@blamejs/blamejs-shop 0.5.22 → 0.5.24

package/lib/storefront.js

@@ -352,6 +352,14 @@ var LAYOUT =
   "    </div>\n" +
   "  </header>\n" +
   "\n" +
+  // Empty on every render, on both substrates — the session-chrome island
+  // fills it when /cart/count reports this browser is an operator viewing a
+  // customer's account. Emitting it always (rather than server-rendering the
+  // banner) keeps the edge-cached body identical for every visitor, so the
+  // cache still serves one page to everyone. It sits OUTSIDE <main> because
+  // the render-parity tests compare that region byte for byte.
+  "  <div id=\"impersonation-banner\"></div>\n" +
+  "\n" +
   "  <div class=\"page-shell\">\n" +
   "  <main id=\"main\">{{body}}</main>\n" +
   "RAW_SIDEBAR_RAIL" +
@@ -5602,6 +5610,91 @@ function renderAccountDelete(opts) {
   });
 }
 
+// The confirmation an operator sees before entering a customer's account.
+//
+// Exists so that FOLLOWING the handoff link changes nothing: a prefetcher, a
+// link-preview bot or a scanner that fetches this URL gets a page, not a
+// session. Only the POST underneath spends the token. It also puts the two
+// facts the operator should see before they are inside someone else's account
+// in front of them — whose account, and the reason they themselves gave.
+function renderImpersonationConfirm(opts) {
+  var esc = b.template.escapeHtml;
+  var who = opts.customer_name
+    ? esc(String(opts.customer_name)) + " (" + esc(String(opts.customer_id)) + ")"
+    : esc(String(opts.customer_id));
+  var until = Number(opts.expires_at);
+  var untilStr = Number.isFinite(until)
+    ? new Date(until).toISOString().slice(0, 16).replace("T", " ") + " UTC"
+    : "one hour";
+  var csrf = opts.csrf_token
+    ? "<input type=\"hidden\" name=\"_csrf\" value=\"" + esc(String(opts.csrf_token)) + "\">"
+    : "";
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<h1 class=\"return-form-page__title\">View the store as this customer?</h1>" +
+      "<p class=\"form-notice\" role=\"note\">You are about to browse as <strong>" + who + "</strong>. " +
+        "Everything you do will be recorded against this session and shown to the customer " +
+        "on their own account page. The session ends automatically at " + esc(untilStr) + ".</p>" +
+      "<p class=\"form-notice\" role=\"note\">Your stated reason: <em>" +
+        esc(String(opts.reason || "—")) + "</em></p>" +
+      "<p class=\"form-notice\" role=\"note\">You will not be able to change their password, " +
+        "passkeys, email address or linked sign-ins, delete the account, or export their data.</p>" +
+      "<form method=\"post\" action=\"/account/impersonate/start\">" +
+        csrf +
+        "<input type=\"hidden\" name=\"token\" value=\"" + esc(String(opts.token || "")) + "\">" +
+        "<div class=\"actions-row\">" +
+          "<button type=\"submit\" class=\"btn-primary\">Start viewing as this customer</button>" +
+          "<a class=\"btn-secondary\" href=\"/\">Cancel</a>" +
+        "</div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "View as customer",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Shown to an operator who reached a credential surface while viewing a
+// customer's account. Addressed to the operator, not the customer — nobody
+// else can see this page, because reaching it requires the impersonation
+// cookie. It names the boundary rather than just refusing, so the operator
+// knows the account is intact and what to do instead.
