snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/graphql/suites/impersonation/workspace-level/__snapshots__/failing-workspace-impersonation.integration-spec.ts.snap

@@ -0,0 +1,25 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Workspace-level impersonation - authorization denials (integration) rejects a non-admin with the impersonate permission impersonating an admin 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "FORBIDDEN_EXCEPTION",
+    "userFriendlyMessage": "Only administrators can impersonate users with admin privileges.",
+  },
+  "message": "Cannot impersonate a user with admin privileges. Only administrators can impersonate other administrators.",
+  "name": "ForbiddenError",
+}
+`;
+
+exports[`Workspace-level impersonation - authorization denials (integration) rejects a user without the impersonate permission 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "PERMISSION_DENIED",
+    "userFriendlyMessage": "User does not have permission.",
+  },
+  "message": "Entity performing the request does not have permission",
+  "name": "ForbiddenError",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/impersonation/workspace-level/failing-workspace-impersonation.integration-spec.ts

@@ -0,0 +1,44 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { getAccessTokenForCredentials } from 'test/integration/graphql/utils/get-access-token-for-credentials.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+import { signUpInWorkspaceAndGetAccessToken } from 'test/integration/graphql/utils/sign-up-in-workspace-and-get-access-token.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+describe('Workspace-level impersonation - authorization denials (integration)', () => {
+  it('rejects a user without the impersonate permission', async () => {
+    const memberWithoutPermissionAccessToken =
+      await signUpInWorkspaceAndGetAccessToken(
+        'impersonation-no-permission@apple.dev',
+      );
+
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.JONY,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+      accessToken: memberWithoutPermissionAccessToken,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+
+  // Scott is a seeded non-admin Apple member (canImpersonate /
+  // canAccessFullAdminPanel both false) whose role grants only the IMPERSONATE
+  // permission flag. He passes the impersonate permission guard but must still
+  // be blocked from impersonating an admin (Jony) by the escalation check.
+  it('rejects a non-admin with the impersonate permission impersonating an admin', async () => {
+    const scottAccessToken = await getAccessTokenForCredentials({
+      email: 'scott.forstall@apple.dev',
+    });
+
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.JONY,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+      accessToken: scottAccessToken,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/workspace-level/successful-workspace-impersonation.integration-spec.ts

@@ -0,0 +1,57 @@
+import { getAuthTokensFromLoginToken } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.util';
+import { getCurrentUser } from 'test/integration/graphql/utils/get-current-user.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+// Jane holds the Apple admin role (so she has the IMPERSONATE workspace
+// permission). Scott is a non-admin Apple member (canImpersonate /
+// canAccessFullAdminPanel both false), so this exercises the member-only
+// workspace impersonation path: an admin impersonating a regular member, with
+// the admin-target escalation guard correctly not triggering.
+const IMPERSONATOR_ACCESS_TOKEN = APPLE_JANE_ADMIN_ACCESS_TOKEN;
+
+describe('Workspace-level impersonation - successful flow (integration)', () => {
+  it('lets a workspace admin impersonate a member and obtain a usable access token', async () => {
+    const { data: impersonateData, errors: impersonateErrors } =
+      await impersonate({
+        userId: USER_DATA_SEED_IDS.SCOTT,
+        workspaceId: SEED_APPLE_WORKSPACE_ID,
+        accessToken: IMPERSONATOR_ACCESS_TOKEN,
+        expectToFail: false,
+      });
+
+    expect(impersonateErrors).toBeUndefined();
+
+    const loginToken = impersonateData.impersonate.loginToken.token;
+    const origin = impersonateData.impersonate.workspace.workspaceUrls
+      .subdomainUrl as string;
+
+    expect(loginToken).toBeDefined();
+
+    const { data: tokensData, errors: tokensErrors } =
+      await getAuthTokensFromLoginToken({
+        loginToken,
+        origin,
+        expectToFail: false,
+      });
+
+    expect(tokensErrors).toBeUndefined();
+
+    const impersonationAccessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+
+    expect(impersonationAccessToken).toBeDefined();
+
+    const { data: currentUserData, errors: currentUserErrors } =
+      await getCurrentUser({
+        accessToken: impersonationAccessToken,
+        expectToFail: false,
+      });
+
+    expect(currentUserErrors).toBeUndefined();
+    expect(currentUserData.currentUser.id).toBe(USER_DATA_SEED_IDS.SCOTT);
+  });
+});