1from plain.auth.views import AuthView
 2from plain.http import RedirectResponse, Response
 3from plain.sessions.views import SessionView
 4
 5from .constants import _IMPERSONATE_SESSION_KEY
 6from .permissions import can_be_impersonator
 7from .requests import get_request_impersonator
 8
 9
10class ImpersonateStartView(AuthView):
11    def get(self) -> Response:
12        # We *could* already be impersonating, so need to consider that
13        impersonator = get_request_impersonator(self.request) or self.user
14        if impersonator and can_be_impersonator(impersonator):
15            self.session[_IMPERSONATE_SESSION_KEY] = self.url_kwargs["id"]
16            return RedirectResponse(
17                self.request.query_params.get("next", "/"), status_code=302
18            )
19
20        return Response(status_code=403)
21
22
23class ImpersonateStopView(SessionView):
24    def get(self) -> Response:
25        self.session.pop(_IMPERSONATE_SESSION_KEY)
26        return RedirectResponse(
27            self.request.query_params.get("next", "/"), status_code=302
28        )