How to log into a regular account from admin account (Impersonation)

[jmaldon1]

Just wondering how I could go about switching from an admin user to a regular user given the regular user's ID. The only difference between the users is their role column in my DB. I am specifically using the auth0 strategy, but I am hoping this question is general enough to be asked here.

[sergiodxa]

I'm not sure how this relates to Remix Auth and authentication in general, if as you said the difference between a regular and admin user is a role column in the DB you just need to change that in your DB for your user, this is completely outside authentication and falls into your app specific business logic.

[sergiodxa]

Ahh you want to impersonate an user, what I would do is to manually store in the session the ID of the impersonated user.

let session = await sessionStorage.getSession(request.headers.get("cookie")
session.set("impersonated", userId)
// commit the session and send it to the browser

I would not replace the authenticator.sessionKey data, instead I would store in another key the ID of the impersonated user or any other data my app would need (like an access token, name, avatar, etc.)

Then I would wrap the authenticator.isAuthenticated call to check for this key.

function isAuthenticated(request: Request, { failureRedirect }: { failureRedirect: string }) {
  let auth = await authenticator.isAuthenticated(request, { failureRedirect })

  if (auth.role !== "admin") return auth; // for normal users return auth data

  let session = await sessionStorage.getSession(request.headers.get("cookie")

  // for admin non impersonating another users return the auth data
  if (!session.has("impersonated")) return auth;

  // for admins impersonating another user, return the impersonated data, cast the type to be the
  // same data that isAuthenticated returns so you always use the same shape
  return session.get("impersonated") as User
}

You can do more things then, like detect if the user is impersonating another user and show a bar at the top to remove the impersonation.

[jmaldon1]

Yup this makes a lot of sense. Thanks!

[jmaldon1]

@sergiodxa Do you know if there is a way to get the result of the call await authenticator.isAuthenticated(request, { failureRedirect }) but for the user I am trying to impersonate? The shape of my auth includes the data returned from auth0 when I run the authenticator.isAuthenticated function.

[jmaldon1]

I am guessing I might need the user im trying to impersonate's access_token which I might not be able to get unless they login?

[sergiodxa]

isAuthenticated is always going to return the data stored in authenticator.sessionKey, you could manually replace it, but I would recommend you to don't do that, be explicit that you're authenticated as user A and you're impersonating user B.