From 6920333d6afc80c5540379b041dd54da820a09d2 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Tue, 27 Jan 2026 10:45:06 -0600
Subject: [PATCH] impersonate fix

---
 CLAUDE.md                                     | 19 +++++++++++++++++++
 .../live/admin/user_live/index.html.heex      |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 3fa310e6..e5492a5a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -259,6 +259,25 @@ All Oban packages are vendored in `vendor/` to avoid requiring authentication du
 
 See `vendor/README.md` for update instructions.
 
+## Admin Features
+
+### User Impersonation
+
+**Location**: `/admin/users` (superuser only)
+
+**Files**:
+- LiveView: `lib/towerops_web/live/admin/user_live/index.ex`
+- Template: `lib/towerops_web/live/admin/user_live/index.html.heex`
+- Controller: `lib/towerops_web/controllers/admin_controller.ex`
+- Auth: `lib/towerops_web/user_auth.ex` (start_impersonation/2, stop_impersonation/1)
+
+**Implementation Notes**:
+- Impersonate button is disabled only when `user.id == @current_scope.user.id` (prevents impersonating yourself)
+- Superusers CAN impersonate other superusers (security feature, not bug)
+- Backend checks in `UserAuth.start_impersonation/2` prevent self-impersonation
+- All impersonation events are logged to audit_logs table via `Towerops.Admin.create_audit_log/1`
+- Stop impersonation: "Stop Impersonating" link appears in user menu when impersonating
+
 ## Project-Specific Constraints
 
 Key constraints from AGENTS.md (see that file for complete details):
diff --git a/lib/towerops_web/live/admin/user_live/index.html.heex b/lib/towerops_web/live/admin/user_live/index.html.heex
index 8ac4ba9d..79d290f8 100644
--- a/lib/towerops_web/live/admin/user_live/index.html.heex
+++ b/lib/towerops_web/live/admin/user_live/index.html.heex
@@ -19,7 +19,7 @@
               <input type="hidden" name="_csrf_token" value={Phoenix.Controller.get_csrf_token()} />
               <button
                 type="submit"
-                disabled={user.is_superuser}
+                disabled={user.id == @current_scope.user.id}
                 class="text-sm text-blue-600 dark:text-blue-400 hover:text-blue-800 dark:hover:text-blue-300 disabled:text-gray-400 disabled:cursor-not-allowed"
               >
                 Impersonate