Allowance check

app/User.php

@@ -5,10 +5,11 @@ namespace App;
 use Illuminate\Notifications\Notifiable;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Laravel\Passport\HasApiTokens; 
+use Lab404\Impersonate\Models\Impersonate;
 
 class User extends Authenticatable
 {
-    use HasApiTokens, Notifiable;
+    use HasApiTokens, Notifiable, Impersonate;
 
     /**
      * The attributes that are mass assignable.
@@ -27,4 +28,16 @@ class User extends Authenticatable
     protected $hidden = [
         'password', 'remember_token',
     ];
+
+    public function canImpersonate()
+    {
+        // Limit to main admin to avoid privilege escalation.
+        return (int) $this->id === 1;
+    }
+
+    public function canBeImpersonated()
+    {
+        // Do not allow impersonating main admin.
+        return (int) $this->id !== 1;
+    }
 }