Authorization

Impersonation is denied until you configure an authorize callback.

Configure

use BradieTilley\Impersonation\ImpersonationManager;

ImpersonationManager::configure(
    authorize: function ($impersonator, $impersonatee): bool {
        return $impersonator->can('impersonate', $impersonatee);
    },
);

The callback receives the current authenticated user (impersonator) and the target (impersonatee). Return true to allow.

Built-in denials

Even when your callback returns true, impersonation is refused when:

• The impersonator and impersonatee are the same Eloquent model (is())
• The current stack depth is already at max_depth

Failures

impersonate() throws CannotImpersonateUserException when authorization fails. Unauthenticated calls throw ImpersonationUnauthenticatedException. Missing configure() throws MissingImpersonationConfigurationException.

HTTP package routes map these to 403 / 401 responses automatically.

Checking without starting

ImpersonationManager::make()->canImpersonate($admin, $user);

Use this to show or hide UI controls.

Continue to HTTP Routes or Events.