From cc6dd377ec900c7625c4ac0a0522339c0d162835 Mon Sep 17 00:00:00 2001
From: Edoardo Spadoni <edoardo.spadoni@nethesis.it>
Date: Wed, 14 Oct 2026 17:16:51 +0200
Subject: [PATCH 1/2] fix(frontend): no forbidden page on impersonation 403

Consent, sessions and audit queries stay idle while impersonating and
a 403 with reason impersonation_active no longer redirects.
---
 .../impersonation/ImpersonationPanel.vue      | 154 +++++++++---------
 frontend/src/i18n/en/translation.json         |   2 +
 frontend/src/i18n/it/translation.json         |   2 +
 frontend/src/lib/axios.ts                     |   4 +-
 frontend/src/queries/impersonationConsent.ts  |   2 +-
 .../src/queries/impersonationSessionAudit.ts  |   5 +-
 frontend/src/queries/impersonationSessions.ts |   2 +-
 7 files changed, 94 insertions(+), 77 deletions(-)

diff --git a/frontend/src/components/account/impersonation/ImpersonationPanel.vue b/frontend/src/components/account/impersonation/ImpersonationPanel.vue
index ca1689d3c..be5670984 100644
--- a/frontend/src/components/account/impersonation/ImpersonationPanel.vue
+++ b/frontend/src/components/account/impersonation/ImpersonationPanel.vue
@@ -94,90 +94,98 @@ async function disableConsent() {
           )
         "
       />
-      <NeSkeleton
-        v-if="state.status === 'pending' || asyncStatus === 'loading'"
-        :lines="3"
-        class="max-w-2xl"
-      />
-      <!-- get consent error notification -->
-      <NeInlineNotification
-        v-else-if="state.status === 'error'"
-        kind="error"
-        :title="$t('account.impersonation.cannot_retrieve_impersonation_consent')"
-        :description="state.error.message"
-      />
-      <template v-else>
-        <!-- delete consent error notification -->
+      <template v-if="!loginStore.isImpersonating">
+        <NeSkeleton
+          v-if="state.status === 'pending' || asyncStatus === 'loading'"
+          :lines="3"
+          class="max-w-2xl"
+        />
+        <!-- get consent error notification -->
         <NeInlineNotification
-          v-if="deleteConsentError?.message"
+          v-else-if="state.status === 'error'"
           kind="error"
-          :title="t('account.impersonation.cannot_disable_impersonation_consent')"
-          :description="deleteConsentError.message"
+          :title="$t('account.impersonation.cannot_retrieve_impersonation_consent')"
+          :description="state.error.message"
         />
-        <template v-if="state.data.consent">
-          <!-- consent is enabled -->
-          <div class="flex flex-col items-start gap-6">
-            <div class="flex items-center gap-2">
-              <FontAwesomeIcon
-                :icon="faCircleCheck"
-                class="text-icon-enabled size-4"
-                aria-hidden="true"
-              />
-              <span>
-                {{
-                  t('account.impersonation.impersonation_consent_is_enabled_until_time', {
-                    time: consentExpirationDate,
-                  })
-                }}
-              </span>
-            </div>
-            <!-- revoke consent button -->
-            <NeButton
-              kind="tertiary"
-              size="lg"
-              :disabled="
-                deleteConsentLoading || loginStore.isOwnerAccount || loginStore.isImpersonating
-              "
-              :loading="deleteConsentLoading"
-              @click.prevent="disableConsent"
-              class="-ml-2.5"
-            >
-              {{ $t('account.impersonation.revoke_impersonation_consent') }}
-            </NeButton>
-          </div>
-        </template>
         <template v-else>
-          <!-- consent is disabled -->
-          <div class="flex flex-col items-start gap-6">
-            <div class="flex items-center gap-2">
-              <FontAwesomeIcon
-                :icon="faCircleInfo"
-                class="size-4 text-indigo-500 dark:text-indigo-300"
-                aria-hidden="true"
-              />
-              <span>
-                {{ t('account.impersonation.impersonation_consent_is_disabled') }}
-              </span>
+          <!-- delete consent error notification -->
+          <NeInlineNotification
+            v-if="deleteConsentError?.message"
+            kind="error"
+            :title="t('account.impersonation.cannot_disable_impersonation_consent')"
+            :description="deleteConsentError.message"
+          />
+          <template v-if="state.data.consent">
+            <!-- consent is enabled -->
+            <div class="flex flex-col items-start gap-6">
+              <div class="flex items-center gap-2">
+                <FontAwesomeIcon
+                  :icon="faCircleCheck"
+                  class="text-icon-enabled size-4"
+                  aria-hidden="true"
+                />
+                <span>
+                  {{
+                    t('account.impersonation.impersonation_consent_is_enabled_until_time', {
+                      time: consentExpirationDate,
+                    })
+                  }}
+                </span>
+              </div>
+              <!-- revoke consent button -->
+              <NeButton
+                kind="tertiary"
+                size="lg"
+                :disabled="
+                  deleteConsentLoading || loginStore.isOwnerAccount || loginStore.isImpersonating
+                "
+                :loading="deleteConsentLoading"
+                @click.prevent="disableConsent"
+                class="-ml-2.5"
+              >
+                {{ $t('account.impersonation.revoke_impersonation_consent') }}
+              </NeButton>
             </div>
-            <!-- enable consent button -->
-            <NeButton
-              kind="secondary"
-              size="lg"
-              :disabled="
-                deleteConsentLoading || loginStore.isOwnerAccount || loginStore.isImpersonating
-              "
-              @click.prevent="isShownEnableConsentModal = true"
-            >
-              {{ $t('account.impersonation.consent_to_impersonation') }}
-            </NeButton>
-          </div>
+          </template>
+          <template v-else>
+            <!-- consent is disabled -->
+            <div class="flex flex-col items-start gap-6">
+              <div class="flex items-center gap-2">
+                <FontAwesomeIcon
+                  :icon="faCircleInfo"
+                  class="size-4 text-indigo-500 dark:text-indigo-300"
+                  aria-hidden="true"
+                />
+                <span>
+                  {{ t('account.impersonation.impersonation_consent_is_disabled') }}
+                </span>
+              </div>
+              <!-- enable consent button -->
+              <NeButton
+                kind="secondary"
+                size="lg"
+                :disabled="
+                  deleteConsentLoading || loginStore.isOwnerAccount || loginStore.isImpersonating
+                "
+                @click.prevent="isShownEnableConsentModal = true"
+              >
+                {{ $t('account.impersonation.consent_to_impersonation') }}
+              </NeButton>
+            </div>
+          </template>
         </template>
       </template>
     </div>
     <NeHeading tag="h4" class="mt-10 mb-5">
       {{ $t('account.impersonation.sessions') }}
     </NeHeading>
-    <SessionsTable />
+    <NeInlineNotification
+      v-if="loginStore.isImpersonating"
+      kind="info"
+      :title="$t('account.impersonation.sessions_not_available')"
+      :description="$t('account.impersonation.sessions_not_available_impersonating_description')"
+    />
+    <SessionsTable v-else />
     <EnableImpersonationConsentModal
       :visible="isShownEnableConsentModal"
       @close="isShownEnableConsentModal = false"
diff --git a/frontend/src/i18n/en/translation.json b/frontend/src/i18n/en/translation.json
index 3ce8b8763..9a4080377 100644
--- a/frontend/src/i18n/en/translation.json
+++ b/frontend/src/i18n/en/translation.json
@@ -626,6 +626,8 @@
       "sessions": "Sessions",
       "sessions_description": "Overview of all sessions during which you were impersonated by a user with the Nethesis staff roles (Staff, Owner).",
       "cannot_retrieve_impersonation_sessions": "Cannot retrieve impersonation sessions",
+      "sessions_not_available": "Sessions not available",
+      "sessions_not_available_impersonating_description": "Impersonation sessions are not available while impersonating another user.",
       "session_start": "Start",
       "session_end": "End",
       "duration": "Duration",
diff --git a/frontend/src/i18n/it/translation.json b/frontend/src/i18n/it/translation.json
index 1c7826faf..761e56847 100644
--- a/frontend/src/i18n/it/translation.json
+++ b/frontend/src/i18n/it/translation.json
@@ -544,6 +544,8 @@
       "sessions": "Sessioni",
       "sessions_description": "Elenco delle sessioni durante le quali sei stato impersonato da un utente con i ruoli dello staff Nethesis (Staff, Owner).",
       "cannot_retrieve_impersonation_sessions": "Impossibile recuperare le sessioni di impersonificazione",
+      "sessions_not_available": "Sessioni non disponibili",
+      "sessions_not_available_impersonating_description": "Le sessioni di impersonificazione non sono disponibili mentre impersoni un altro utente.",
       "session_start": "Inizio",
       "session_end": "Fine",
       "duration": "Durata",
diff --git a/frontend/src/lib/axios.ts b/frontend/src/lib/axios.ts
index 64d4d4cc5..700b1d1f4 100644
--- a/frontend/src/lib/axios.ts
+++ b/frontend/src/lib/axios.ts
@@ -127,7 +127,9 @@ export const configureAxios = () => {
         console.warn('[interceptor]', 'Unrecoverable 401, re-authenticating')
         loginStore.forceReauth()
       } else if (error.response?.status == 403) {
-        router.push({ name: 'forbidden' })
+        if (error.response?.data?.data?.reason !== 'impersonation_active') {
+          router.push({ name: 'forbidden' })
+        }
       } else if (!isValidationErrorCode(error.response?.data?.code)) {
         // show error notification if it's not a validation error
         notificationsStore.createNotificationFromAxiosError(error)
diff --git a/frontend/src/queries/impersonationConsent.ts b/frontend/src/queries/impersonationConsent.ts
index 491cb8af3..46537d334 100644
--- a/frontend/src/queries/impersonationConsent.ts
+++ b/frontend/src/queries/impersonationConsent.ts
@@ -11,7 +11,7 @@ export const useImpersonationConsent = defineQuery(() => {
 
   const { state, asyncStatus, ...rest } = useQuery({
     key: () => [IMPERSONATION_CONSENT_KEY],
-    enabled: () => !!loginStore.jwtToken,
+    enabled: () => !!loginStore.jwtToken && !loginStore.isImpersonating,
     query: () => getConsent(),
   })
 
diff --git a/frontend/src/queries/impersonationSessionAudit.ts b/frontend/src/queries/impersonationSessionAudit.ts
index 6c7c5cf11..3b8857eb3 100644
--- a/frontend/src/queries/impersonationSessionAudit.ts
+++ b/frontend/src/queries/impersonationSessionAudit.ts
@@ -30,7 +30,10 @@ export const useImpersonationSessionAudit = defineQuery(() => {
         pageSize: pageSize.value,
       },
     ],
-    enabled: () => !!loginStore.jwtToken && !!sessionAuditStore.session?.session_id,
+    enabled: () =>
+      !!loginStore.jwtToken &&
+      !loginStore.isImpersonating &&
+      !!sessionAuditStore.session?.session_id,
     query: () =>
       getSessionAudit(sessionAuditStore.session?.session_id || '', pageNum.value, pageSize.value),
   })
diff --git a/frontend/src/queries/impersonationSessions.ts b/frontend/src/queries/impersonationSessions.ts
index 9d61e0a70..58407dfda 100644
--- a/frontend/src/queries/impersonationSessions.ts
+++ b/frontend/src/queries/impersonationSessions.ts
@@ -20,7 +20,7 @@ export const useImpersonationSessions = defineQuery(() => {
         pageSize: pageSize.value,
       },
     ],
-    enabled: () => !!loginStore.jwtToken,
+    enabled: () => !!loginStore.jwtToken && !loginStore.isImpersonating,
     query: () => getSessions(pageNum.value, pageSize.value),
   })
 

From 325588f68b96126872b42c9244b23fe085cc7606 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:18:47 +0000
Subject: [PATCH 2/2] chore: update build triggers for PR deployment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Auto-updated .render-build-trigger files to ensure all services
are deployed in PR preview environments.

