- How do I enable impersonation for specific admin roles in Laravel?
- Use the provided `ImpersonateMiddleware` in your routes or middleware groups. For example, add `middleware(['auth', 'can:impersonate'])` to restrict access to impersonation routes. The package also includes `@canImpersonate` Blade directives for UI-level checks.
- Does this package work with Laravel Sanctum for API impersonation?
- No, Laravel Impersonate relies on session-based authentication, which isn’t compatible with stateless Sanctum APIs. However, if you’re using Sanctum with sessions (e.g., web + API hybrid apps), the package will work as long as you’re on the same guard.
- Can I track who impersonated which user and when for auditing?
- Yes, the package emits `ImpersonateStarted` and `ImpersonateEnded` events. Extend these events to log details like impersonator ID, target user, timestamp, or IP address to your database or SIEM. Example: `Event::listen(ImpersonateStarted::class, function ($event) { ... });`
- What Laravel versions and PHP versions are supported?
- The package supports Laravel 8 through 13 and PHP 8.0 to 8.4. Check the [release notes](https://github.com/404labfr/laravel-impersonate/releases) for version-specific changes. Older versions may require manual adjustments or forks.
- How do I test impersonation in PHPUnit or Pest?
- Use the `Impersonate` facade to manually trigger impersonation in tests: `$this->impersonate(User::find(1));`. For Blade directives, mock the `Auth` facade or use `Livewire`/`Dusk` to test UI interactions. The package includes test helpers for common scenarios.
- Will this break if my User model doesn’t extend Eloquent?
- Yes, the package assumes Eloquent models with `getAuthIdentifier()`. If you’re using a custom `Authenticatable` model, override the `findUserById` method in your service provider or extend the `UserProvider` to handle non-Eloquent lookups.
- Can I limit impersonation sessions to a time duration?
- The package doesn’t enforce time limits by default, but you can add middleware to auto-end sessions after X minutes. For example, create a `TimeoutImpersonationMiddleware` that checks `now()->gt($user->impersonation_ends_at)` and calls `stopImpersonating()`.
- How do I integrate impersonation into a multi-guard app (e.g., web + api)?
- The package supports multi-guard setups via `Auth::guard('web')->impersonate($user)`. Always specify the guard when calling impersonation methods. For middleware, bind it to the correct guard: `Route::middleware(['web', 'auth', 'can:impersonate'])->group(...);`.
- Are there alternatives to Laravel Impersonate for debugging users?
- Alternatives include `spatie/laravel-activitylog` (for audit logs) or custom middleware to switch users temporarily. However, Laravel Impersonate is the most feature-complete for session-based impersonation with middleware, events, and Blade support. For API-only apps, consider `tymon/jwt-auth` with manual user switching.
- How do I disable impersonation in production if needed?
- Use Laravel’s feature flags (e.g., `config(['impersonate.enabled' => false])`) or wrap impersonation routes in a feature flag middleware. For emergencies, override the `canImpersonate` method in your `AuthServiceProvider` to always return `false`. Always test rollback procedures in staging.