 Server : Apache/2 System : Linux server-15-235-50-60 5.15.0-164-generic #174-Ubuntu SMP Fri Nov 14 20:25:16 UTC 2025 x86_64 User : gositeme ( 1004) PHP Version : 8.2.29 Disable Function : exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname Directory : /home/gositeme/domains/lavocat.ca/public_html/ |
# ๐ Impersonation System Testing Guide ## ๐ฏ **Quick Start Testing** ### 1. **Login as Super Admin** - **URL**: `https://localhost:3443/auth/login` - **Email**: `dannywperez@msn.com` - **Password**: `your_password` ### 2. **Access User Management** - **URL**: `https://localhost:3443/admin/users` - Look for **"๐ Sign In As"** buttons next to each user ### 3. **Test Different User Types** ## ๐ฅ **Available Test Users** | Role | Name | Email | Password | Expected Features | |------|------|-------|----------|-------------------| | ๐ค **USER** | Danny PEREZ | support@gositeme.com | - | Basic dashboard, profile, applications | | ๐ **SECRETARY** | Isabelle Gagnon | legal.secretary@lmep.ca | demo123 | Admin dashboard, case support, documents | | ๐ **CLERK** | Sophie Tremblay | law.clerk@lmep.ca | demo123 | Research tools, document access, case viewing | | โ๏ธ **LAWYER** | Marie Dubois | lead.attorney@lmep.ca | demo123 | Full case access, assignments, analytics | | โ๏ธ **LAWYER** | Jean-Pierre Martin | assistant.lawyer@lmep.ca | demo123 | Case management, client communication | | ๐ฉโโ๏ธ **ADMIN** | Admin User | admin@example.com | - | User management, newsletter, export functions | ## ๐งช **Step-by-Step Testing Process** ### **Step 1: Test USER Role** 1. Click **"๐ Sign In As"** next to Danny PEREZ (USER) 2. **Expected Behavior**: - โ Redirected to `/user/dashboard` - โ Orange impersonation banner appears at top - โ Limited navigation (no admin options) - โ Can access profile, applications - โ Cannot access admin features ### **Step 2: Test SECRETARY Role** 1. Click **"Stop Impersonating"** to return to Super Admin 2. Click **"๐ Sign In As"** next to Isabelle Gagnon (SECRETARY) 3. **Expected Behavior**: - โ Access to admin dashboard - โ Can view case management - โ Document handling capabilities - โ Cannot create new users - โ Limited admin features ### **Step 3: Test CLERK Role** 1. Stop impersonation and try Sophie Tremblay (CLERK) 2. **Expected Behavior**: - โ Research tools access - โ Document viewing - โ Case viewing (read-only) - โ Cannot assign cases - โ No user management ### **Step 4: Test LAWYER Role** 1. Stop impersonation and try Marie Dubois (LAWYER) 2. **Expected Behavior**: - โ Full case access - โ Case assignments dashboard - โ Analytics dashboard - โ Client communication - โ Can view and manage assigned cases - โ Cannot manage users (unless also ADMIN) ### **Step 5: Test ADMIN Role** 1. Stop impersonation and try Admin User (ADMIN) 2. **Expected Behavior**: - โ User management access - โ Newsletter system - โ Export functions (PDF/CSV) - โ All admin features - โ Cannot impersonate others (only SUPERADMIN can) ## ๐ **What to Verify During Each Test** ### **Navigation Access** - Check sidebar menu items - Verify role-appropriate features are visible - Confirm restricted features are hidden ### **Page Access** - Try accessing admin URLs directly - Verify proper redirects for unauthorized access - Check error handling ### **Functional Testing** - Test creating/editing within role permissions - Verify data access is properly scoped - Check API endpoint restrictions ## ๐จ **Security Validation** ### **Critical Security Tests** 1. **Cannot Impersonate SUPERADMIN** - Verify no "Sign In As" button for SUPERADMIN users - API should reject attempts to impersonate SUPERADMIN 2. **Session Logging** - Check database for impersonation session records - Verify IP address and user agent are logged 3. **Proper Session Cleanup** - Ensure stopping impersonation restores original user - Verify no session leakage between users 4. **Rate Limiting** - Try rapid impersonation attempts - Should be rate limited for security ## ๐ฏ **Expected User Experience Flow** ### **Successful Impersonation** 1. ๐ Click "Sign In As" โ Loading state 2. ๐ฏ Redirect to appropriate dashboard 3. ๐ Orange banner shows impersonation status 4. ๐ค Navigation reflects user's role 5. ๐ "Stop Impersonating" button works 6. โ Return to Super Admin dashboard ### **Visual Indicators** - **Impersonation Banner**: Orange gradient at top - **User Info**: Shows current impersonated user - **Original User**: Shows who is impersonating - **Stop Button**: Clear exit option ## ๐ **Quick Test URLs** | Feature | URL | Purpose | |---------|-----|---------| | User Management | `/admin/users` | Main impersonation interface | | Super Admin | `/admin/super` | System overview | | Case Assignments | `/admin/case-assignments` | Test lawyer/admin access | | Analytics | `/admin/analytics-dashboard` | Test advanced features | | Newsletter | `/admin/newsletter` | Test admin-only features | | User Dashboard | `/user/dashboard` | Test basic user experience | ## ๐ **Troubleshooting** ### **Common Issues** 1. **Impersonation Not Working** - Check server logs for JWT callback errors - Verify database has ImpersonationSession table - Ensure user has SUPERADMIN role 2. **Permissions Not Applied** - Verify API endpoints include SUPERADMIN in role checks - Check if permissions were set up correctly - Review role hierarchy in auth-utils.ts 3. **Session Issues** - Clear browser cookies - Restart development server - Check NextAuth configuration ### **Debug Commands** ```bash # Check user roles npm run check-user dannywperez@msn.com # View all users for testing npm run test-impersonation # Check permissions setup npm run setup-permissions ``` ## โ **Success Criteria** **Impersonation system is working correctly when:** - โ Can impersonate all roles except SUPERADMIN - โ Each role sees appropriate features only - โ Security restrictions are enforced - โ Can easily stop impersonation and return - โ Sessions are properly logged and managed - โ No permission leakage between roles --- **๐ Happy Testing!** The impersonation system allows you to experience your application from each user's perspective, ensuring proper role-based access control.