fix(webapp): scope impersonation to id-matched customers and enforce session controls

Author: isshaddad

apps/webapp/app/routes/api.v1.plain.customer-cards.ts

@@ -121,11 +121,22 @@ export async function action({ request }: ActionFunctionArgs) {
 
     const user = where ? await prisma.user.findFirst({ where, include: userInclude }) : null;
 
+    /**
+     * Impersonation is offered only when the customer was matched on `externalId` — a value we set
+     * ourselves from `User.id`.
+     *
+     * Matching on email is a weaker claim: the address on a Plain customer isn't verified, and for
+     * customers created outside our own writes it comes from whoever sent the message. Offering a
+     * one-click impersonation link off the back of that would let an unverified address stand in
+     * for an account, so email-matched customers get the account rows without it.
+     */
+    const canImpersonate = !!customer.externalId;
+
     // No matching user: still answer every requested key, with no data so Plain hides the cards.
     if (!user) {
+      // Presence flags only — the identifiers themselves don't need to persist in log storage.
       logger.info("User not found for Plain customer card request", {
-        customerId: customer.id,
-        externalId: customer.externalId,
+        hasExternalId: !!customer.externalId,
         hasEmail: !!customer.email,
       });
       return json({ cards: answerAllCardKeys(cardKeys, []) });
@@ -138,10 +149,21 @@ export async function action({ request }: ActionFunctionArgs) {
     for (const cardKey of cardKeys) {
       switch (cardKey) {
         case accountDetailsKey: {
-          // Generate a signed one-time token for impersonation
-          const impersonationToken = await generateImpersonationToken(user.id);
-          // Build the impersonate URL with token for CSRF protection
-          const impersonateUrl = `${env.APP_ORIGIN}/admin/impersonate?impersonate=${user.id}&impersonationToken=${encodeURIComponent(impersonationToken)}`;
+          // Only mint a token when the button will actually be rendered — see `canImpersonate`.
+          const impersonationComponents = canImpersonate
+            ? [
+                uiComponent.spacer({ size: "M" }),
+                uiComponent.divider({ spacingSize: "M" }),
+                uiComponent.spacer({ size: "M" }),
+                uiComponent.linkButton({
+                  label: "Impersonate User",
+                  // The one-time token is what protects this link against CSRF.
+                  url: `${env.APP_ORIGIN}/admin/impersonate?impersonate=${user.id}&impersonationToken=${encodeURIComponent(
+                    await generateImpersonationToken(user.id)
+                  )}`,
+                }),
+              ]
+            : [];
 
           cards.push({
             key: accountDetailsKey,
@@ -221,13 +243,7 @@ export async function action({ request }: ActionFunctionArgs) {
                       }),
                     ],
                   }),
-                  uiComponent.spacer({ size: "M" }),
-                  uiComponent.divider({ spacingSize: "M" }),
-                  uiComponent.spacer({ size: "M" }),
-                  uiComponent.linkButton({
-                    label: "Impersonate User",
-                    url: impersonateUrl,
-                  }),
+                  ...impersonationComponents,
                 ],
               }),
             ],

apps/webapp/app/services/session.server.ts

@@ -141,14 +141,26 @@ export async function getRealUser(
   prismaClient: PrismaClientOrTransaction = prisma
 ) {
   const authUser = await authenticator.isAuthenticated(request);
+
+  // Apply the same session controls `getUserId`/`getUser` apply to the real user, so this helper
+  // can't become a way around them: a session the IdP has revoked throws to /logout here, and one
+  // past its effective duration is caught below. Skipping either would let an admin whose session
+  // should have ended still start impersonation.
+  await revalidateSsoSession(request, authUser);
   if (!authUser?.userId) return null;
 
-  // Narrow select: callers only ever need the id and the admin flag. Takes a client so a caller
-  // already scoped to one reads the admin from the same database it writes to.
-  return prismaClient.user.findFirst({
+  // Narrow select — callers need the id and the admin flag, plus `nextSessionEnd` for the deadline
+  // check. Takes a client so a caller already scoped to one reads the admin from the same database
+  // it writes to.
+  const user = await prismaClient.user.findFirst({
     where: { id: authUser.userId },
-    select: { id: true, admin: true },
+    select: { id: true, admin: true, nextSessionEnd: true },
   });
+  if (!user) return null;
+
+  maybeAutoLogout(request, user);
+
+  return user;
 }
 
 export type UserFromSession = Awaited<ReturnType<typeof requireUser>>;

apps/webapp/app/utils/plainCustomerCards.ts

@@ -49,9 +49,11 @@ export function answerAllCardKeys<TCard extends { key: string }>(
     ...cards,
     ...cardKeys
       .filter((key) => !answered.has(key))
-      .map((key): NoDataCard => ({
-        key,
-        components: null,
-      })),
+      .map(
+        (key): NoDataCard => ({
+          key,
+          components: null,
+        })
+      ),
   ];
 }