@milaboratories/pl-middle-layer 1.64.42 → 1.65.1

package/dist/model/sharing_model.js

@@ -40,6 +40,22 @@ function canGrantToEveryone(role) {
 		default: return false;
 	}
 }
+/**
+* Whether a role may impersonate another user: open/create another user's root and list
+* the resources that user can access. Mirrors the backend's authorization rule
+* `util/misecurity/role.go` `CanImpersonate` — true for controller and admin only. This is
+* the admin gate for the "open another user's root" feature and is intentionally stricter
+* than {@link canGrantToEveryone}, which also returns true for a regular user (a normal user
+* may share their own projects, but must never be offered impersonation). `null` (no-auth
+* mode) returns false.
+*/
+function canImpersonate(role) {
+	switch (role) {
+		case Role.CONTROLLER:
+		case Role.ADMIN: return true;
+		default: return false;
+	}
+}
 /** Dynamic field on SharingState, one per handled share, keyed by shareId. */
 const decisionField = (shareId) => `decision/${shareId}`;
 /** Dynamic field on SharedEnvelope, one per recipient who accepted or rejected, keyed
@@ -63,6 +79,6 @@ function decodeEnvelopeData(data) {
 	return JSON.parse(Buffer.from(data).toString("utf-8"));
 }
 //#endregion
-export { AcceptanceFieldPrefix, SharedEnvelopeResourceType, SharingOutboxField, SharingOutboxResourceType, SharingStateField, SharingStateResourceType, acceptanceField, acceptanceFieldLogin, asShareId, canGrantToEveryone, decisionField, decodeEnvelopeData, isAcceptanceField, newShareId };
+export { AcceptanceFieldPrefix, SharedEnvelopeResourceType, SharingOutboxField, SharingOutboxResourceType, SharingStateField, SharingStateResourceType, acceptanceField, acceptanceFieldLogin, asShareId, canGrantToEveryone, canImpersonate, decisionField, decodeEnvelopeData, isAcceptanceField, newShareId };
 
