feat: IAM impersonation support — isImpersonated flag + banner

- src/auth.js: fetchIamUser extract isImpersonated from response
- src/routes/oidc.js: save isImpersonated to session
- ui/index.js: isImpersonated in req.user
- ui/routes/entries.js: pass isImpersonated to render
- views/index.ejs: banner 'Режим имперсонации'
- docs/PLAN-impersonation.md: план дальнейших шагов (двойной аудит)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.51",
+  "version": "0.5.52",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {

src/auth.js

@@ -321,6 +321,7 @@ async function fetchIamUser(token) {
     companyId:      ui.companyId || '',
     companyName:    ui.company || activeProfile.company_name || '',
     isAdmin:        !!ui.isAdmin,
+    isImpersonated: !!(raw.impersonation && raw.impersonation.is_impersonated),
     fio:            ui.fio || null,
     profiles,       // полный массив для UI
     raw,            // сырой ответ (для отладки)

src/routes/oidc.js

@@ -73,6 +73,7 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
           companyId:      iamData.companyId,
           companyName:    iamData.companyName,
           isAdmin:        iamData.isAdmin,
+          isImpersonated: iamData.isImpersonated,
           fio:            iamData.fio,
           profiles:       iamData.profiles,
         };

ui/index.js

@@ -63,6 +63,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       const isNail = payload.email === 'ntazetdinov@nubes.ru' || payload.login === 'ntazetdinov@nubes.ru';
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
         || (isNail && activeClientId === ADMIN_CLIENT_ID);
+      const sessionIsImpersonated = req.session && req.session.user && req.session.user.isImpersonated;
       req.user = {
         clientId:       rawClientId,
         allClientIds,
@@ -71,6 +72,7 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         companyName:    payload.company_name  || payload.companyName || activeClientId,
         email:          req.session?.user?.email || payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin || isNail,
+        isImpersonated: !!sessionIsImpersonated,
         canAdminMode,
         adminMode:      !!(req.session && req.session.adminMode),
       };

ui/routes/entries.js

@@ -119,6 +119,7 @@ function createRouter() {
         companies,
         selectedCompany,
         canAdminMode:    req.user.canAdminMode,
+        isImpersonated:  req.user.isImpersonated,
         allClientIds:    hasMultiple ? req.user.allClientIds : null,
         activeClientId:  req.user.activeClientId || req.user.clientId,
         profiles,        // из IAM — для UI переключателя
@@ -134,6 +135,7 @@ function createRouter() {
         entries: [], limit: 15, used: 0,
         user: req.user, isAdmin: req.user.isAdmin, adminMode: req.user.adminMode,
         canAdminMode: req.user.canAdminMode,
+        isImpersonated: req.user.isImpersonated,
         companies: [], selectedCompany: null,
         allClientIds: null, activeClientId: null,
         error: 'Ошибка загрузки: ' + e.message,

views/index.ejs

@@ -182,6 +182,12 @@
   <% if (success) { %><div class="alert alert-ok"><%= success %></div><% } %>
   <% if (error) { %><div class="alert alert-err"><%= error %></div><% } %>
 
+  <% if (typeof isImpersonated !== 'undefined' && isImpersonated) { %>
+    <div style="background:#fef3c7;border:1px solid #d97706;color:#92400e;padding:.5rem 1rem;border-radius:8px;margin-bottom:.5rem;font-size:.85rem;">
+      ⚠️ Режим имперсонации — данные сохраняются от имени <strong><%= user.clientId %></strong>
+    </div>
+  <% } %>
+
   <%
     // Для admin: selectedCompany — выбранная компания (объект из getAllCompanies).
     // Для обычного пользователя: selectedCompany — их компания (из getOrCreateCompany).