My-KOPKB/be/app/Policies/ImpersonatePolicy.php

<?php

namespace App\Policies;

use Illuminate\Auth\Access\HandlesAuthorization;
use Modules\Auth\Entities\User;

class ImpersonatePolicy
{
    use HandlesAuthorization;

    /**
     * Determine whether the user can impersonate another user.
     */
    public function impersonate(User $user): bool
    {
        // DEVELOPER role bypasses all permission checks
        if ($user->hasRole('DEVELOPER')) {
            return true;
        }

        return $user->hasPermissionTo('menyamar pengguna');
    }

    /**
     * Determine whether the user can impersonate a specific target user.
     */
    public function impersonateUser(User $user, User $targetUser): bool
    {
        // DEVELOPER cannot be impersonated by anyone
        if ($targetUser->hasRole('DEVELOPER')) {
            return false;
        }

        // DEVELOPER role bypasses all permission checks
        if ($user->hasRole('DEVELOPER')) {
            return true;
        }

        // Check if user has permission to impersonate
        if (!$user->hasPermissionTo('menyamar pengguna')) {
            return false;
        }

        // Users with permission can impersonate other users (except DEVELOPER)
        return true;
    }
}