Filament Account Switcher

Switch between accounts in a Filament panel without signing out — safely, in production.

Features

Linked accounts — work from a low-privilege account day to day and switch to your full admin account only when you need it. Switching up asks for that account's password; switching down is one click.
Impersonation — an ImpersonateAction for your user resource, a persistent banner with a Switch back button, and authorization hooks on your model.
Developer logins — one-click sign-in buttons on the login page for the accounts you seed locally, never rendered outside the environments you allow.
Audit trail — every switch is recorded (who, to whom, why, panel, IP, user agent) and fires AccountSwitching / AccountSwitched events.
Fluent plugin API — enable each feature per panel, add your own authorization rules, move the banner, replace the Linked accounts page.
Dark mode ready and translatable — built from Filament components, with every string in a language file.

Formerly xlite-dev/filament-impersonate — see the upgrade guide.

Compatibility

Plugin	Filament	Laravel	PHP
4.x	4.x, 5.x	12.x, 13.x	8.2+
3.x (`xlite-dev/filament-impersonate`)	4.x, 5.x	9.x – 12.x	8.1+

Installation

composer require packstub/filament-account-switcher
php artisan packstub-account-switcher:install

Add the trait to your user model and the plugin to your panel:

use Packstub\AccountSwitcher\Concerns\HasLinkedAccounts;

class User extends Authenticatable implements FilamentUser
{
    use HasLinkedAccounts;

    public function canImpersonate(User $target): bool
    {
        return $this->hasRole('super-admin');
    }
}

use Packstub\AccountSwitcher\AccountSwitcherPlugin;

$panel->plugin(
    AccountSwitcherPlugin::make()
        ->developerLogins(['[email protected]', '[email protected]']),
);

Full walkthrough: Installation.

Linked accounts

Link the accounts one person owns. A Switch to menu next to the user menu lists them with their label and e-mail.

Switching down to a lower-privilege account is one click. Switching up asks for the target account's password, so a compromised daily session can never reach the admin account on its own.

Switching up to the admin account asks for its password

The Linked accounts page (in the user menu) links an existing account, creates a sub-account, renames links and sets the per-link password rule.

The Linked accounts page

// Or link programmatically — one click down, password up
$admin->linkAccount($daily, label: 'Daily', requiresPassword: false);

Read more: Linked accounts · Security model.

Impersonation

Drop ImpersonateAction into your users table or a page header. It is hidden for records the current user may not impersonate, based on canImpersonate() / canBeImpersonated() on your model.

use Packstub\AccountSwitcher\Filament\Actions\ImpersonateAction;

->recordActions([
    ImpersonateAction::make(),
])

The Impersonate action on each row of the users table

While impersonating, a banner stays visible on every page with a Switch back button.

Developer logins

One-click sign-in for the accounts you seed, shown under the login form. They only render in the environments listed in the config (local by default), whatever the panel says.

AccountSwitcherPlugin::make()
    ->developerLogins(['[email protected]', '[email protected]'])

Developer login buttons under the login form

Configuration

AccountSwitcherPlugin::make()
    ->impersonation()                                  // on by default
    ->linkedAccounts()                                 // on by default
    ->developerLogins(['[email protected]'])           // off by default
    ->canImpersonateUsing(fn (User $by, User $target) => $by->can('impersonate', $target))
    ->canSwitchUsing(fn (User $from, User $to) => ! $to->is_locked)
    ->banner(position: 'top', style: 'light')
    ->redirectTo('/admin')

Read more: Configuration — the config file, events, the switch log and the AccountSwitcher facade.

Documentation

The same pages live in the docs/ directory of this repository.

Testing

composer test

Changelog

See the changelog.

Security vulnerabilities

Please e-mail [email protected] rather than opening a public issue.

Credits

License

MIT. See the license file.

Filament Impersonate Laravel Package