+function renderAccountImpersonationRefused(opts) {
+  var esc = b.template.escapeHtml;
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<h1 class=\"return-form-page__title\">Not available while viewing as a customer</h1>" +
+      "<p class=\"form-notice form-notice--error\" role=\"alert\">" +
+        "You are signed in as this customer for support. Anything that decides who owns " +
+        "the account — a passkey, a linked sign-in, the email address, erasure, or a data " +
+        "export — stays closed while you are here, so a support session can never become " +
+        "a takeover and you cannot lock the customer out." +
+      "</p>" +
+      "<p class=\"form-notice\" role=\"note\">Refused: <code>" + esc(String(opts.path || "")) + "</code>. " +
+        "This attempt is recorded against the session. If the customer needs one of these " +
+        "changed, walk them through it on their own device.</p>" +
+      "<div class=\"actions-row\">" +
+        "<a class=\"btn-secondary\" href=\"/account\">Back to the account</a>" +
+        "<form method=\"post\" action=\"/account/impersonate/end\" style=\"display:inline\">" +
+          (opts.csrf_token
+            ? "<input type=\"hidden\" name=\"_csrf\" value=\"" + esc(String(opts.csrf_token)) + "\">"
+            : "") +
+          "<button type=\"submit\" class=\"btn-primary\">Stop viewing as customer</button>" +
+        "</form>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Not available while viewing as a customer",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Loyalty transaction-type pill — reuses the `pdp__badge` class the
 // theme already styles. The type is one of the ledger's closed enum
 // (earn / redeem / expire / adjust / tier-bonus).
@@ -9742,6 +9835,17 @@ var SESSION_COOKIE_NAME = "shop_sid";
 // initiated logout-everywhere).
 var AUTH_COOKIE_NAME    = "shop_auth";
 
+// How many support-session records the account page shows per page. Paged
+// rather than capped: the rows are the customer's only view of who opened
+// their account, so an older one must stay reachable however many there are.
+var ACCESS_PAGE_SIZE = 10;
+
+// Longest page path the impersonation action log will store, matching that
+// primitive's own `resource_id` cap. Kept in step deliberately: a value this
+// side accepts and the primitive refuses would be dropped by the recorder's
+// catch, losing the page from the trail silently.
+var IMPERSONATION_PATH_MAX = 256;
+
 // Cookie-prefix-hardened names for the two Path=/ session cookies. The
 // `__Host-` prefix is a browser-enforced integrity marker (RFC 6265bis
 // §4.1.3.2): a `__Host-`-named cookie is only stored when it was set
@@ -10659,6 +10763,68 @@ var ACCOUNT_DASH_ORDER_ROW =
   "  <td data-label=\"Actions\">RAW_ACCOUNT_ORDER_ACTIONS</td>\n" +
   "</tr>\n";
 
+// "Account access" — every time a support operator opened this account,
+// shown to the person it belongs to.
+//
+// This IS the customer's notification. The store keeps their email as a hash
+// only, so there is no address to write to; a notice that cannot be delivered
+// is not a notice, and stamping one as sent would put a false line in an audit
+// trail. Rendered here it needs no address, cannot bounce, and cannot fail
+// silently — the customer sees it the next time they sign in.
+//
+// Renders NOTHING when the account has never been opened, so an ordinary
+// customer is never shown a scary empty security panel.
+function _accountAccessSection(sessions, page, hasMore) {
+  if (!Array.isArray(sessions) || !sessions.length) return "";
+  var esc = b.template.escapeHtml;
+  page = page || 0;
+
+  var rows = sessions.map(function (s) {
+    var started = Number(s.started_at);
+    var when = Number.isFinite(started)
+      ? new Date(started).toISOString().slice(0, 16).replace("T", " ") + " UTC"
+      : "—";
+    // `ended` and `expired` both mean the session is over; only `active`
+    // means someone may be looking right now, and saying so plainly is the
+    // point of the panel.
