Feedback from testing

#79
This discussion is linked to the following issue above and a continuation of it here.

Initial discussion between @wellington-vell and @m-t-a97

[wellington-vell]

Thanks for the detailed explanation!
I completely understand that Go has some limitations, that makes total sense.

For now i will just add that would be helpful to add the previous cursor on the adminusers query.

[wellington-vell]

Hey, when stopping impersonating we are really supposed to lost the session ?

[m-t-a97]

Yes because currently we don't have a fallback mechanism to go back to your original session. Just to give you some more context, this is how it works from what I remember:

• when you start impersonating a user, a new user session is created for that user and the session token is assigned to you (stored as a cookie if you're using session plugin or JWT is returned to you if using the JWT+Bearer plugins). What happens now is that your original session is actually removed and replaced with this new user session.
• when you stop impersonating, you essentially get logged out completely.

So actually there is a workaround to fixing this and it's something I've thought about. If you're using the session plugin which means your auth state is stored in cookies, we could simply move your original session token authula.session_token into a new cookie authula.session_token.original for example. Then when you impersonate a user, your authula.session_token becomes the user's session token. Now when you log out and stop impersonating that user, we could simply return back to your original session by copying and moving the authula.session_token.original to authula.session_token, this way you don't need to log back in.

I'm assuming I'd implement something similar for the Bearer plugin too so it can be used with JWTs. I hope that makes sense :)

[m-t-a97]

I'll make a GitHub issue for this, thanks for bringing it up.

[m-t-a97]

#83

[m-t-a97]

@wellington-vell , I've now implemented the change for the Metadata property throughout this entire project. The PR is here: #85

[m-t-a97]

@wellington-vell, I wanted to update you and let you know that admin impersonation is now fixed.

When you log out of the impersonated user's account, you retain your original session so you no longer need to log back in again. This works for both session & JWT based auth.

It's been implemented in this PR: #91

Please make sure to read the docs here too as there's been some changes to the Admin plugin regarding permissions: Admin Plugin Docs

[wellington-vell]

Nice, i will test it latter

[m-t-a97]

Another update for you @wellington-vell as you mentioned previously regarding the Node.js SDK. The SDK has now been drastically improved. You can check out the details here: https://www.npmjs.com/package/authula

I hope this helps and improves your workflow further.