fix(app-shell): the impersonation banner names the administrator by name or email, never by a raw user id - #29272

Requested by Steedos · project thread

Fixes #29161

Clause-②: yes (widening)
Metadata-protocol: none

维护者速读

• 改了什么：管理员「模拟登录」某个用户后，页面顶部红条原来写「由管理员 963Jhis… 发起」（一串内部用户 id），现在写管理员的姓名（没有姓名时写邮箱），例如「由管理员 Dev Admin 发起」。
• 为什么改：红条的作用是让人一眼看清谁在代谁操作；一串 id 既不能让管理员确认是自己，也不能让屏幕共享或审计截图里的旁观者认出是谁。
• 风险与回滚：只改红条这一句的显示；被模拟的用户看不到管理员那条用户记录时（例如不在同一组织），显示「由管理员发起」，绝不显示 id；退出模拟、密码/MFA 遮罩都不变。回滚即 revert 本 PR。
• 先看：ui/packages/app-shell/src/layout/ImpersonationBanner.tsx（useAdministratorName 的一次读取与三种结果）；ui/packages/app-shell/src/layout/__tests__/ImpersonationBanner.test.tsx；ui/packages/i18n/src/locales/en.ts（新键 startedByUnnamed）。
• 两分钟验证：showcase 上以管理员进入 Setup → Users，对一个同组织的普通用户「Impersonate User」，红条应写「Started by administrator Dev Admin.」，不出现任何 id。
• 需要你做的：无，席位落地。

What changes

• ImpersonationBanner names the administrator. The session carries the administrator only as session.impersonatedBy (a sys_user id). The banner now reads that one row, GET /api/v1/data/sys_user/ID, through createAuthenticatedFetch (the session the console holds, which is the impersonated user's), parses the body with the spec's GetDataResponseSchema, and names the administrator by the first non-empty of the person display columns approverIdentity already uses for sys_user (full name, name, display name, email).
• An honest sentence when the row cannot be read. A refused, missing or failed read, a body off the GetDataResponse shape, or a row with neither name nor email shows "Started by an administrator." The raw id is never rendered, and the sentence is held back until the read answers, so it never flips from an id to a name.
• Why a raw authenticated GET and not the data adapter: the banner mounts in ConsoleShell, above AdapterProvider, so useAdapter() has nothing there. The /api/v1 lane is the one the banner's exit (useImpersonationExit) and storageUsageEndpoint already use from the same shell level.
• RemediationOverlay is unchanged. The read lives in the banner, not in the shared useImpersonationExit, so the overlay (which names nobody) issues no read.
• New locale key impersonation.banner.startedByUnnamed in all ten @object-ui/i18n packs, hence Clause-②: yes (widening) (the claim was amended for it).

Tests

• ImpersonationBanner.test.tsx (13 cases, on the real AuthProvider + real locale packs):
  • the named case now asserts "Started by administrator Dev Admin." and that usr_admin appears nowhere; the read goes to /api/v1/data/sys_user/usr_admin with the impersonated bearer;
  • a row with an empty name is named by email;
  • four cases (404 as a user outside the row scope gets it, 403, an off-shape body, a network failure) all show "Started by an administrator." and never the id;
  • while the read is still out, no administrator sentence renders;
  • the two stop cases now rotate the token only on the stop route (the old stub rotated on every URL, which the new read would have adopted).
• Ablation (one, the brief's): admin: administrator.name mutated to admin: impersonatedBy (pass the id back) through scripts/ablation-replace.mjs: 2 cases red ("names BOTH parties", "names the administrator by email"), 11 green; restored, blob equal to HEAD and git diff HEAD empty.
• Runs at head cb02bf18 (after merging main), under scripts/pm/os-verify-lock.sh:
  • pnpm --dir ui exec vitest run packages/app-shell/src/layout/__tests__/ImpersonationBanner.test.tsx packages/app-shell/src/console/__tests__/RemediationOverlay.impersonation-13208.test.tsx: 2 files, 19 tests passed (the overlay's 6 unchanged).
  • pnpm --dir ui exec vitest run packages/i18n/: 95 files passed, 1443 tests passed, 13 skipped (run before the merge; the merge moved only the Studio namespace in i18n).
  • turbo run type-check --filter=@object-ui/app-shell --filter=@object-ui/i18n: 66 tasks, exit 0 (both tsc programs, source and tests).

Acceptance notes

• The data route answers GET /data/sys_user/ID as the spec's GetDataResponse body with no success/data envelope (measured live, below); the banner reads that shape only.
• The read uses the conventional /api/v1/data prefix, as the exit uses /api/v1/auth. A deployment that moved crud.dataPrefix gets a 404 there and the banner says "an administrator", never the id.
• In the Vite dev console the read is issued twice (React StrictMode double effect); production renders issue it once per administrator id.

Verification

Live showcase (pnpm dev -- --fresh, framework at this branch before the main merge, Console Vite dev proxied to it), admin admin@objectos.ai, a new user "RT Dave" created with admin/create-user and impersonated with admin/impersonate-user:

• Dave in the admin's organization: get-session reports impersonatedBy = the admin's id; GET /api/v1/data/sys_user/ADMIN_ID as Dave answers 200 {"object":"sys_user","id":…,"record":{…"name":"Dev Admin","email":"admin@objectos.ai"…}}; the banner reads "You are impersonating RT Dave — every action is recorded as them. Started by administrator Dev Admin."
• Dave removed from the organization (organization/remove-member), re-impersonated: the same GET answers 404 RECORD_NOT_FOUND (the sys_user row scope is own row plus organization members), GET /data/sys_user lists only Dave's own row; the banner reads "… Started by an administrator." with no id.
• Screenshots (desktop named, phone named, desktop unnamed) are on the card thread.

Generated by Claude Code