Skip to content

fix(frontend): no forbidden page on impersonation 403 - #232

Merged
edospadoni merged 2 commits into
mainfrom
fix/impersonation-forbidden-page
Oct 14, 2026
Merged

edospadoni merged 2 commits into
mainfrom
fix/impersonation-forbidden-page

Conversation

@edospadoni

Copy link
Copy Markdown
Member

Problem

  • while impersonating, the top bar keeps the impersonation-consent query alive and refetches it on window focus
  • the backend refuses GET /impersonate/consent with 403 impersonation_active (consent belongs to the real account)
  • the axios interceptor turns every 403 into /forbidden: switching tab and back lands on "Pagina riservata"
  • same path from Account › Impersonation (GET /impersonate/sessions) and on a reload during impersonation

Changes

  • queries: consent, sessions and session audit stay idle while impersonating (same guard as apiKeys.ts)
  • axios interceptor: a 403 carrying reason: impersonation_active is left to the caller, no redirect
  • ImpersonationPanel: consent state and sessions table replaced by an info notice while impersonating (2 i18n keys, en + it)

Review focus

  • the interceptor keys on the backend's data.reason: every other 403 still redirects to /forbidden
  • manual check: impersonate, open a system, switch tab and back; reload the page; open Account › Impersonation; exit impersonation and verify the consent badge is back

@edospadoni
edospadoni deployed to fix/impersonation-forbidden-page - my-frontend-qa PR #232 October 14, 2026 15:17 — with Render Active
@github-actions

Copy link
Copy Markdown
Contributor

🔗 Redirect URIs Added to Logto

The following redirect URIs have been automatically added to the Logto application configuration:

Redirect URIs:

  • https://my-proxy-qa-pr-232.onrender.com/login-redirect

Post-logout redirect URIs:

  • https://my-proxy-qa-pr-232.onrender.com/login

These will be automatically removed when the PR is closed or merged.

@edospadoni

Copy link
Copy Markdown
Member Author

update deploy

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Build triggers updated!

All .render-build-trigger files have been automatically updated to ensure fresh deployments of all services in the PR preview environment.

@edospadoni
edospadoni deployed to fix/impersonation-forbidden-page - my-frontend-qa PR #232 October 14, 2026 15:18 — with Render Active
@edospadoni
edospadoni deployed to fix/impersonation-forbidden-page - my-backend-qa PR #232 October 14, 2026 15:18 — with Render Active
@edospadoni
edospadoni deployed to fix/impersonation-forbidden-page - my-collect-qa PR #232 October 14, 2026 15:18 — with Render Active
edospadoni and others added 2 commits October 14, 2026 17:21
Consent, sessions and audit queries stay idle while impersonating and
a 403 with reason impersonation_active no longer redirects.
Auto-updated .render-build-trigger files to ensure all services
are deployed in PR preview environments.

🤖 Generated by GitHub Actions
@edospadoni
edospadoni force-pushed the fix/impersonation-forbidden-page branch from 3d7fdec to 325588f Compare October 14, 2026 15:22
@edospadoni
edospadoni temporarily deployed to fix/impersonation-forbidden-page - my-backend-qa PR #232 October 14, 2026 15:22 — with Render Destroyed
@edospadoni
edospadoni temporarily deployed to fix/impersonation-forbidden-page - my-collect-qa PR #232 October 14, 2026 15:22 — with Render Destroyed
@edospadoni
edospadoni temporarily deployed to fix/impersonation-forbidden-page - my-frontend-qa PR #232 October 14, 2026 15:22 — with Render Destroyed
@edospadoni
edospadoni temporarily deployed to fix/impersonation-forbidden-page - my-proxy-qa PR #232 October 14, 2026 15:22 — with Render Destroyed
@edospadoni
edospadoni requested a review from andre8244 October 14, 2026 15:41
@edospadoni edospadoni added the run-e2e Run the full-stack browser suite on this PR label Oct 14, 2026
@github-actions github-actions Bot removed the run-e2e Run the full-stack browser suite on this PR label Oct 14, 2026
@edospadoni
edospadoni merged commit 141f3d2 into main Oct 14, 2026
18 checks passed
@edospadoni
edospadoni deleted the fix/impersonation-forbidden-page branch October 14, 2026 15:58
@github-actions

Copy link
Copy Markdown
Contributor

🗑️ Redirect URIs Removed from Logto

The following redirect URIs have been automatically removed from the Logto application configuration:

Redirect URIs:

  • https://my-proxy-qa-pr-232.onrender.com/login-redirect

Post-logout redirect URIs:

  • https://my-proxy-qa-pr-232.onrender.com/login

Cleanup completed for PR #232.

This branch was successfully deployed

No deployments
fix/impersonation-forbidden-page - my-proxy-qa PR #232 — 325588f6 Deployed Oct 14, 2026 by edospadoni
fix/impersonation-forbidden-page - my-backend-qa PR #232 — 325588f6 Deployed Oct 14, 2026 by edospadoni
fix/impersonation-forbidden-page - my-collect-qa PR #232 — 325588f6 Deployed Oct 14, 2026 by edospadoni
fix/impersonation-forbidden-page - my-frontend-qa PR #232 — 325588f6 Deployed Oct 14, 2026 by edospadoni
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants