feat: full IAM impersonation support — read-only + original user + canWrite

- src/auth.js: all impersonation fields + permissions.can_write - src/routes/oidc.js: save all fields to session - ui/index.js: canWrite, originalUserEmail in req.user - ui/routes/entries.js: read-only guard on POST/PATCH/DELETE - docs/PLAN-impersonation.md: updated with implemented items
2026-06-11 15:54:56 +04:00
parent a2cfd2c10f
commit 9a331eec82
6 changed files with 38 additions and 2 deletions
@@ -73,7 +73,12 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
          companyId:      iamData.companyId,
          companyName:    iamData.companyName,
          isAdmin:        iamData.isAdmin,
+          canWrite:       iamData.canWrite,
          isImpersonated: iamData.isImpersonated,
+          impersonationType:     iamData.impersonationType,
+          originalUserEmail:     iamData.originalUserEmail,
+          originalUserFullName:  iamData.originalUserFullName,
+          originalUserCompany:   iamData.originalUserCompany,
          fio:            iamData.fio,
          profiles:       iamData.profiles,
        };