 //# sourceMappingURL=sharing_model.js.map

package/dist/model/sharing_model.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharing_model.js","names":["RoleEnum"],"sources":["../../src/model/sharing_model.ts"],"sourcesContent":["import type { ResourceType, Role } from \"@milaboratories/pl-client\";\nimport { Role as RoleEnum } from \"@milaboratories/pl-client\";\nimport type { Branded, ProjectId } from \"@milaboratories/pl-model-common\";\nimport { randomUUID } from \"node:crypto\";\n\n/**\n * Logical identity of a share, stable across replaces. A donor-generated UUID string,\n * branded so it cannot be silently confused with a project id, a login, or a raw field\n * name. Minted once with {@link newShareId}; every other site receives it (from decoded\n * {@link EnvelopeData} or by parsing a `decision/{shareId}` field name) and threads it\n * through unchanged.\n */\nexport type ShareId = Branded<string, \"ShareId\">;\n\n/** Mints a fresh {@link ShareId}. The single place a share's logical identity is created. */\nexport function newShareId(): ShareId {\n  return randomUUID() as ShareId;\n}\n\n/** Brands a string already known to be a share id (e.g. parsed from a `decision/{shareId}`\n *  field name) as a {@link ShareId}, without minting a new one. */\nexport function asShareId(id: string): ShareId {\n  return id as ShareId;\n}\n\n//\n// Pl Model — Project Sharing\n//\n// All sharing structures are defined and managed by the middle layer; the\n// backend knows nothing about envelopes.\n//\n\n/** Field on the donor's clientRoot holding the {@link SharingOutboxResourceType} resource. */\nexport const SharingOutboxField = \"sharingOutbox\";\n/** Field on the acceptor's clientRoot holding the {@link SharingStateResourceType} resource. */\nexport const SharingStateField = \"sharingState\";\n\nexport const SharingOutboxResourceType: ResourceType = { name: \"SharingOutbox\", version: \"1\" };\nexport const SharedEnvelopeResourceType: ResourceType = { name: \"SharedEnvelope\", version: \"1\" };\nexport const SharingStateResourceType: ResourceType = { name: \"SharingState\", version: \"1\" };\n\nexport type EnvelopeMode = \"copy\" | \"read-only\" | \"collaboration\";\n\n/** Per-project decision on change, matching the UI labels: re-snapshot the live source (\"update\"),\n *  carry the existing snapshot (\"keep\"), or drop the project from the pack (\"remove\"). */\nexport type ProjectChangeAction = \"keep\" | \"update\" | \"remove\";\n\n/** Key of the per-project envelope maps: a uuid minted per snapshot to name the `project/{uuid}`\n *  field. Distinct from {@link ProjectId} — re-snapshotting one source yields a new uuid each time. */\nexport type ProjectFieldUuid = Branded<string, \"ProjectFieldUuid\">;\n\n/**\n * Whether a role may make a resource public (grant to everyone): true for controller,\n * admin, and user; false for workflow and unspecified. The middle layer carries no policy\n * of its own here — a crafted call still hits the backend's role + permission-ceiling gate.\n * `null` (no-auth mode) returns false.\n */\nexport function canGrantToEveryone(role: Role | null): boolean {\n  switch (role) {\n    case RoleEnum.CONTROLLER:\n    case RoleEnum.ADMIN:\n    case RoleEnum.USER:\n      return true;\n    default:\n      return false;\n  }\n}\n\n/** One project's snapshot inside an envelope, keyed by {@link ProjectFieldUuid} in {@link EnvelopeData.projects}. */\nexport interface EnvelopeProject {\n  label: string; // carried so the pending-share UI renders without traversing into the project\n  source: ProjectId; // donor's source projectId; supersedes a prior share and matches the snapshot to its live source on change\n  updatedAt: number; // ms epoch of the last (re)snapshot\n}\n\n/** Immutable `data` on a SharedEnvelope, set at createEphemeral, never mutated. */\nexport interface EnvelopeData {\n  schemaVersion: 1;\n  shareId: ShareId; // donor-generated UUID; logical share identity, stable across changes\n  sharedAt: number; // ms epoch; this instance's creation time — distinguishes instances of one shareId\n  expiresAt: number | null; // ms epoch; sharedAt + ttl (default 14 days) for a targeted share; null for share-with-everybody (never expires)\n  mode: EnvelopeMode; // what the acceptor's app should do with the contents\n  sender: string; // donor login (informational; backend granted_by is authoritative)\n  title: string; // display name shown to recipients; defaults to the first project's name\n  projects: Record<ProjectFieldUuid, EnvelopeProject>; // contained projects, keyed by project field uuid\n}\n\n/** Dynamic field on SharingState, one per handled share, keyed by shareId. */\nexport const decisionField = (shareId: ShareId) => `decision/${shareId}`;\n\nexport interface SharingDecision {\n  decision: \"accepted\" | \"rejected\";\n  timestamp: number; // ms epoch — when the acceptor