impersonate fix

CLAUDE.md

@@ -259,6 +259,25 @@ All Oban packages are vendored in `vendor/` to avoid requiring authentication du
 
 See `vendor/README.md` for update instructions.
 
+## Admin Features
+
+### User Impersonation
+
+**Location**: `/admin/users` (superuser only)
+
+**Files**:
+- LiveView: `lib/towerops_web/live/admin/user_live/index.ex`
+- Template: `lib/towerops_web/live/admin/user_live/index.html.heex`
+- Controller: `lib/towerops_web/controllers/admin_controller.ex`
+- Auth: `lib/towerops_web/user_auth.ex` (start_impersonation/2, stop_impersonation/1)
+
+**Implementation Notes**:
+- Impersonate button is disabled only when `user.id == @current_scope.user.id` (prevents impersonating yourself)
+- Superusers CAN impersonate other superusers (security feature, not bug)
+- Backend checks in `UserAuth.start_impersonation/2` prevent self-impersonation
+- All impersonation events are logged to audit_logs table via `Towerops.Admin.create_audit_log/1`
+- Stop impersonation: "Stop Impersonating" link appears in user menu when impersonating
+
 ## Project-Specific Constraints
 
 Key constraints from AGENTS.md (see that file for complete details):

lib/towerops_web/live/admin/user_live/index.html.heex

@@ -19,7 +19,7 @@
               <input type="hidden" name="_csrf_token" value={Phoenix.Controller.get_csrf_token()} />
               <button
                 type="submit"
-                disabled={user.is_superuser}
+                disabled={user.id == @current_scope.user.id}
                 class="text-sm text-blue-600 dark:text-blue-400 hover:text-blue-800 dark:hover:text-blue-300 disabled:text-gray-400 disabled:cursor-not-allowed"
               >
                 Impersonate