diff --git a/passbook/core/tests/test_impersonation.py b/passbook/core/tests/test_impersonation.py
new file mode 100644
index 000000000..ba365e421
--- /dev/null
+++ b/passbook/core/tests/test_impersonation.py
@@ -0,0 +1,55 @@
+"""impersonation tests"""
+from django.shortcuts import reverse
+from django.test.testcases import TestCase
+
+from passbook.core.models import User
+
+
+class TestImpersonation(TestCase):
+ """impersonation tests"""
+
+ def setUp(self) -> None:
+ super().setUp()
+ self.other_user = User.objects.create(username="to-impersonate")
+ self.pbadmin = User.objects.get(username="pbadmin")
+
+ def test_impersonate_simple(self):
+ """test simple impersonation and un-impersonation"""
+ self.client.force_login(self.pbadmin)
+
+ self.client.get(
+ reverse(
+ "passbook_core:impersonate-init", kwargs={"user_id": self.other_user.pk}
+ )
+ )
+
+ response = self.client.get(reverse("passbook_core:overview"))
+ self.assertIn(self.other_user.username, response.content.decode())
+ self.assertNotIn(self.pbadmin.username, response.content.decode())
+
+ self.client.get(reverse("passbook_core:impersonate-end"))
+
+ response = self.client.get(reverse("passbook_core:overview"))
+ self.assertNotIn(self.other_user.username, response.content.decode())
+ self.assertIn(self.pbadmin.username, response.content.decode())
+
+ def test_impersonate_denied(self):
+ """test impersonation without permissions"""
+ self.client.force_login(self.other_user)
+
+ self.client.get(
+ reverse(
+ "passbook_core:impersonate-init", kwargs={"user_id": self.pbadmin.pk}
+ )
+ )
+
+ response = self.client.get(reverse("passbook_core:overview"))
+ self.assertIn(self.other_user.username, response.content.decode())
+ self.assertNotIn(self.pbadmin.username, response.content.decode())
+
+ def test_un_impersonate_empty(self):
+ """test un-impersonation without impersonating first"""
+ self.client.force_login(self.other_user)
+
+ response = self.client.get(reverse("passbook_core:impersonate-end"))
+ self.assertRedirects(response, reverse("passbook_core:overview"))
diff --git a/passbook/core/urls.py b/passbook/core/urls.py
index df29adde5..881b2e021 100644
--- a/passbook/core/urls.py
+++ b/passbook/core/urls.py
@@ -1,11 +1,22 @@
"""passbook URL Configuration"""
from django.urls import path
-from passbook.core.views import overview, user
+from passbook.core.views import impersonate, overview, user
urlpatterns = [
# User views
path("-/user/", user.UserSettingsView.as_view(), name="user-settings"),
# Overview
path("", overview.OverviewView.as_view(), name="overview"),
+ # Impersonation
+ path(
+ "-/impersonation/
/",
+ impersonate.ImpersonateInitView.as_view(),
+ name="impersonate-init",
+ ),
+ path(
+ "-/impersonation/end/",
+ impersonate.ImpersonateEndView.as_view(),
+ name="impersonate-end",
+ ),
]
diff --git a/passbook/core/views/impersonate.py b/passbook/core/views/impersonate.py
new file mode 100644
index 000000000..009c74d2a
--- /dev/null
+++ b/passbook/core/views/impersonate.py
@@ -0,0 +1,55 @@
+"""passbook impersonation views"""
+
+from django.http import HttpRequest, HttpResponse
+from django.shortcuts import get_object_or_404, redirect
+from django.views import View
+from structlog import get_logger
+
+from passbook.core.middleware import (
+ SESSION_IMPERSONATE_ORIGINAL_USER,
+ SESSION_IMPERSONATE_USER,
+)
+from passbook.core.models import User
+
+LOGGER = get_logger()
+
+
+class ImpersonateInitView(View):
+ """Initiate Impersonation"""
+
+ def get(self, request: HttpRequest, user_id: int) -> HttpResponse:
+ """Impersonation handler, checks permissions"""
+ if not request.user.has_perm("impersonate"):
+ LOGGER.debug(
+ "User attempted to impersonate without permissions", user=request.user
+ )
+ return HttpResponse("Unauthorized", status=401)
+
+ user_to_be = get_object_or_404(User, pk=user_id)
+
+ request.session[SESSION_IMPERSONATE_ORIGINAL_USER] = request.user
+ request.session[SESSION_IMPERSONATE_USER] = user_to_be
+
+ # TODO Audit log entry
+
+ return redirect("passbook_core:overview")
+
+
+class ImpersonateEndView(View):
+ """End User impersonation"""
+
+ def get(self, request: HttpRequest) -> HttpResponse:
+ """End Impersonation handler"""
+ if (
+ SESSION_IMPERSONATE_USER not in request.session
+ or SESSION_IMPERSONATE_ORIGINAL_USER not in request.session
+ ):
+ LOGGER.debug("Can't end impersonation", user=request.user)
+ return redirect("passbook_core:overview")
+
+ del request.session[SESSION_IMPERSONATE_USER]
+ del request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
+
+ # TODO: Audit log entry
+
+ return redirect("passbook_core:overview")
diff --git a/passbook/root/settings.py b/passbook/root/settings.py
index 928eb0f62..fa48db253 100644
--- a/passbook/root/settings.py
+++ b/passbook/root/settings.py
@@ -179,6 +179,7 @@ MIDDLEWARE = [
"django.middleware.csrf.CsrfViewMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
"django.middleware.clickjacking.XFrameOptionsMiddleware",
+ "passbook.core.middleware.ImpersonateMiddleware",
"django_prometheus.middleware.PrometheusAfterMiddleware",
]