acted\n  envelopeSharedAt: number; // the acted-on envelope instance's sharedAt — pins which instance was handled (paired with the shareId key; the resource id is never stored)\n  acceptedProjects: string[]; // ids of the projects created in the acceptor's list ([] for a rejected share)\n}\n\n/** Dynamic field on SharedEnvelope, one per recipient who accepted or rejected, keyed\n *  by recipient login. Written by the acceptor in read-write shares only (Copy & Share,\n *  Live collaboration) — the acceptor's writable envelope grant is what permits the\n *  write; read-only shares omit it. The donor reads these from its own outbox to see\n *  who responded and when. Informational, not authoritative (a writable grant holder\n *  could write under another login — same trust assumption as the sender field).\n *  Copied forward when a share is changed. */\nexport const AcceptanceFieldPrefix = \"acceptance/\";\nexport const acceptanceField = (login: string) => `${AcceptanceFieldPrefix}${login}`;\nexport const isAcceptanceField = (name: string) => name.startsWith(AcceptanceFieldPrefix);\nexport const acceptanceFieldLogin = (name: string) => name.slice(AcceptanceFieldPrefix.length);\n\nexport interface EnvelopeAcceptance {\n  action: \"accepted\" | \"rejected\";\n  timestamp: number; // ms since epoch\n}\n\n/**\n * Single owner of the raw-data → {@link EnvelopeData} decode. The envelope's immutable `data`\n * blob is UTF-8 JSON set once at createEphemeral; every site that reads it from a raw resource\n * `data` byte buffer (the basic-resource read path) goes through here. The reactive tree-node\n * path uses `node.getDataAsJson<EnvelopeData>()`, which decodes the same JSON.\n */\nexport function decodeEnvelopeData(data: Uint8Array): EnvelopeData {\n  return JSON.parse(Buffer.from(data).toString(\"utf-8\")) as EnvelopeData;\n}\n\n/**\n * Options for {@link MiddleLayer.shareProjects}.\n *\n * Recipients XOR everyone — two clean variants, not one struct with mutually exclusive\n * optional fields. The everyone variant issues a single make-public grant (the envelope's\n * `expiresAt` is set to `null`, so it never expires); the recipients variant grants each\n * named recipient and the envelope expires after the default TTL.\n */\nexport type ShareProjectsOptions =\n  | {\n      recipients: string[]; // recipient logins\n      title: string; // display name shown to recipients; defaults to the first project's name\n      mode: EnvelopeMode; // v1 UI always sends \"copy\"\n    }\n  | {\n      everyone: true; // share with all users on the server\n      /**\n       * When true and an everyone-share of the same project already exists, refresh it under its\n       * stable shareId (recipients who already accepted or rejected are not re-prompted) instead of\n       * minting a new share. No-op when no prior everyone-share of the project exists. Callers that\n       * don't care pass `false`.\n       */\n      replace: boolean;\n      title: string;\n      mode: EnvelopeMode;\n    };\n"],"mappings":";;;;AAeA,SAAgB,aAAsB;CACpC,OAAO,WAAW;AACpB;;;AAIA,SAAgB,UAAU,IAAqB;CAC7C,OAAO;AACT;;AAUA,MAAa,qBAAqB;;AAElC,MAAa,oBAAoB;AAEjC,MAAa,4BAA0C;CAAE,MAAM;CAAiB,SAAS;AAAI;AAC7F,MAAa,6BAA2C;CAAE,MAAM;CAAkB,SAAS;AAAI;AAC/F,MAAa,2BAAyC;CAAE,MAAM;CAAgB,SAAS;AAAI;;;;;;;AAkB3F,SAAgB,mBAAmB,MAA4B;CAC7D,QAAQ,MAAR;EACE,KAAKA,KAAS;EACd,KAAKA,KAAS;EACd,KAAKA,KAAS,MACZ,OAAO;EACT,SACE,OAAO;CACX;AACF;;AAsBA,MAAa,iBAAiB,YAAqB,YAAY;;;;;;;;AAgB/D,MAAa,wBAAwB;AACrC,MAAa,mBAAmB,UAAkB,GAAG,wBAAwB;AAC7E,MAAa,qBAAqB,SAAiB,KAAK,WAAW,qBAAqB;AACxF,MAAa,wBAAwB,SAAiB,KAAK,MAAM,EAA4B;;;;;;;AAa7F,SAAgB,mBAAmB,MAAgC;CACjE,OAAO,KAAK,MAAM,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC;AACvD"}
+{"version":3,"file":"sharing_model.js","names":["RoleEnum"],"sources":["../../src/model/sharing_model.ts"],"sourcesContent":["import type { ResourceType, Role } from \"@milaboratories/pl-client\";\nimport { Role as RoleEnum } from \"@milaboratories/pl-client\";\nimport type { Branded, ProjectId } from \"@milaboratories/pl-model-common\";\nimport { randomUUID } from \"node:crypto\";\n\n/**\n * Logical identity of a share, stable across replaces. A donor-generated UUID string,\n * branded so it cannot be silently confused with a project id, a login, or a raw field\n * name. Minted once with {@link newShareId}; every other site receives it (from decoded\n * {@link EnvelopeData} or by parsing a `decision/{shareId}` field name) and threads it\n * through unchanged.\n */\nexport type ShareId = Branded<string, \"ShareId\">;\n\n/** Mints a fresh {@link ShareId}. The single place a share's logical identity is created. */\nexport function newShareId(): ShareId {\n  return randomUUID() as ShareId;\n}\n\n/** Brands a string already known to be a share id (e.g. parsed from a `decision/{shareId}`\n *  field name) as a {@link ShareId}, without minting a new one. */\nexport function asShareId(id: string): ShareId {\n  return id as ShareId;\n}\n\n//\n// Pl Model — Project Sharing\n//\n// All sharing structures are defined and managed by the middle layer; the\n// backend knows nothing about envelopes.