+    var live = s.status === "active";
+    return "<tr>" +
+      "<td>" + esc(when) + "</td>" +
+      "<td>" + esc(String(s.reason || "—")) + "</td>" +
+      "<td>" + (live
+        ? "<strong>in progress now</strong>"
+        : esc(String(s.status || "ended"))) + "</td>" +
+    "</tr>";
+  }).join("");
+
+  return "<section class=\"account-access\" aria-labelledby=\"account-access-title\">" +
+    "<h2 id=\"account-access-title\">Account access by our support team</h2>" +
+    "<p>For your security we record every time a member of our team opened your " +
+    "account to help with a problem, and why. They cannot change your password, " +
+    "your passkeys, your email address, or any other way of signing in — and they " +
+    "cannot delete your account or export your data.</p>" +
+    "<table class=\"account-access__table\">" +
+      "<thead><tr><th scope=\"col\">When</th><th scope=\"col\">Reason</th>" +
+      "<th scope=\"col\">Status</th></tr></thead>" +
+      "<tbody>" + rows + "</tbody>" +
+    "</table>" +
+    // Paging, not truncation: this is the customer's only view of who opened
+    // their account, so an older session must never become unreachable.
+    "<div class=\"actions-row\">" +
+      (page > 0
+        ? "<a class=\"btn-secondary\" href=\"/account?access_page=" + (page - 1) +
+          "#account-access-title\">Newer</a>"
+        : "") +
+      (hasMore
+        ? "<a class=\"btn-secondary\" href=\"/account?access_page=" + (page + 1) +
+          "#account-access-title\">Older</a>"
+        : "") +
+    "</div>" +
+    "<p class=\"form-notice\" role=\"note\">If any of this looks wrong, contact us — " +
+    "reply to any order email and mention the date above.</p>" +
+  "</section>";
+}
+
 function renderAccount(opts) {
   if (!opts || !opts.customer) throw new TypeError("storefront.renderAccount: opts.customer required");
   var orders = opts.orders || [];
@@ -10751,6 +10917,8 @@ function renderAccount(opts) {
     .replace("RAW_QUOTES_LINK", opts.quotes_enabled
       ? "<a class=\"btn-secondary\" href=\"/account/quotes\">Quotes</a>"
       : "");
+  body += _accountAccessSection(
+    opts.account_accesses, opts.account_access_page, opts.account_access_has_more);
   return _wrap({
     title:      "Account",
     shop_name:  opts.shop_name || "blamejs.shop",
@@ -11939,6 +12107,20 @@ function mount(router, deps) {
   _hasCollections = !!deps.collections;
   _hasCategoryNav = !!deps.categoryNavigation;
 
+  // Deliberately NOT routed through `b.render.htmlString`, unlike the admin
+  // console's equivalent helper.
+  //
+  // The renderer's default is `Cache-Control: private, no-cache,
+  // must-revalidate`, which is right for the admin console — every response
+  // there is signed-in operator data. This helper is not the same shape: it
+  // serves anonymous, edge-cacheable pages (category, collection, help
+  // article, opening hours) from the SAME function as the account pages.
+  // Stamping `private` on all of them would tell the CDN not to cache exactly
+  // the pages the edge exists to serve, trading a real performance loss for no
+  // security gain on a page a logged-out visitor can already fetch.
+  //
+  // The per-route cache directives that do exist are set by the routes that
+  // own them, which is where the public/private decision actually lives.
   function _send(res, status, html) {
     res.status(status);
     res.setHeader && res.setHeader("content-type", "text/html; charset=utf-8");
@@ -12453,6 +12635,133 @@ function mount(router, deps) {
   // request. Resolution is best-effort (falls back to the English
   // baseline). The audit-log write is fired off without awaiting so it
   // never blocks the render. Only mounted when the router exposes `.use`.
+  // An impersonating operator can act as the customer — fix a cart, update an
+  // address, place an order. They cannot touch anything that decides WHO the
+  // account belongs to. That distinction is the whole reason impersonation is
+  // defensible: a support session must never become a takeover, and an
+  // operator must never be able to lock a customer out of their own account.
+  //
+  // Prefix-matched, so a route added under one of these later is closed by
+  // where it lives rather than by its author remembering.
