- How do I install kabbouchi/nova-impersonate in a Laravel Nova app?
- Run composer require kabbouchi/nova-impersonate, then add the impersonate field to the fields() method of the Nova resource that represents your users. On your User model, add the impersonation traits (typically CanImpersonate and CanBeImpersonated from lab404/laravel-impersonate) and implement the authorization methods. Finally configure the redirect and leave behavior so admins return to their own account cleanly. Most teams finish the code integration in hours, not weeks.
- Which Laravel and Nova versions does nova-impersonate support?
- Version 2.2.0 declares Laravel 12 support, which was previously an open compatibility question. The release note speaks only to Laravel and says nothing about which Nova major is validated, so check the declared Nova constraint in composer.json yourself. Laravel 12 deployments realistically pair with Nova 5, and you should not infer Nova 4 support on Laravel 12.
- Does nova-impersonate depend on lab404/laravel-impersonate?
- In practice the field wraps the ecosystem-standard impersonation primitive, lab404/laravel-impersonate, and surfaces it as a button on a Nova resource. Confirm the exact dependency and version constraint in composer.json before adopting it. If the dependency is declared normally, you can pin or upgrade it independently of the Nova field as long as the APIs it uses stay stable.
- How do I control which admins can impersonate which users?
- The authorization seam lives on your User model, not inside the Nova field: implement canImpersonate and canBeImpersonated to express your policy. This is the right architecture, but it also means the guardrail is entirely your code. The field is visible by default, so a permissive or unimplemented policy is a silent bypass and remains the top risk with this package.
- Does nova-impersonate work with multiple guards, Sanctum, or non-default session drivers?
- Impersonation is session-state mutation, so multi-guard admin setups, Sanctum or SPA sessions, non-default session drivers, and custom auth providers all need explicit verification. The failure mode is subtle rather than loud, so test the full enter-and-leave cycle on your actual configuration. Version 2.2.0 introduces no session-handling changes, so any verification work you did previously still applies.
- How does an admin return to their own account after impersonating a user?
- The package provides leave behavior that restores the original admin session, and the return or leave redirect target is configurable. Verify that the redirect target survives session or cache eviction, since impersonation state is session-bound. Test the leave path explicitly on your session driver rather than assuming it works.
- Does nova-impersonate provide audit logs or events for impersonation?
- The package is deliberately small and focused on rendering a button and wiring routes; it does not ship a documented audit pipeline with enter and leave events. If you need compliance-grade records, capture enter and leave yourself via model events, middleware, or logging around the impersonation calls. Without that, impersonation is privileged access into customer accounts with no trail, which is a SOC 2 access-review and GDPR finding waiting to happen.
- Is nova-impersonate safe to use in production?
- It is safe if you treat it as privileged access: implement strict canImpersonate and canBeImpersonated policies, record enter and leave events, mark the session, and set a retention policy. The blast radius is confined to your admin panel, so severity is low, but consequence is high when audit is missing. Authorization gaps are the main risk, not the field's rendering code.
- Is nova-impersonate actively maintained, and what happens when Nova releases a major version?
- It is a 234-star, effectively single-maintainer package with zero observed dependents, and version 2.2.0 arrived as a community pull request rather than maintainer-authored work. Nova is closed-source and moves majors (v4 to v5), so any break lands on a thin vendor chain. Plan for the possibility that you may need to fork the package when compatibility drifts.
- What are alternatives to nova-impersonate, and can I use it outside Nova?
- The obvious alternative is using lab404/laravel-impersonate directly with your own admin UI, which gives you full control over the button, routes, and audit hooks. Other Nova impersonation fields exist, but they share the same architectural property of delegating policy to your User model. The package does not fit if you do not run Nova, if impersonation targets are not Eloquent users, or if you have a bespoke admin surface where a Nova field has nowhere to render.