\n//\n\n/** Field on the donor's clientRoot holding the {@link SharingOutboxResourceType} resource. */\nexport const SharingOutboxField = \"sharingOutbox\";\n/** Field on the acceptor's clientRoot holding the {@link SharingStateResourceType} resource. */\nexport const SharingStateField = \"sharingState\";\n\nexport const SharingOutboxResourceType: ResourceType = { name: \"SharingOutbox\", version: \"1\" };\nexport const SharedEnvelopeResourceType: ResourceType = { name: \"SharedEnvelope\", version: \"1\" };\nexport const SharingStateResourceType: ResourceType = { name: \"SharingState\", version: \"1\" };\n\nexport type EnvelopeMode = \"copy\" | \"read-only\" | \"collaboration\";\n\n/** Per-project decision on change, matching the UI labels: re-snapshot the live source (\"update\"),\n *  carry the existing snapshot (\"keep\"), or drop the project from the pack (\"remove\"). */\nexport type ProjectChangeAction = \"keep\" | \"update\" | \"remove\";\n\n/** Key of the per-project envelope maps: a uuid minted per snapshot to name the `project/{uuid}`\n *  field. Distinct from {@link ProjectId} — re-snapshotting one source yields a new uuid each time. */\nexport type ProjectFieldUuid = Branded<string, \"ProjectFieldUuid\">;\n\n/**\n * Whether a role may make a resource public (grant to everyone): true for controller,\n * admin, and user; false for workflow and unspecified. The middle layer carries no policy\n * of its own here — a crafted call still hits the backend's role + permission-ceiling gate.\n * `null` (no-auth mode) returns false.\n */\nexport function canGrantToEveryone(role: Role | null): boolean {\n  switch (role) {\n    case RoleEnum.CONTROLLER:\n    case RoleEnum.ADMIN:\n    case RoleEnum.USER:\n      return true;\n    default:\n      return false;\n  }\n}\n\n/**\n * Whether a role may impersonate another user: open/create another user's root and list\n * the resources that user can access. Mirrors the backend's authorization rule\n * `util/misecurity/role.go` `CanImpersonate` — true for controller and admin only. This is\n * the admin gate for the \"open another user's root\" feature and is intentionally stricter\n * than {@link canGrantToEveryone}, which also returns true for a regular user (a normal user\n * may share their own projects, but must never be offered impersonation). `null` (no-auth\n * mode) returns false.\n */\nexport function canImpersonate(role: Role | null): boolean {\n  switch (role) {\n    case RoleEnum.CONTROLLER:\n    case RoleEnum.ADMIN:\n      return true;\n    default:\n      return false;\n  }\n}\n\n/** One project's snapshot inside an envelope, keyed by {@link ProjectFieldUuid} in {@link EnvelopeData.projects}. */\nexport interface EnvelopeProject {\n  label: string; // carried so the pending-share UI renders without traversing into the project\n  source: ProjectId; // donor's source projectId; supersedes a prior share and matches the snapshot to its live source on change\n  updatedAt: number; // ms epoch of the last (re)snapshot\n}\n\n/** Immutable `data` on a SharedEnvelope, set at createEphemeral, never mutated. */\nexport interface EnvelopeData {\n  schemaVersion: 1;\n  shareId: ShareId; // donor-generated UUID; logical share identity, stable across changes\n  sharedAt: number; // ms epoch; this instance's creation time — distinguishes instances of one shareId\n  expiresAt: number | null; // ms epoch; sharedAt + ttl (default 14 days) for a targeted share; null for share-with-everybody (never expires)\n  mode: EnvelopeMode; // what the acceptor's app should do with the contents\n  sender: string; // donor login (informational; backend granted_by is authoritative)\n  title: string; // display name shown to recipients; defaults to the first project's name\n  projects: Record<ProjectFieldUuid, EnvelopeProject>; // contained projects, keyed by project field uuid\n}\n\n/** Dynamic field on SharingState, one per handled share, keyed by shareId. */\nexport const decisionField = (shareId: ShareId) => `decision/${shareId}`;\n\nexport interface SharingDecision {\n  decision: \"accepted\" | \"rejected\";\n  timestamp: number; // ms epoch — when the acceptor acted\n  envelopeSharedAt: number; // the acted-on envelope instance's sharedAt — pins which instance was handled (paired with the shareId key; the resource id is never stored)\n  acceptedProjects: string[]; // ids of the projects created in the acceptor's list ([] for a rejected share)\n}\n\n/** Dynamic field on SharedEnvelope, one per recipient who accepted or rejected, keyed\n *  by recipient login. Written by the acceptor in read-write shares only (Copy & Share,\n *  Live collaboration) — the acceptor's writable envelope grant is what permits the\n *  write; read-only shares omit it. The donor reads these from its own outbox to see\n *  who responded and when. Informational, not authoritative (a writable grant holder\n *  could write under another login — same trust assumption as the sender field).