taken from the {@code impersonate_user} cookie first, then
+     * from the access token's {@code impUid} claim so Bearer callers without
+     * cookies still evaluate policy as the viewed-as user.
      */
     public void applyToRequest(HttpServletRequest request) {
         if (!shouldApply(request)) {
@@ -218,6 +237,14 @@ private Optional<User> readTargetUser(HttpServletRequest request) {
     }
 
     private Long readTargetUserId(HttpServletRequest request) {
+        Long fromCookie = readTargetUserIdFromCookie(request);
+        if (fromCookie != null) {
+            return fromCookie;
+        }
+        return readTargetUserIdFromJwt(request);
+    }
+
+    private Long readTargetUserIdFromCookie(HttpServletRequest request) {
         Cookie[] cookies = request.getCookies();
         if (cookies == null) {
             return null;
@@ -230,6 +257,69 @@ private Long readTargetUserId(HttpServletRequest request) {
         return null;
     }
 
+    private Long readTargetUserIdFromJwt(HttpServletRequest request) {
+        String jwt = readAccessJwt(request);
+        if (jwt == null) {
+            return null;
+        }
+        try {
+            return jwtUtil.extractImpersonateUserId(jwt);
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    private void rewriteAccessToken(
+        HttpServletRequest request,
+        HttpServletResponse response,
+        User sessionOwner,
+        Long impersonateUserId
+    ) {
+        String sessionId = sessionIdFrom(request);
+        if (sessionId == null) {
+            return;
+        }
+        authSessionService.reissueAccessToken(response, sessionId, sessionOwner, impersonateUserId);
+    }
+
+    private String sessionIdFrom(HttpServletRequest request) {
+        Object attr = request.getAttribute("auth.sessionId");
+        if (attr instanceof String sid && !sid.isBlank()) {
+            return sid;
+        }
+        String jwt = readAccessJwt(request);
+        if (jwt == null) {
+            return null;
+        }
+        try {
+            String sessionId = jwtUtil.extractSessionId(jwt);
+            return sessionId == null || sessionId.isBlank() ? null : sessionId;
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    private String readAccessJwt(HttpServletRequest request) {
+        String authorization = request.getHeader(HttpHeaders.AUTHORIZATION);
+        if (authorization != null && authorization.startsWith("Bearer ")) {
+            String token = authorization.substring(7);
+            if (token.startsWith(McpTokenService.TOKEN_PREFIX)) {
+                return null;
+            }
+            return token.isBlank() ? null : token;
+        }
+        Cookie[] cookies = request.getCookies();
+        if (cookies == null) {
+            return null;
+        }
+        for (Cookie cookie : cookies) {
+            if (accessCookieName.equals(cookie.getName())) {
+                return cookie.getValue();
+            }
+        }
+        return null;
+    }
+
     private Long parseUserId(String value) {
         if (value == null || value.isBlank()) {
             return null;