xF2 Add-on D.C Style - Login As User 1.1.0 Patch Level 3 1.1.0

Introduction
Support add-on that lets permitted staff browse the board as another member — seeing exactly the pages, permissions, unread state and error messages that member sees — without ever asking for their password. Every switch is recorded, every live session is visible, and every session ends on its own.

Features
Six entry points, all gated on the same permission, all rendering only when the target can actually be impersonated.

• Staff bar
• Member profile
• Post action bar
• Admin CP user list
• Admin CP user edit
• Direct link

The Confirmation Screen​

• Identity check — the target's avatar, name and email, so there is no doubt which account is about to be entered.
• Optional reason — free text, recorded on the audit row and shown in the log.
• Restricted accounts are flagged, not blocked — banned, disabled, awaiting approval, rejected, awaiting email confirmation and bouncing-email accounts are all clearly labelled, and can still be entered. That is usually the point: you see exactly what a restricted member sees.
• Password re-prompt — the staff member's own password, before the switch.

While Signed In As Someone Else​

• The staff bar is tinted and carries an accent line, so there is never a page where it is unclear whose account is in use.
• A persistent indicator and one-click return — "Signed in as {member}" and "Return to {yourself}", on every page.
• Log out means return. Clicking log out while impersonating ends the impersonation and leaves the staff member in their own account rather than signing them out — and does so without destroying their own remember-me record, which a plain logout would.
• The board treats you as the member in every respect: permissions, style, node visibility, unread counts and error messages are all theirs.

Safety Rails​

• Administrators can never be impersonated. Hard-coded, not a permission — immunity that can be granted away is not immunity.
• Grantable immunity — a separate "Cannot be logged in as" permission for protecting moderators, VIPs or one individual without touching code.
• Password confirmation — a stolen staff session is not by itself enough to reach member accounts. The confirmation lasts 30 minutes and is spent on each switch, so every impersonation is confirmed separately.
• No nesting — you must return to yourself before entering another account.
• One session per staff member, board-wide. Starting a second closes the first and destroys that device's session, so there is never a forgotten tab quietly browsing as somebody.
• Enforced time limit — 30 minutes by default, after which the staff member is returned automatically. Lowering the setting shortens sessions already running; raising it never extends one that started under a tighter rule.
• Never issues a credential for the target — no remember-me cookie is ever minted for the impersonated account, so nothing outlives the session.
• Uninstalling terminates live sessions first, before the code that could end them goes away.

Every failure path returns the staff member​

Each of these ends the session on its own and is recorded with its own outcome, rather than leaving somebody wearing an identity they cannot shed.

Audit Log​

Admin CP → Logs → Users → Login as user, behind the standard "view logs" admin permission — the same gate the moderator log uses.

• One row per session with staff member, impersonated member, reason, IP, start time, duration and outcome.
• Filters — by staff member (a select, since the set is bounded), by impersonated member (an autocomplete, since it is not), by date range, and an active-only toggle. Filters are reflected in the URL, so a filtered view is linkable.
• Row detail overlay with the full record, including which footprint suppressions were in force for that specific session — snapshotted at the time, so it stays accurate even after the settings change.
• Deleted accounts still name themselves — usernames are stored on the row, so history survives the accounts it describes.
• Cross-referenced with the native admin log — each event also writes an xf_admin_log entry, and the two rows are linked.
• Retention — completed sessions are pruned daily after a configurable number of days (365 by default; 0 keeps them forever). Open sessions are never pruned, whatever their age.

Live Sessions​

Admin CP → Users → Active sessions, behind its own admin permission — because ending a session is not reading a log, it terminates a peer administrator's browsing outright. Super admins pass automatically, so out of the box it behaves like a super-admin gate, with the difference that a board can delegate it.

• Who is signed in as whom right now, with reason, IP, start time, running duration and expiry.
• Force-end any session — the staff member's session is destroyed rather than handed back, the only outcome that cannot leave someone impersonating after an administrator decided they should not be.
• Automatic cleanup every 15 minutes closes sessions that hit their expiry, plus sessions nobody came back from — a closed laptop, a killed tab — after 24 hours. An active-sessions page that cries wolf is worse than no page at all.

Footprint Control​

Six independent toggles controlling what the impersonated member is left with afterwards. All on by default

Currently online list
The member is not pushed onto the online list by staff browsing.
Last activity time
Their last-seen timestamp is not moved.
Read marking
Unread threads and forums survive the visit, including the "Mark forums read" button.
Alerts
Their unread alerts stay unread.
Direct messages
Their unread conversations stay unread.
IP logging
The staff member's IP is not written into the member's IP history. It is still recorded on the audit row, where it belongs.

Suppression is scoped to the impersonated account specifically, so anything happening in the same request that concerns a different member still behaves normally — hiding one staff member's browsing never corrupts a third party's data.

Installation

1. Install the add-on via Add-ons → Install/upgrade from archive​

2. Grant the permission under Admin CP → Groups & permissions → User group permissions, grant Log in as another member​

3. Protect the accounts that need it​

   Optionally grant Cannot be logged in as to any group or individual member that should be off limits. Administrators are already protected unconditionally.

4. Delegate session control​

   Under Admin CP → Administrators, grant Login as user: end active sessions to the administrators who should be able to see and terminate live sessions. Super admins already have it.