\n *  Copied forward when a share is changed. */\nexport const AcceptanceFieldPrefix = \"acceptance/\";\nexport const acceptanceField = (login: string) => `${AcceptanceFieldPrefix}${login}`;\nexport const isAcceptanceField = (name: string) => name.startsWith(AcceptanceFieldPrefix);\nexport const acceptanceFieldLogin = (name: string) => name.slice(AcceptanceFieldPrefix.length);\n\nexport interface EnvelopeAcceptance {\n  action: \"accepted\" | \"rejected\";\n  timestamp: number; // ms since epoch\n}\n\n/**\n * Single owner of the raw-data → {@link EnvelopeData} decode. The envelope's immutable `data`\n * blob is UTF-8 JSON set once at createEphemeral; every site that reads it from a raw resource\n * `data` byte buffer (the basic-resource read path) goes through here. The reactive tree-node\n * path uses `node.getDataAsJson<EnvelopeData>()`, which decodes the same JSON.\n */\nexport function decodeEnvelopeData(data: Uint8Array): EnvelopeData {\n  return JSON.parse(Buffer.from(data).toString(\"utf-8\")) as EnvelopeData;\n}\n\n/**\n * Options for {@link MiddleLayer.shareProjects}.\n *\n * Recipients XOR everyone — two clean variants, not one struct with mutually exclusive\n * optional fields. The everyone variant issues a single make-public grant (the envelope's\n * `expiresAt` is set to `null`, so it never expires); the recipients variant grants each\n * named recipient and the envelope expires after the default TTL.\n */\nexport type ShareProjectsOptions =\n  | {\n      recipients: string[]; // recipient logins\n      title: string; // display name shown to recipients; defaults to the first project's name\n      mode: EnvelopeMode; // v1 UI always sends \"copy\"\n    }\n  | {\n      everyone: true; // share with all users on the server\n      /**\n       * When true and an everyone-share of the same project already exists, refresh it under its\n       * stable shareId (recipients who already accepted or rejected are not re-prompted) instead of\n       * minting a new share. No-op when no prior everyone-share of the project exists. Callers that\n       * don't care pass `false`.\n       */\n      replace: boolean;\n      title: string;\n      mode: EnvelopeMode;\n    };\n"],"mappings":";;;;AAeA,SAAgB,aAAsB;CACpC,OAAO,WAAW;AACpB;;;AAIA,SAAgB,UAAU,IAAqB;CAC7C,OAAO;AACT;;AAUA,MAAa,qBAAqB;;AAElC,MAAa,oBAAoB;AAEjC,MAAa,4BAA0C;CAAE,MAAM;CAAiB,SAAS;AAAI;AAC7F,MAAa,6BAA2C;CAAE,MAAM;CAAkB,SAAS;AAAI;AAC/F,MAAa,2BAAyC;CAAE,MAAM;CAAgB,SAAS;AAAI;;;;;;;AAkB3F,SAAgB,mBAAmB,MAA4B;CAC7D,QAAQ,MAAR;EACE,KAAKA,KAAS;EACd,KAAKA,KAAS;EACd,KAAKA,KAAS,MACZ,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;;;;;AAWA,SAAgB,eAAe,MAA4B;CACzD,QAAQ,MAAR;EACE,KAAKA,KAAS;EACd,KAAKA,KAAS,OACZ,OAAO;EACT,SACE,OAAO;CACX;AACF;;AAsBA,MAAa,iBAAiB,YAAqB,YAAY;;;;;;;;AAgB/D,MAAa,wBAAwB;AACrC,MAAa,mBAAmB,UAAkB,GAAG,wBAAwB;AAC7E,MAAa,qBAAqB,SAAiB,KAAK,WAAW,qBAAqB;AACxF,MAAa,wBAAwB,SAAiB,KAAK,MAAM,EAA4B;;;;;;;AAa7F,SAAgB,mBAAmB,MAAgC;CACjE,OAAO,KAAK,MAAM,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC;AACvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milaboratories/pl-middle-layer",
-  "version": "1.64.42",
+  "version": "1.65.1",
   "description": "Pl Middle Layer",
   "keywords": [],
   "license": "UNLICENSED",
@@ -32,22 +32,22 @@
     "yaml": "^2.8.0",
     "zod": "~3.25.76",
     "@milaboratories/computable": "2.9.5",
+    "@milaboratories/helpers": "1.14.2",
     "@milaboratories/pf-driver": "1.7.15",
-    "@milaboratories/pl-client": "3.12.1",
+    "@milaboratories/pl-client": "3.13.1",
     "@milaboratories/pl-deployments": "3.0.9",
-    "@milaboratories/helpers": "1.14.2",
     "@milaboratories/pf-spec-driver": "1.4.17",
-    "@milaboratories/pl-errors": "1.4.25",
-    "@milaboratories/pl-drivers": "1.16.4",
+    "@milaboratories/pl-drivers": "1.16.6",
+    "@milaboratories/pl-errors": "1.4.27",
     "@milaboratories/pl-http": "1.2.4",
-    "@milaboratories/pl-model-middle-layer": "1.30.10",
-    "@milaboratories/pl-model-backend": "1.4.10",
+    "@milaboratories/pl-model-backend": "1.4.12",
     "@milaboratories/pl-model-common": "1.46.3",
-    "@milaboratories/pl-tree": "1.12.15",
-    "@platforma-sdk/block-tools": "2.11.7",
+    "@milaboratories/pl-model-middle-layer": "1.30.10",
     "@milaboratories/resolve-helper": "1.1.3",
-    "@platforma-sdk/model": "1.79.24",
+    "@milaboratories/pl-tree": "1.12.17",
     "@milaboratories/ts-helpers": "1.8.3",
+    "@platforma-sdk/block-tools": "2.11.9",
+    "@platforma-sdk/model": "1.79.24",
     "@platforma-sdk/workflow-tengo": "6.6.5"
   },
   "devDependencies": {