+  var IMPERSONATION_CLOSED_PREFIXES = [
+    "/account/delete",          // destroying the account
+    "/account/passkey/",        // enrolling a credential
+    "/account/passkeys/",       // revoking someone else's credential
+    "/account/auth/",           // linking an identity provider
+    "/account/login/link",      // mailing a sign-in link to the address
+    "/account/privacy/",        // exporting or erasing the whole record
+  ];
+
+  // ---- impersonation guard, ahead of EVERY route ------------------------
+  //
+  // Mounted here rather than beside the account routes because `router.use`
+  // only sees routes registered after it. Down there it would have left
+  // /cart, /checkout and their mutation endpoints uncovered — so an operator
+  // whose session had been ended could still have gone on spending the
+  // customer's money until the cookie expired, which is the precise opposite
+  // of the next-request revocation this feature promises.
+  //
+  // Ordinary visitors leave in the first line: no marker on the cookie, no
+  // work, no database read.
+  if (typeof router.use === "function" && deps.customerImpersonation) {
+    router.use(async function impersonationGuard(req, res, next) {
+      var imp = _impersonationOf(req);
+      if (!imp) return next();
+
+      // Is the session behind this cookie still live? Re-read on every
+      // impersonated request so `end` and `revoke` bite on the operator's
+      // very next click rather than whenever the cookie happens to expire.
+      var live = await _impersonationStillLive(_currentCustomerEnv(req));
+      if (!live) {
+        _clearAuthCookie(req, res);
+        res.status(303);
+        res.setHeader && res.setHeader("location",
+          "/account/login?error=" + encodeURIComponent("that view-as-customer session has ended"));
+        return res.end ? res.end() : res.send("");
+      }
+
+      var pathname = req.pathname || req.url || "/";
+      var q = pathname.indexOf("?");
+      if (q !== -1) pathname = pathname.slice(0, q);
+
+      // Everything the operator does under this session is recorded, not just
+      // what is refused — that is the whole basis on which impersonation is
+      // defensible. Reads and writes both: knowing an operator LOOKED at an
+      // order is as much a part of the trail as knowing they changed it.
+      // Awaited, so the row is durable before the response goes out and a
+      // failure lands in the surrounding handler rather than as an unhandled
+      // rejection.
+      // "Sign out" means LEAVE, not "sign the customer out".
+      //
+      // The account page's own sign-out control posts to /account/logout,
+      // which revokes every session the customer has and invalidates their
+      // pending sign-in links. An operator reaching for it means "get me out
+      // of here" — and letting it through would log the customer out of their
+      // phone and laptop, which is precisely the lock-out this feature
+      // promises an operator cannot cause. Ending the impersonation is what
+      // they meant, so that is what it does.
+      if (pathname === "/account/logout") {
+        // Recorded before it is acted on — leaving is part of the trail, and
+        // this path returns before the common recording block below.
+        if (typeof deps.customerImpersonation.actionsRecord === "function") {
+          try {
+            await deps.customerImpersonation.actionsRecord({
+              impersonation_id: imp.impersonation_id,
+              action:           "exit",
+              resource_kind:    "route",
+              resource_id:      pathname,
+            });
+          } catch (_e) { /* observability sink — must not block the exit */ }
+        }
+        try {
+          await deps.customerImpersonation.endImpersonation({
+            impersonation_id: imp.impersonation_id,
+            ended_by:         "operator",
+            reason:           "operator signed out of the session",
+          });
+        } catch (_e) { /* clearing the cookie below is what protects the customer */ }
+        _clearAuthCookie(req, res);
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/");
+        return res.end ? res.end() : res.send("");
+      }
+
+      var closed = IMPERSONATION_CLOSED_PREFIXES.some(function (p) {
+        return pathname === p || pathname.indexOf(p) === 0;
+      });
+
+      if (typeof deps.customerImpersonation.actionsRecord === "function") {
+        try {
+          await deps.customerImpersonation.actionsRecord({
+            impersonation_id: imp.impersonation_id,
+            action:           closed ? "refused" : String(req.method || "GET").toUpperCase(),
+            resource_kind:    closed ? "credential_surface" : "route",
+            resource_id:      pathname,
+          });
+        } catch (_e) {
+          // Drop-silent by design: this is an observability sink on the hot
+          // path, and a failed audit insert must not take down the request
+          // the operator is making. The refusal below still happens.
