feat(account): super-admin read-only "view as" (customer impersonation)#262

Merged

kilbot merged 16 commits into

mainfrom

worktree-super-admin-view-as

Jul 6, 2026

Commits on Jul 5, 2026

feat(admin): owner allowlist + isAdmin (config-in-code)
kilbot
committed
feat(admin): findAdminCustomerByEmail + getAdminCustomerById
kilbot
committed
refactor(auth): extract getSessionCustomer; getCustomer delegates
kilbot
committed
feat(account): stamp x-wcpos-account-request header for impersonation scope
kilbot
committed
feat(impersonation): getImpersonation resolver + assertViewOnly guard
kilbot
committed
feat(impersonation): getCustomer + order fetchers resolve the target
kilbot
committed
feat(impersonation): block mutating account routes during inspection
kilbot
committed
feat(impersonation): owner-only /account/admin entry + start action
kilbot
committed
feat(impersonation): read-only banner + exit route
kilbot
committed
fix(test): ViewOnlyError takes no constructor args
kilbot
committed
test(impersonation): end-to-end lib-layer resolve + orders
kilbot
committed
fix(impersonation): strip spoofable scope header, session-safe OAuth callback, stale-target auto-exit
kilbot
committed
fix: address impersonation review feedback
wcpos-agents[bot]
committed
fix: address impersonation audit review feedback
wcpos-agents[bot]
committed

Commits on Jul 6, 2026