package/src/middle_layer/middle_layer.ts

@@ -14,7 +14,12 @@ import {
   resourceIdToString,
 } from "@milaboratories/pl-client";
 import { LRUCache } from "lru-cache";
-import { createProjectList, ProjectsField, ProjectsResourceType } from "./project_list";
+import {
+  createProjectList,
+  ensureProjectListRid,
+  ProjectsField,
+  ProjectsResourceType,
+} from "./project_list";
 import { createProject, duplicateProject, withProjectAuthored } from "../mutator/project";
 import { ProjectMetaKey } from "../model/project_model";
 import type { ProjectId } from "../model/project_model";
@@ -22,6 +27,7 @@ import type { SynchronizedTreeState } from "@milaboratories/pl-tree";
 import {
   acceptanceFieldLogin,
   canGrantToEveryone,
+  canImpersonate,
   decodeEnvelopeData,
   isAcceptanceField,
   SharingOutboxField,
@@ -186,7 +192,15 @@ export class MiddleLayer {
    * additional required capabilities later without a UI change.
    */
   public get sharingSupported(): boolean {
-    return this.serverCapabilities.includes("crossTreeRefs:v1");
+    // Sharing does not compose with impersonation (discovery is scoped to the admin's session,
+    // decisions attribute to the admin), so it is disabled while impersonating. Admins move
+    // projects across roots with duplicateProjectToUser instead.
+    return this.serverCapabilities.includes("crossTreeRefs:v1") && !this.impersonating;
+  }
+
+  /** True when this session is impersonating another user (an admin opened another user's root). */
+  public get impersonating(): boolean {
+    return this.pl.conf.asUser !== undefined;
   }
 