+        }
+      }
+
+      if (!closed) return next();
+      res.status(403);
+      return _send(res, 403, renderAccountImpersonationRefused({
+        shop_name: shopName,
+        path:      pathname,
+        // Passed explicitly. This guard runs ahead of every route — including
+        // ahead of the locale middleware that normally puts the token where
+        // `_wrap` finds it — so without this the exit form on the refusal page
+        // would carry no `_csrf` and the csrf guard would reject it. That
+        // button is the operator's way OUT of someone else's account; a
+        // silently dead one is worse than none. The app-level csrf middleware
+        // has already run by here, so the token is on the request.
+        csrf_token: req.csrfToken,
+      }));
+    });
+  }
+
   if (typeof router.use === "function") {
     router.use(function localeMiddleware(req, _res, next) {
       try {
@@ -13218,6 +13527,53 @@ function mount(router, deps) {
     return env;
   }
 
+  // ---- operator impersonation ------------------------------------------
+  //
+  // An impersonated session is an ordinary auth cookie whose sealed envelope
+  // carries `imp` — the impersonation row's id. Everything downstream reads
+  // the target customer through the same `_currentCustomerEnv`, so the
+  // operator sees precisely the storefront that customer sees, with no
+  // parallel code path to drift out of sync.
+  //
+  // Two things hang off the marker: the banner (so the operator can never
+  // forget whose account they are in) and the credential-surface refusal.
+
+  // Whether THIS request is an impersonation, and of what. Returns null for
+  // an ordinary visitor, so a caller can branch on truthiness.
+  function _impersonationOf(req) {
+    var env = _currentCustomerEnv(req);
+    if (!env || typeof env.imp !== "string" || !env.imp.length) return null;
+    return { impersonation_id: env.imp, customer_id: env.customer_id };
+  }
+
+  // Is the impersonation row behind this cookie STILL live?
+  //
+  // The cookie is self-validating for its own lifetime, which would leave an
+  // operator browsing as a customer for hours after the session was ended or
+  // revoked. Every impersonated request re-reads the row, so `end` and
+  // `revoke` take effect on the operator's very next click rather than at
+  // cookie expiry. Only impersonated requests pay for the read.
+  //
+  // Fails CLOSED, unlike the customer-revocation gate beside it: that one
+  // fails open because a D1 blip must not sign out every shopper, but here a
+  // blip must not extend an operator's authority over someone else's account.
+  // The cost of failing closed is that the operator signs in again.
+  async function _impersonationStillLive(env) {
+    if (!env || typeof env.imp !== "string" || !env.imp.length) return true;
+    if (!deps.customerImpersonation ||
+        typeof deps.customerImpersonation.getSession !== "function") {
+      return false;
+    }
+    var row;
+    try { row = await deps.customerImpersonation.getSession(env.imp); }
+    catch (_e) { return false; }
+    if (!row || row.status !== "active") return false;
+    if (Number(row.expires_at) <= Date.now()) return false;
+    // The row must still name the customer the cookie claims, so a resealed
+    // or replayed envelope cannot point a live session at a different account.
