fix(webapp): keep the impersonation link through login, order audit rows

Signing in from an impersonation link dropped the destination: the admin gate
answered both "not signed in" and "signed in but not an admin" with a redirect
to /, so an agent who clicked Impersonate while logged out landed on the
dashboard afterwards. Unauthenticated requests now redirect to login carrying
the original URL as redirectTo — the one-time token is validated after the gate,
so it survives the round trip.

The paired STOP/START audit rows were written with createMany, a single insert,
so both took the same createdAt and a view ordered by that column could show the
new START ahead of the STOP closing the previous session. They are now two
statements so the sequence is unambiguous.

Author: isshaddad

apps/webapp/app/models/admin.server.ts

@@ -238,27 +238,31 @@ export async function redirectWithImpersonation(
   const previousTargetId = await getImpersonationId(request);
 
   try {
-    await prismaClient.impersonationAuditLog.createMany({
-      data: [
-        // Switching straight from one target to another never passes through `clearImpersonation`,
-        // so close the previous session here or the trail shows two overlapping STARTs.
-        ...(previousTargetId && previousTargetId !== userId
-          ? [
-              {
-                action: "STOP" as const,
-                adminId: admin.id,
-                targetId: previousTargetId,
-                ipAddress,
-              },
-            ]
-          : []),
-        {
-          action: "START" as const,
+    // Switching straight from one target to another never passes through `clearImpersonation`, so
+    // close the previous session here or the trail shows two overlapping STARTs.
+    //
+    // Two statements rather than one `createMany`: `createdAt` defaults to `now()`, which is fixed
+    // for the duration of a statement, so a single insert would stamp both rows identically and an
+    // audit view ordered by `createdAt` couldn't tell which came first — the very ambiguity the
+    // STOP row exists to remove.
+    if (previousTargetId && previousTargetId !== userId) {
+      await prismaClient.impersonationAuditLog.create({
+        data: {
+          action: "STOP",
           adminId: admin.id,
-          targetId: userId,
+          targetId: previousTargetId,
           ipAddress,
         },
-      ],
+      });
+    }
+
+    await prismaClient.impersonationAuditLog.create({
+      data: {
+        action: "START",
+        adminId: admin.id,
+        targetId: userId,
+        ipAddress,
+      },
     });
   } catch (error) {
     logger.error("Failed to create impersonation audit log", {

apps/webapp/app/routes/admin.impersonate.tsx

@@ -5,20 +5,33 @@ import {
 } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { redirectWithImpersonation } from "~/models/admin.server";
+import { authenticator } from "~/services/auth.server";
 import { getRealUser } from "~/services/session.server";
 import { validateAndConsumeImpersonationToken } from "~/services/impersonation.server";
 import { logger } from "~/services/logger.server";
+import { sanitizeRedirectPath } from "~/utils";
 
 const FormSchema = z.object({ id: z.string() });
 
 /**
- * The real authenticated user, or null when they aren't an admin.
+ * The real authenticated user, or null when they're signed in but not an admin.
  *
  * Must not use `requireUser`: while impersonating it resolves to the impersonation target, whose
  * `admin` is false, so an admin switching to a second target was bounced to `/` and left on the
  * first one.
+ *
+ * Throws a login redirect when nobody is signed in, keeping this URL as `redirectTo` so the
+ * impersonation survives the round trip — the one-time token is validated after this gate, so it's
+ * still unconsumed when the browser comes back. Collapsing that into the non-admin `/` redirect
+ * would drop the link the agent clicked.
  */
 async function requireRealAdmin(request: Request) {
+  if (!(await authenticator.isAuthenticated(request))) {
+    const url = new URL(request.url);
+    const redirectTo = sanitizeRedirectPath(`${url.pathname}${url.search}`);
+    throw redirect(`/login?${new URLSearchParams([["redirectTo", redirectTo]])}`);
+  }
+
   const admin = await getRealUser(request);
   return admin?.admin ? admin : null;
 }