   /**
@@ -205,11 +219,23 @@ export class MiddleLayer {
    */
   public get canShareWithEveryone(): boolean {
     return (
+      !this.impersonating &&
       this.serverCapabilities.includes("publicGrants:v1") &&
       canGrantToEveryone(this.currentUserRole)
     );
   }
 
+  /**
+   * Whether the authenticated user may impersonate others (open another user's root). Mirrors
+   * the backend's `CanImpersonate` role gate — admin/controller only, never a regular user.
+   * Derived from the session role, which stays the authenticated admin's even while
+   * impersonating, so this stays true across a switch: the "return to my root" affordance must
+   * not vanish mid-impersonation. Not a security boundary; the backend re-checks on every call.
+   */
+  public get currentUserCanImpersonate(): boolean {
+    return canImpersonate(this.currentUserRole);
+  }
+
   /** Adds a runtime capability to the middle layer. */
   public addRuntimeCapability(
     requirement: SupportedRequirement,
@@ -369,6 +395,50 @@ export class MiddleLayer {
     return newProjectId;
   }
 
+  /**
+   * Duplicates a project into another user's root, minted in the TARGET user's color so the target
+   * owns it. Sibling of {@link duplicateProject}, but writes into a different root. The source
+   * project (on the current client root) is referenced cross-color for its block data, kept alive
+   * by refcounting, exactly like accepting a shared project. Works both ways: pull (while
+   * impersonating a user, copy their project to yourself) and push (from your own root, copy a
+   * project to a user). Admin cross-root op; requires the crossTreeRefs:v1 backend capability.
+   */
+  public async duplicateProjectToUser(
+    srcProjectId: ProjectId,
+    targetLogin: string,
+    rename?: (previousLabel: string, existingLabels: string[]) => string,
+  ): Promise<void> {
+    if (!this.serverCapabilities.includes("crossTreeRefs:v1"))
+      throw new Error("duplicateProjectToUser requires the crossTreeRefs:v1 backend capability.");
+
+    const sourceRid = await this.resolveProjectId(srcProjectId);
+    const targetRoot = await this.pl.getUserRoot({ login: targetLogin, createIfNotExists: true });
+
+    // Run on the target root: the tx default color is the target's, so the new project (and the
+    // target's project list, if created here) are minted in the target's color.
+    await this.pl.withWriteTxOnRoot(targetRoot, "MLDuplicateProjectToUser", async (tx) => {
+      // Resolve or lazily create the target root's project list (tx.clientRoot === targetRoot).
+      const targetProjectListRid = await ensureProjectListRid(tx);
+
+      // Source label + the target's existing labels, for collision-aware renaming.
+      const sourceMeta = await tx.getKValueJson<ProjectMeta>(sourceRid, ProjectMetaKey);
+      const targetListData = await tx.getResourceData(targetProjectListRid, true);
+      const existingLabels = (
+        await Promise.all(
+          targetListData.fields
+            .map((f) => f.value)
+            .filter(isNotNullSignedResourceId)
+            .map((rid) => tx.getKValueJson<ProjectMeta>(rid, ProjectMetaKey)),
+        )
+      ).map((m) => m.label);
+      const newLabel = rename ? rename(sourceMeta.label, existingLabels) : sourceMeta.label;
+
+      const newPrj = await duplicateProject(tx, sourceRid, { label: newLabel });
+      tx.createField(field(targetProjectListRid, randomUUID()), "Dynamic", newPrj);
+      await tx.commit();
+    });
+  }
+
   //
   // Project Sharing (Copy & Share)
   //