+    return row.customer_id === env.customer_id;
+  }
+
   // Server-side session-revocation gate. The sealed cookie is otherwise
   // self-validating for its 14-day TTL, so erasure / passkey-revoke /
   // sign-out have no way to kill a LIVE cookie without this check. Resolves
@@ -14757,7 +15113,62 @@ function mount(router, deps) {
     res.status(200);
     res.setHeader && res.setHeader("content-type", "application/json; charset=utf-8");
     res.setHeader && res.setHeader("cache-control", "no-store");
-    var payload = JSON.stringify({ count: count });
+    // The impersonation flag rides this response rather than getting an
+    // endpoint of its own. Every page already calls this to fill the cart
+    // count, including the edge-cached ones where per-session chrome cannot
+    // be rendered server-side — so this is the one place a banner can be
+    // raised on a cached product page without routing the visitor to the
+    // container and destroying the cache hit rate.
+    //
+    // Read from the sealed cookie only: no database round trip, so an
+    // ordinary shopper's call costs exactly what it did before. The
+    // per-request liveness check still runs on the routes that matter; a
+    // banner shown a few seconds after a session ended is harmless, and the
+    // operator's next real request is refused regardless.
+    var imp = _impersonationOf(req);
+
+    // Record the page the island reported. With edge rendering on, most of
+    // the operator's browsing is answered by the Worker and never reaches the
+    // guard, so without this the session's trail would be a run of
+    // /cart/count calls naming nothing the operator actually looked at.
+    //
+    // The value comes from a browser and is treated that way: screened
+    // through the shared codepoint guard, required to look like a rooted
+    // path, and length-capped. A value that fails any of those is dropped
+    // rather than refused — this is an observability sink on a hot path, and
+    // the cart count must still come back.
+    if (imp && deps.customerImpersonation &&
+        typeof deps.customerImpersonation.actionsRecord === "function") {
+      var reported = null;
+      try {
+        var u = req.url ? new URL(req.url, "http://localhost") : null;
+        var p = u && u.searchParams.get("p");
+        // 256 is the action log's own cap on `resource_id`. Accepting more
+        // here would hand the primitive a value it refuses, and the catch
+        // below would swallow the refusal — so a long product URL would
+        // vanish from the trail without a trace. Truncate rather than drop:
+        // a shortened path still says which page, and losing the record
+        // entirely is the worse failure.
+        if (typeof p === "string" && p.length && p.charAt(0) === "/" &&
+            !textGuard.hasCodepointThreat(p, { singleLine: "reject" })) {
+          reported = p.length > IMPERSONATION_PATH_MAX ? p.slice(0, IMPERSONATION_PATH_MAX) : p;
+        }
+      } catch (_e) { reported = null; }
+      if (reported) {
+        try {
+          await deps.customerImpersonation.actionsRecord({
+            impersonation_id: imp.impersonation_id,
+            action:           "VIEW",
+            resource_kind:    "page",
+            resource_id:      reported,
+          });
+        } catch (_e) { /* drop-silent — the cart count must still return */ }
+      }
+    }
+
+    var payload = JSON.stringify(imp
+      ? { count: count, impersonating: { customer_id: imp.customer_id } }
+      : { count: count });
     return res.end ? res.end(payload) : res.send(payload);
   });
 
@@ -16179,6 +16590,12 @@ function mount(router, deps) {
     var rpId   = deps.rpId || (deps.shop_origin ? new URL(deps.shop_origin).hostname : "localhost");
     var expectedOrigin = deps.shop_origin || ("https://" + rpId);
 
+    // The impersonation guard that closes these surfaces is mounted at the
+    // TOP of this router, ahead of every route — see `impersonationGuard`
+    // near the locale middleware. It cannot live here: `router.use` only
+    // applies to routes registered after it, and /cart and /checkout are
+    // registered before this block.
+
     function _b64u(buf) {
       return b.crypto.toBase64Url(buf);
     }
@@ -16447,6 +16864,134 @@ function mount(router, deps) {
       });
     }
 
+    // ---- impersonation: redeem, and exit --------------------------------
+    //
+    // The operator arrives here from the admin console holding the one-time
+    // bearer the primitive minted. Redeeming it seals an ordinary auth cookie
+    // for the target customer, marked with the impersonation row's id.
