Summary
When an admin inspects (impersonates) a user who does not hold the configured allowed role, the admin is logged out. The role gate is evaluated against the impersonated identity instead of the authenticated admin, so inspecting any lapsed or non-subscribing user ends the admin's own session.
Reported by moderators on 2026-08-12: "inspecting someone who doesn't have an active sub logs you out on poracle web".
Evidence
From poraclewebnet-poracle-web-1 on poracle-01, admin 237272485169594369 inspecting user 291319232543719434:
Start processing HTTP request GET http://…:3030/api/humans/one/291319232543719434
Start processing HTTP request GET http://…:3030/api/humans/291319232543719434/getAdministrationRoles
Pgan.PoracleWebNet.Api.Controllers.AuthController[798789167]
Role check for 291319232543719434: allowed=[497571422407884810],
user=[1448534383613968385, 576753755673067530, 576754810842513418,
264148989329276938, 1448534417759932466, 1448534374726238270]
Pgan.PoracleWebNet.Api.Controllers.AuthController[2048928978]
User 291319232543719434 denied: has none of the allowed roles.
A few requests later the same sequence repeats for admin 231013798494994432 on the same target, so it reproduces across admins. The inspected account holds six Discord roles but not the subscriber role 497571422407884810, which is exactly the "no active sub" case the moderators hit.
Expected
Impersonation should scope what data is shown, not who is authorised. The admin's session must survive inspecting a user at any entitlement level; that is the whole point of the feature (checking why someone's alerts stopped usually means they lapsed).
Suggested fix
In AuthController, evaluate the entitlement/role gate against the authenticated principal, not the effective/impersonated id. Where the impersonated user's roles genuinely matter (rendering their view), keep that as data, not as an authorisation result. A denial for an impersonated target should at worst show a banner ("this user has no active subscription"), never revoke the caller's session.
Worth auditing every other place that reads the effective id for an authorisation decision while impersonation is active.
Environment
- Image
ghcr.io/pgan-dev/poracleweb.net:latest, built 2026-08-10T19:01:18Z
- Host poracle-01, container
poraclewebnet-poracle-web-1
Summary
When an admin inspects (impersonates) a user who does not hold the configured allowed role, the admin is logged out. The role gate is evaluated against the impersonated identity instead of the authenticated admin, so inspecting any lapsed or non-subscribing user ends the admin's own session.
Reported by moderators on 2026-08-12: "inspecting someone who doesn't have an active sub logs you out on poracle web".
Evidence
From
poraclewebnet-poracle-web-1on poracle-01, admin237272485169594369inspecting user291319232543719434:A few requests later the same sequence repeats for admin
231013798494994432on the same target, so it reproduces across admins. The inspected account holds six Discord roles but not the subscriber role497571422407884810, which is exactly the "no active sub" case the moderators hit.Expected
Impersonation should scope what data is shown, not who is authorised. The admin's session must survive inspecting a user at any entitlement level; that is the whole point of the feature (checking why someone's alerts stopped usually means they lapsed).
Suggested fix
In
AuthController, evaluate the entitlement/role gate against the authenticated principal, not the effective/impersonated id. Where the impersonated user's roles genuinely matter (rendering their view), keep that as data, not as an authorisation result. A denial for an impersonated target should at worst show a banner ("this user has no active subscription"), never revoke the caller's session.Worth auditing every other place that reads the effective id for an authorisation decision while impersonation is active.
Environment
ghcr.io/pgan-dev/poracleweb.net:latest, built 2026-08-10T19:01:18Zporaclewebnet-poracle-web-1