Enh/allow impersonate

Events.php

@@ -31,6 +31,7 @@ public static function onBeforeRequest($event)
 
             // Auth
             ['pattern' => 'auth/login', 'route' => 'rest/auth/auth/index', 'verb' => ['POST']],
+            ['pattern' => 'auth/impersonate', 'route' => 'rest/auth/auth/impersonate', 'verb' => ['POST']],
             ['pattern' => 'auth/current', 'route' => 'rest/auth/auth/current', 'verb' => ['GET', 'HEAD']],
 
             // User: Default Controller

components/BaseController.php

@@ -7,6 +7,7 @@
 
 namespace humhub\modules\rest\components;
 
+use humhub\modules\rest\components\auth\ImpersonateAuth;
 use Yii;
 use yii\data\Pagination;
 use yii\db\ActiveQuery;
@@ -75,6 +76,9 @@ public function behaviors()
                             return null;
                         },
                     ]] : [],
+                    [[
+                        'class' => ImpersonateAuth::class,
+                    ]]
                 ),
             ],
         ], parent::behaviors());

components/auth/ImpersonateAuth.php

@@ -0,0 +1,59 @@
+<?php
+/**
+ * @link https://www.humhub.org/
+ * @copyright Copyright (c) 2023 HumHub GmbH & Co. KG
+ * @license https://www.humhub.com/licences
+ */
+
+namespace humhub\modules\rest\components\auth;
+
+use yii\db\Expression;
+use yii\filters\auth\HttpBearerAuth;
+use yii\helpers\StringHelper;
+use humhub\modules\rest\models\ImpersonateAuthToken;
+use humhub\modules\user\models\User;
+use Firebase\JWT\JWT;
+
+class ImpersonateAuth extends HttpBearerAuth
+{
+    public $pattern = '/^Impersonate\s+(.*?)$/';
+
+    public function authenticate($user, $request, $response)
+    {
+        $authHeader = $request->getHeaders()->get($this->header);
+
+        if ($authHeader !== null) {
+            if ($this->pattern !== null) {
+                if (preg_match($this->pattern, $authHeader, $matches)) {
+                    $authHeader = $matches[1];
+                } else {
+                    return null;
+                }
+
+                if (!StringHelper::startsWith($authHeader, 'impersonate-')) {
+                    return null;
+                }
+            }
+
+            $accessToken = ImpersonateAuthToken::find()
+                ->where(['token' => $authHeader])
+                ->andWhere(['>', 'expiration', new Expression('NOW()')])
+                ->one();
+
+            if ($accessToken && ($identity = $accessToken->user)) {
+                $user->login($identity);
+            } else {
+                $identity = null;
+            }
+
+            if ($identity === null) {
+                $this->challenge($response);
+                $this->handleFailure($response);
+            }
+
+            return $identity;
+        }
+
+        return null;
+    }
+}

controllers/auth/AuthController.php

@@ -10,18 +10,21 @@
 use Firebase\JWT\JWT;
 use humhub\modules\rest\components\BaseController;
 use humhub\modules\rest\definitions\UserDefinitions;
+use humhub\modules\rest\models\ImpersonateAuthToken;
 use humhub\modules\rest\models\JwtAuthForm;
 use humhub\modules\user\models\forms\Login;
 use humhub\modules\user\models\User;
 use humhub\modules\user\services\AuthClientService;
 use Yii;
+use yii\web\ForbiddenHttpException;
 use yii\web\JsonParser;
+use yii\web\NotFoundHttpException;
 
 class AuthController extends BaseController
 {
     public function beforeAction($action)
     {
-        if ($action->id == 'current') {
+        if (in_array($action->id, ['current', 'impersonate'])) {
             return parent::beforeAction($action);
         }
 
@@ -92,4 +95,30 @@ public function actionCurrent()
 
         return UserDefinitions::getUser($user);
     }
+
+    public function actionImpersonate()
+    {
+        if (!Yii::$app->user->isAdmin()) {
+            throw new ForbiddenHttpException();
+        }
+
+        $user = User::findOne(['id' => Yii::$app->request->getBodyParam('userId')]);
+
+        if ($user === null) {
+            throw new NotFoundHttpException();
+        }
+
+        if ($token = ImpersonateAuthToken::findOne(['user_id' => $user->id])) {
+            $token->delete();
+        }
+
+        $token = new ImpersonateAuthToken();
+        $token->user_id = $user->id;
+        $token->save();
+
+        return [
+            'token' => $token->token,
+            'expires' => $token->expiration,
+        ];
+    }
 }

docs/CHANGELOG.md

@@ -6,6 +6,7 @@ Changelog
 - Fix #110: Fix PHP Error in UserDefinition
 - Enh #106: Allow to set `authclient` and `authclient_id` on user creating and updating
 - Enh #112: Added support of HttpBearer and QueryParam auth methods
+- Enh #117: Added support of user Impersonate
 
 0.8.0 (March 10, 2023)
 ----------------------