+    //
+    // Two steps, and the split is load-bearing.
+    //
+    // The GET only LOOKS: it verifies the token and paints a confirmation page
+    // naming the customer and the stated reason. It changes nothing. The POST
+    // spends the token and mints the session.
+    //
+    // Doing both in the GET would mean anything that follows a link ahead of
+    // the operator — a browser prefetcher, a link-preview bot in whatever chat
+    // the console was open next to, a security scanner walking history — burns
+    // the one-time bearer. The operator then arrives to be told their link is
+    // invalid, and something that is not the operator is holding the only
+    // session that link will ever mint. A GET must not spend a credential.
+    //
+    // The confirmation is worth having on its own: the operator sees whose
+    // account they are about to enter, and why they said they were entering
+    // it, before they are inside it.
+    var _impersonationRefused = function (res) {
+      // One outcome for every failure — expired, ended, revoked, already
+      // spent, never existed. An operator who mistypes learns nothing about
+      // which, and a visitor guessing URLs learns nothing at all.
+      res.status(303);
+      res.setHeader && res.setHeader("location",
+        "/account/login?error=" + encodeURIComponent("view-as-customer link is no longer valid"));
+      return res.end ? res.end() : res.send("");
+    };
+
+    if (deps.customerImpersonation) {
+      router.get("/account/impersonate/:token", async function (req, res) {
+        var ctx = null;
+        try { ctx = await deps.customerImpersonation.verifyImpersonationToken(req.params.token); }
+        catch (_e) { ctx = null; }
+        if (!ctx) return _impersonationRefused(res);
+
+        var target = null;
+        try { target = await deps.customers.get(ctx.customer_id); }
+        catch (_e) { target = null; }
+
+        return _send(res, 200, renderImpersonationConfirm({
+          shop_name:     shopName,
+          token:         req.params.token,
+          customer_id:   ctx.customer_id,
+          customer_name: (target && target.display_name) || "",
+          reason:        ctx.reason,
+          expires_at:    ctx.expires_at,
+          csrf_token:    req.csrfToken,
+        }));
+      });
+
+      router.post("/account/impersonate/start", async function (req, res) {
+        var token = (req.body && req.body.token) || "";
+        var ctx = null;
+        try { ctx = await deps.customerImpersonation.verifyImpersonationToken(token); }
+        catch (_e) { ctx = null; }
+        if (!ctx) return _impersonationRefused(res);
+
+        // The claim authorizes the cookie, not the verify above: verification
+        // is a read, so two requests carrying the same token can both pass it.
+        // Only the one whose UPDATE still matched the hash gets a session.
+        // Fails CLOSED on a handle that cannot claim. An older or custom
+        // implementation without `consumeToken` would otherwise skip the claim
+        // and still be handed a cookie, turning the single-use link back into
+        // a bearer any number of holders could replay for the session's life.
+        // No claim, no session.
+        if (typeof deps.customerImpersonation.consumeToken !== "function") {
+          return _impersonationRefused(res);
+        }
+        var claim = null;
+        try { claim = await deps.customerImpersonation.consumeToken(ctx.impersonation_id, token); }
+        catch (_e) { claim = null; }
+        if (!claim || !claim.consumed) return _impersonationRefused(res);
+
+        // If this browser is already in a session, close it before the cookie
+        // naming it is overwritten. The cookie is the only handle on it: once
+        // replaced, the operator cannot reach the exit control for the old one
+        // and its row would sit `active` until the hourly sweep — telling the
+        // first customer "in progress now" about a session nobody is in, and
+        // showing operator dashboards a session that has been abandoned.
