feat: admin-only profile switch to verify user policies - #66
Merged
venkateshsakamuri-lab merged 5 commits intoAug 19, 2026
Conversation
Admins can view the product as a sub-user from the top-right control. The admin JWT stays on the session; an httpOnly impersonation cookie overlays the target principal so connection ACLs, chat/editor policies, and role-gated nav apply as they would for that user. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
The switch sat absolutely over the Agent header, so clicks hit the section underneath. Put it in a dedicated top-right bar instead. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
The Docs sidebar tab is no longer a product surface. Persisted docs nav state now lands on Agent. Remove HelpTooltip wrappers from the profile-switch CTAs so they no longer intercept clicks. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
The Agent tab 503'd because native spring-boot:run sourced Compose DNS (deepsql-agent:8788) which does not resolve on the host. Remap those hosts to loopback in start-backend.sh, and let the agent container reach a host-side Java backend via host.docker.internal. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
Vite has no nginx auth_request, so the Agent tab 401'd on profile/switch. Send X-Remote-User from /api/agent/session's username (including impersonation) and replay it on SSE via the proxy. Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>
venkateshsakamuri-lab
marked this pull request as ready for review
August 18, 2026 18:33
venkateshsakamuri-lab
requested review from
a team and
geekypunk
as code owners
August 18, 2026 18:33
venkateshsakamuri-lab
merged commit Aug 19, 2026
1cf7eac
into
cursor/schema-policy-multischema-c497
5 of 6 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Admins can switch into a sub-user profile from the top-right of the app to verify that connection ACLs, chat/editor policies, and role-gated navigation actually apply.
How it works
The admin JWT stays on the session. Starting a switch sets an httpOnly
impersonate_usercookie.JwtAuthenticationFilteroverlays the target user's principal so every access check (AccessControlService, policies,/auth/me) runs as that user.The impersonation control plane (
GET|POST|DELETE /api/admin/impersonate), logout, refresh, and MCP tokens are excluded from the overlay so the real admin can stop the switch and so CLI tokens cannot ride the cookie.Guardrails
IMPERSONATION_STARTED/IMPERSONATION_STOPPEDUI
Viewing as <user>with Exitdocsnav state lands on AgentAPI
GET /api/admin/impersonate— candidates + current statusPOST /api/admin/impersonate{ userId }— startDELETE /api/admin/impersonate— stopGET /api/auth/mereturns the effective user plusimpersonating/impersonatorUsernameStacked on #65 so policy enforcement can be verified by switching into
marts-editor.Native Agent tab (follow-up on this branch)
The Agent tab 503'd on native
mvn spring-boot:runbecause.envstill used Compose DNS (deepsql-agent:8788) and Vite had no nginxX-Remote-Userstamp.scripts/start-backend.shnow remaps unresolvable Compose hosts to loopback, the agent container can reach a host-side backend viahost.docker.internal, and Vite forwards the effective username (including impersonation) to the Agent API.Agent answered table count on ACME ERP
Only ACME ERP Multi-Schema connection remains
agent_working_and_acme_connection.mp4
Profile switch walkthrough
Sidebar without Docs
Admin View as control
View as dropdown listing marts-editor
Viewing as marts-editor banner
Editor shows only marts tables while switched
admin_profile_switch_view_as_exit.mp4
To show artifacts inline, enable in settings.