Laravel Impersonate
Laravel Impersonate makes it easy to authenticate as your users. Add a simple trait to your user model and impersonate as one of your users in one click.
- Requirements
- Installation
- Simple usage
- Advanced Usage
- Configuration
- Blade
- Tests
- Contributors
- Why Not Just Use loginAsId()?
Requirements
- Laravel 6.x, 7.x or 8.x
- PHP >= 7.2 or 8.0
Laravel support
| Version | Release |
|---|---|
| 6.x to 8.x | 1.7 |
| 6.x, 7.x | 1.6 |
| 5.8 | 1.5 |
| 5.7, 5.6 | 1.2 |
| 5.5, 5.4 | 1.1 |
Installation
- Require it with Composer:
composer require lab404/laravel-impersonate
- Add the service provider at the end of your
config/app.php:
'providers' => [
// ...
Lab404\Impersonate\ImpersonateServiceProvider::class,
],
- Add the trait
Lab404\Impersonate\Models\Impersonateto your User model.
Simple usage
Impersonate a user:
Auth::user()->impersonate($other_user);
// You're now logged as the $other_user
Leave impersonation:
Auth::user()->leaveImpersonation();
// You're now logged as your original user.
Using the built-in controller
In your routes file, under web middleware, you must call the impersonate route macro.
Route::impersonate();
Alternatively, you can execute this macro with your RouteServiceProvider.
namespace App\Providers;
class RouteServiceProvider extends ServiceProvider
{
public function map() {
Route::middleware('web')->group(function (Router $router) {
$router->impersonate();
});
}
}
// Where $id is the ID of the user you want impersonate
route('impersonate', $id)
// Or in case of multi guards, you should also add `guardName` (defaults to `web`)
route('impersonate', ['id' => $id, 'guardName' => 'admin'])
// Generate an URL to leave current impersonation
route('impersonate.leave')
Advanced Usage
Defining impersonation authorization
By default all users can impersonate an user.
You need to add the method canImpersonate() to your user model:
/**
* @return bool
*/
public function canImpersonate()
{
// For example
return $this->is_admin == 1;
}
By default all users can be impersonated.
You need to add the method canBeImpersonated() to your user model to extend this behavior:
/**
* @return bool
*/
public function canBeImpersonated()
{
// For example
return $this->can_be_impersonated == 1;
}
Using your own strategy
- Getting the manager:
// With the app helper
app('impersonate')
// Dependency Injection
public function impersonate(ImpersonateManager $manager, $user_id) { /* ... */ }
- Working with the manager:
$manager = app('impersonate');
// Find an user by its ID
$manager->findUserById($id);
// TRUE if your are impersonating an user.
$manager->isImpersonating();
// Impersonate an user. Pass the original user and the user you want to impersonate
$manager->take($from, $to);
// Leave current impersonation
$manager->leave();
// Get the impersonator ID
$manager->getImpersonatorId();
Middleware
Protect From Impersonation
You can use the middleware impersonate.protect to protect your routes against user impersonation.
This middleware can be useful when you want to protect specific pages like users subscriptions, users credit cards, ...
Router::get('/my-credit-card', function() {
echo "Can't be accessed by an impersonator";
})->middleware('impersonate.protect');
Events
There are two events available that can be used to improve your workflow:
TakeImpersonationis fired when an impersonation is taken.LeaveImpersonationis fired when an impersonation is leaved.
Each events returns two properties $event->impersonator and $event->impersonated containing User model instance.
Configuration
The package comes with a configuration file.
Publish it with the following command:
php artisan vendor:publish --tag=impersonate
Available options:
// The session key used to store the original user id.
'session_key' => 'impersonated_by',
// Where to redirect after taking an impersonation.
// Only used in the built-in controller.
// You can use: an URI, the keyword back (to redirect back) or a route name
'take_redirect_to' => '/',
// Where to redirect after leaving an impersonation.
// Only used in the built-in controller.
// You can use: an URI, the keyword back (to redirect back) or a route name
'leave_redirect_to' => '/'
Blade
There are three Blade directives available.
When the user can impersonate
@canImpersonate($guard = null)
<a href="{{ route('impersonate', $user->id) }}">Impersonate this user</a>
@endCanImpersonate
When the user can be impersonated
This comes in handy when you have a user list and want to show an "Impersonate" button next to all the users. But you don't want that button next to the current authenticated user neither to that users which should not be able to impersonated according your implementation of canBeImpersonated() .
@canBeImpersonated($user, $guard = null)
<a href="{{ route('impersonate', $user->id) }}">Impersonate this user</a>
@endCanBeImpersonated
When the user is impersonated
@impersonating($guard = null)
<a href="{{ route('impersonate.leave') }}">Leave impersonation</a>
@endImpersonating
Tests
vendor/bin/phpunit
Contributors
- This package was created by MarceauKa and tghpow. Many thanks to all of our contributors.
Rationale
Why not just use loginAsId()?
This package adds broader functionality, including Blade directives to allow you to override analytics and other tracking events when impersonating, fire events based on impersonation status, and more. Brief discussion at issues/5
Licence
MIT
509 Dec 30, 2022
393 Nov 28, 2022
268 Dec 27, 2022
74 May 1, 2022
220 Dec 25, 2022
59 Sep 25, 2022
11 Dec 14, 2022
9 Sep 17, 2022
3 Jul 27, 2022
152 Dec 15, 2022
9 Dec 14, 2022
40 Jan 3, 2023
197 Dec 9, 2022
87 Nov 26, 2022
27 Mar 2, 2022
877 Dec 30, 2022
48 Dec 29, 2022
25 Dec 22, 2022
888 Dec 31, 2022