+        var previous = _impersonationOf(req);
+        if (previous && previous.impersonation_id !== ctx.impersonation_id) {
+          try {
+            await deps.customerImpersonation.endImpersonation({
+              impersonation_id: previous.impersonation_id,
+              ended_by:         "operator",
+              reason:           "operator moved to another customer's session",
+            });
+          } catch (_e) { /* the new cookie below is what the operator gets either way */ }
+        }
+
+        _setAuthCookie(req, res, {
+          customer_id: ctx.customer_id,
+          // The cookie must not outlive the session it represents. The auth
+          // cookie's usual 14 days would leave a sealed envelope naming a
+          // dead impersonation long after it ended; the per-request liveness
+          // read would refuse it, but there is no reason to hand out a
+          // credential that outlives its authority.
+          exp:         ctx.expires_at,
+          imp:         ctx.impersonation_id,
+        });
+        res.status(303); res.setHeader && res.setHeader("location", "/account");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Leaving. Ends the row so the operator's next request is refused by
+      // the liveness read even if the cookie survives, then clears the cookie
+      // so the browser stops carrying the customer's session at all.
+      router.post("/account/impersonate/end", async function (req, res) {
+        var imp = _impersonationOf(req);
+        if (imp) {
+          try {
+            await deps.customerImpersonation.endImpersonation({
+              impersonation_id: imp.impersonation_id,
+              ended_by:         "operator",
+              reason:           "operator left the session",
+            });
+          } catch (_e) { /* clearing the cookie below is what protects the customer */ }
+        }
+        _clearAuthCookie(req, res);
+        res.status(303); res.setHeader && res.setHeader("location", "/");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     router.post("/account/passkey/register-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
@@ -16845,11 +17390,48 @@ function mount(router, deps) {
       } catch (_e) { /* drop-silent — primitive may not expose listPasskeys on every build */ }
 
       var cartCount = await _cartCountForReq(req);
+      // Every time an operator has opened this account for support, shown to
+      // the person it belongs to. This is the customer's notification: the
+      // store keeps their email as a hash only, so there is no address to
+      // send to, and a notice that cannot be delivered is not a notice. Here
+      // it needs no address, cannot bounce, and cannot silently fail to send.
+      //
+      // Read-only and best-effort: a lookup failure must never keep a
+      // customer out of their own account.
+      var accountAccesses = [];
+      var accessPage = 0;
+      var accessHasMore = false;
+      if (deps.customerImpersonation &&
+          typeof deps.customerImpersonation.listForCustomer === "function") {
+        var acctUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        // Bounded per page, because these rows are never pruned and an
+        // unbounded read would make this page slower for the rest of the
+        // account's life — worst for the customers support has helped most
+        // often. Paged rather than truncated: this is the customer's only
+        // view of who opened their account, so nothing may become
+        // permanently unreachable. `?access_page=N` walks back.
+        accessPage = Math.max(0, parseInt((acctUrl && acctUrl.searchParams.get("access_page")) || "0", 10) || 0);
+        try {
+          // One extra row than the page shows, purely to learn whether there
+          // is another page — cheaper than a second COUNT query.
+          var fetched = await deps.customerImpersonation.listForCustomer(customer.id, {
+            limit:  ACCESS_PAGE_SIZE + 1,
+            offset: accessPage * ACCESS_PAGE_SIZE,
+          });
+          accessHasMore = fetched.length > ACCESS_PAGE_SIZE;
+          accountAccesses = accessHasMore ? fetched.slice(0, ACCESS_PAGE_SIZE) : fetched;
+        }
+        catch (_e) { accountAccesses = []; }
+      }
+
       _send(res, 200, renderAccount({
         asset_prefix:          deps.asset_prefix || "/assets/",
         customer:              customer,
         orders:                orders,
         order_product_lookup:  orderProductLookup,
+        account_accesses:      accountAccesses,
+        account_access_page:     accessPage,
+        account_access_has_more: accessHasMore,
         passkey_count:         passkeyCount,
         preorders_enabled:     !!preorder,
         pickups_enabled:       !!deps.clickAndCollect,