3
Surface user impersonation in SDKs
Source: supabase/supabase#36310 · opened by @bdotsamir
Hello!
It's already very useful be able to impersonate various users in the dashboard, but it would be even more amazing if Supabase could expose the impersonation capability in the SDKs offered (in @supabase/supabase-js, it would have to be under the supabase.auth.admin namespace definitely).
My use case for this: I use a custom auth hook which modifies the JWT. My RLS policies then rely on this modified JWT to have a certain property, and allow/deny access accordingly. As you might be able to imagine, simply impersonating a user via the Supabase dashboard in most cases is not enough to thoroughly test my policies, as the user impersonation does not "log in" as that user, and thus does not run the auth hook.
It would be incredible if the SDKs could expose user impersonation to us users so that we can then implement our own versions of impersonation. Maybe something like const { user, error } = await supabase.auth.admin.impersonate(userID)
It's already very useful be able to impersonate various users in the dashboard, but it would be even more amazing if Supabase could expose the impersonation capability in the SDKs offered (in @supabase/supabase-js, it would have to be under the supabase.auth.admin namespace definitely).
My use case for this: I use a custom auth hook which modifies the JWT. My RLS policies then rely on this modified JWT to have a certain property, and allow/deny access accordingly. As you might be able to imagine, simply impersonating a user via the Supabase dashboard in most cases is not enough to thoroughly test my policies, as the user impersonation does not "log in" as that user, and thus does not run the auth hook.
It would be incredible if the SDKs could expose user impersonation to us users so that we can then implement our own versions of impersonation. Maybe something like const { user, error } = await supabase.auth.admin.impersonate(userID)
No pledges yet. Be the first to back this.
Comments
Similar requests
User Impersonation Support in Supabase Storage
2 votes · 0 comments
Exposing user impersonation as auth function
15 votes · 0 comments
[RFC] Query builder immutability and safe branching semantics across Supabase SDKs
1 vote · 0 comments
user/role impersonation while testing edge functions in the dashboard
2 votes · 0 comments
Possibility to manage all active sessions
5 votes · 0 comments
No comments yet.