🤖 Generated by GitHub Actions
---
 backend/.render-build-trigger        | 4 ++--
 collect/.render-build-trigger        | 4 ++--
 frontend/.render-build-trigger       | 4 ++--
 proxy/.render-build-trigger          | 4 ++--
 services/mimir/.render-build-trigger | 2 +-
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/backend/.render-build-trigger b/backend/.render-build-trigger
index 720b86f1a..553625f7e 100644
--- a/backend/.render-build-trigger
+++ b/backend/.render-build-trigger
@@ -2,9 +2,9 @@
 # This file is used to force Docker service rebuilds in PR previews
 # Modify LAST_UPDATE to trigger rebuilds
 
-LAST_UPDATE=2026-09-30T12:43:29Z
+LAST_UPDATE=2026-10-14T15:18:46Z
 
 # Instructions:
 # 1. To force rebuild of Docker services in a PR, update LAST_UPDATE
-# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-09-30T12:43:29Z
+# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-10-14T15:18:46Z
 # 2. Commit and push changes to trigger Docker rebuilds
diff --git a/collect/.render-build-trigger b/collect/.render-build-trigger
index 720b86f1a..553625f7e 100644
--- a/collect/.render-build-trigger
+++ b/collect/.render-build-trigger
@@ -2,9 +2,9 @@
 # This file is used to force Docker service rebuilds in PR previews
 # Modify LAST_UPDATE to trigger rebuilds
 
-LAST_UPDATE=2026-09-30T12:43:29Z
+LAST_UPDATE=2026-10-14T15:18:46Z
 
 # Instructions:
 # 1. To force rebuild of Docker services in a PR, update LAST_UPDATE
-# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-09-30T12:43:29Z
+# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-10-14T15:18:46Z
 # 2. Commit and push changes to trigger Docker rebuilds
diff --git a/frontend/.render-build-trigger b/frontend/.render-build-trigger
index 720b86f1a..553625f7e 100644
--- a/frontend/.render-build-trigger
+++ b/frontend/.render-build-trigger
@@ -2,9 +2,9 @@
 # This file is used to force Docker service rebuilds in PR previews
 # Modify LAST_UPDATE to trigger rebuilds
 
-LAST_UPDATE=2026-09-30T12:43:29Z
+LAST_UPDATE=2026-10-14T15:18:46Z
 
 # Instructions:
 # 1. To force rebuild of Docker services in a PR, update LAST_UPDATE
-# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-09-30T12:43:29Z
+# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-10-14T15:18:46Z
 # 2. Commit and push changes to trigger Docker rebuilds
diff --git a/proxy/.render-build-trigger b/proxy/.render-build-trigger
index 720b86f1a..553625f7e 100644
--- a/proxy/.render-build-trigger
+++ b/proxy/.render-build-trigger
@@ -2,9 +2,9 @@
 # This file is used to force Docker service rebuilds in PR previews
 # Modify LAST_UPDATE to trigger rebuilds
 
-LAST_UPDATE=2026-09-30T12:43:29Z
+LAST_UPDATE=2026-10-14T15:18:46Z
 
 # Instructions:
 # 1. To force rebuild of Docker services in a PR, update LAST_UPDATE
-# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-09-30T12:43:29Z
+# 2. Run: perl -i -pe "s/LAST_UPDATE=2026-10-14T15:18:46Z
 # 2. Commit and push changes to trigger Docker rebuilds
diff --git a/services/mimir/.render-build-trigger b/services/mimir/.render-build-trigger
index 116dfb459..a60fa2678 100644
--- a/services/mimir/.render-build-trigger
+++ b/services/mimir/.render-build-trigger
@@ -2,7 +2,7 @@
 # This file is used to force Docker service rebuilds in PR previews
 # Modify LAST_UPDATE to trigger rebuilds
 
-LAST_UPDATE=2026-09-30T12:43:29Z
+LAST_UPDATE=2026-10-14T15:18:46Z
 
 # Instructions:
 # 1. To force rebuild of Docker services in a PR, update LAST_UPDATE