first init

be/app/Policies/ImpersonatePolicy.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Policies;
+
+use Illuminate\Auth\Access\HandlesAuthorization;
+use Modules\Auth\Entities\User;
+
+class ImpersonatePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can impersonate another user.
+     */
+    public function impersonate(User $user): bool
+    {
+        // DEVELOPER role bypasses all permission checks
+        if ($user->hasRole('DEVELOPER')) {
+            return true;
+        }
+
+        return $user->hasPermissionTo('menyamar pengguna');
+    }
+
+    /**
+     * Determine whether the user can impersonate a specific target user.
+     */
+    public function impersonateUser(User $user, User $targetUser): bool
+    {
+        // DEVELOPER cannot be impersonated by anyone
+        if ($targetUser->hasRole('DEVELOPER')) {
+            return false;
+        }
+
+        // DEVELOPER role bypasses all permission checks
+        if ($user->hasRole('DEVELOPER')) {
+            return true;
+        }
+
+        // Check if user has permission to impersonate
+        if (!$user->hasPermissionTo('menyamar pengguna')) {
+            return false;
+        }
+
+        // Users with permission can impersonate other users (except DEVELOPER)
+        return true;
+    }
+}
+