package/src/middle_layer/project_list.ts

@@ -1,7 +1,19 @@
 import type { PruningFunction } from "@milaboratories/pl-tree";
 import { SynchronizedTreeState } from "@milaboratories/pl-tree";
-import type { Filter, PlClient, ResourceType, SignedResourceId } from "@milaboratories/pl-client";
-import { resourceIdToString, resourceTypesEqual, treeFilter } from "@milaboratories/pl-client";
+import type {
+  Filter,
+  PlClient,
+  PlTransaction,
+  ResourceType,
+  SignedResourceId,
+} from "@milaboratories/pl-client";
+import {
+  field,
+  isNullSignedResourceId,
+  resourceIdToString,
+  resourceTypesEqual,
+  treeFilter,
+} from "@milaboratories/pl-client";
 import type { TreeAndComputableU } from "./types";
 import type { WatchableValue } from "@milaboratories/computable";
 import { Computable } from "@milaboratories/computable";
@@ -18,6 +30,25 @@ import type { ProjectMeta } from "@milaboratories/pl-model-middle-layer";
 export const ProjectsField = "projects";
 export const ProjectsResourceType: ResourceType = { name: "Projects", version: "1" };
 
+/**
+ * Resolves the projects-list resource on the transaction's client root, lazily creating (and
+ * locking) an empty one when the {@link ProjectsField} is not yet populated. Returns its signed
+ * id. Used when writing into a root that may have no projects list yet, e.g. copying a project
+ * into another user's root during admin impersonation.
+ */
+export async function ensureProjectListRid(tx: PlTransaction): Promise<SignedResourceId> {
+  const projectsField = field(tx.clientRoot, ProjectsField);
+  tx.createField(projectsField, "Dynamic");
+  const fData = await tx.getField(projectsField);
+  if (isNullSignedResourceId(fData.value)) {
+    const ref = tx.createEphemeral(ProjectsResourceType);
+    tx.lock(ref);
+    tx.setField(projectsField, ref);
+    return await ref.globalId;
+  }
+  return fData.value;
+}
+
 export const ProjectsListTreePruningFunction: PruningFunction = (resource) => {
   if (!resourceTypesEqual(resource.type, ProjectsResourceType)) return [];
   return resource.fields;

package/src/model/sharing_model.test.ts

@@ -0,0 +1,22 @@
+import { test, expect } from "vitest";
+import { Role } from "@milaboratories/pl-client";
+import { canGrantToEveryone, canImpersonate } from "./sharing_model";
+
+// canImpersonate is the admin gate for "open another user's root". It must be strictly
+// stricter than canGrantToEveryone: a regular USER may share their own projects but must
+// never be offered impersonation. Reusing the sharing predicate here let a regular user
+// see the admin menu item (MILAB-6484 regression), so this asymmetry is pinned.
+
+test("canImpersonate: admin and controller only", () => {
+  expect(canImpersonate(Role.ADMIN)).toBe(true);
+  expect(canImpersonate(Role.CONTROLLER)).toBe(true);
+  expect(canImpersonate(Role.USER)).toBe(false);
+  expect(canImpersonate(Role.WORKFLOW)).toBe(false);
+  expect(canImpersonate(Role.UNSPECIFIED)).toBe(false);
+  expect(canImpersonate(null)).toBe(false);
+});
+
+test("canGrantToEveryone includes USER but canImpersonate does not", () => {
+  expect(canGrantToEveryone(Role.USER)).toBe(true);
+  expect(canImpersonate(Role.USER)).toBe(false);
+});

package/src/model/sharing_model.ts

@@ -66,6 +66,25 @@ export function canGrantToEveryone(role: Role | null): boolean {
   }
 }
 
+/**
+ * Whether a role may impersonate another user: open/create another user's root and list
+ * the resources that user can access. Mirrors the backend's authorization rule
+ * `util/misecurity/role.go` `CanImpersonate` — true for controller and admin only. This is
+ * the admin gate for the "open another user's root" feature and is intentionally stricter
+ * than {@link canGrantToEveryone}, which also returns true for a regular user (a normal user
+ * may share their own projects, but must never be offered impersonation). `null` (no-auth
+ * mode) returns false.
+ */
+export function canImpersonate(role: Role | null): boolean {
+  switch (role) {
+    case RoleEnum.CONTROLLER:
+    case RoleEnum.ADMIN:
+      return true;
+    default:
+      return false;
+  }
+}
+
 /** One project's snapshot inside an envelope, keyed by {@link ProjectFieldUuid} in {@link EnvelopeData.projects}. */
 export interface EnvelopeProject {
   label: string; // carried so the pending-share UI renders without traversing into the project