Files
twenty/packages/twenty-server/test/integration/graphql/utils/impersonate.util.ts
T
Paul Rastoin e7e99247e8 Centralize and standardize impersonation validation rules (#21717)
# Introduction
Followup https://github.com/twentyhq/twenty/pull/21707

## Behavioral change worth calling out
Server-level impersonation now requires verified 2FA outside development
at every checkpoint (generation, exchange, and per-request). In main the
2FA gate only existed in ImpersonationService. This is the right
tightening, but it means existing server-admin impersonation sessions in
production for admins without verified 2FA will now be rejected on the
next request, not just at token creation.

cc @s0yd4RK

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21717?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Co-authored-by: s0yd4RK <285671363+s0yd4RK@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-18 13:13:50 +02:00

66 lines
1.8 KiB
TypeScript

import gql from 'graphql-tag';
import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
import { type ImpersonateDTO } from 'src/engine/core-modules/admin-panel/dtos/impersonate.dto';
type ImpersonateUtilArgs = {
userId: string;
workspaceId: string;
accessToken: string;
expectToFail?: boolean;
};
export const impersonate = async ({
userId,
workspaceId,
accessToken,
expectToFail,
}: ImpersonateUtilArgs): CommonResponseBody<{
impersonate: ImpersonateDTO;
}> => {
const mutation = gql`
mutation Impersonate($userId: UUID!, $workspaceId: UUID!) {
impersonate(userId: $userId, workspaceId: $workspaceId) {
loginToken {
token
expiresAt
}
workspace {
id
workspaceUrls {
subdomainUrl
customUrl
}
}
}
}
`;
const response = await makeMetadataAPIRequest(
{
query: mutation,
variables: { userId, workspaceId },
},
accessToken,
);
if (expectToFail === true) {
warnIfNoErrorButExpectedToFail({
response,
errorMessage: 'Impersonate should have failed but did not',
});
}
if (expectToFail === false) {
warnIfErrorButNotExpectedToFail({
response,
errorMessage: 'Impersonate has failed but should not',
});
}
return { data: response.body.data, errors: response.body.errors };
};