fix(impersonation): prevent CF auth loop and add target user CF token

[lewisojile]

Summary

Fixes an auth redirect loop that occurred when an admin impersonated a user and navigated to /crowdfunding pages. The error presented was:

{"error": "Authentication required to access this resource", "code": "AUTHENTICATION_REQUIRED"}

Root Causes (three simultaneous)

1. SSR redirect triggered before Angular booted — the catch-all handler called the CF auth-code redirect on every /crowdfunding page load during impersonation, before Angular had a chance to render anything.
2. Admin's CF token loaded under impersonation — extractCrowdfundingToken loaded the real (admin's) CF token into the impersonation session, returning the wrong user's data or triggering a confusing upstream 401.
3. 401 CF_UNAUTHENTICATED triggered Angular redirect loop — cfFetch returned 401 CF_UNAUTHENTICATED which is the exact condition the Angular handleCfError handler uses to call redirectToCfAuth(), creating a loop.

Fix

Phase 1 (no Auth0 changes required — ships immediately):

• Guard the SSR CF auth-code redirect with !isImpersonating
• Return 503 CF_UNAVAILABLE_DURING_IMPERSONATION from cfFetch/cfFetchNullable when no CF token is available during impersonation — Angular's handleCfError falls through to of(fallback) (empty state) instead of redirecting
• extractCrowdfundingToken returns early during impersonation, never loading the admin's CF token

Phase 2 (best-effort — shows target user's real CF data when Auth0 is configured):

• During startImpersonation, attempt a second audience-scoped CTE for CROWDFUNDING_API_AUDIENCE using the same NATS subject
• If Auth0 is configured to allow cross-audience exchange, the target user's CF token is stored in the session (impersonationCrowdfundingToken / impersonationCrowdfundingExpiresAt)
• If Auth0 returns access_denied (not yet configured), the try/catch logs a warning, impersonation still starts, and CF shows empty state (Phase 1 fallback)

Auth Service Dependency

The Phase 2 CTE requires lfx-v2-auth-service to accept an optional audience field on lfx.auth-service.impersonation.token_exchange. That change has been implemented in a separate PR in that repo. If the auth service is deployed without that change, the CF CTE NATS call will still succeed (the auth service silently ignores unknown fields) but will issue a primary LFX V2 token scoped to the wrong audience — the token will be rejected by the CF API and the BFF will fall through to Phase 1 empty state. No breakage.

Auth0 Tenant Configuration (for Phase 2 to show live CF data)

See cf-impersonation-solution.md §9 for the two Auth0 tenant changes needed:

1. Authorize AUTH0_M2M_CLIENT_ID for the CF API with scopes openid profile access:me offline_access
2. Add a CF audience branch to the CTE Action

Testing

• Admin impersonates user → navigates to /crowdfunding → no redirect loop, no console auth errors
• CF sections show empty state (Phase 1) or target user's CF data (Phase 2)
• Admin stops impersonation → own CF data returns normally
• Non-impersonating user with no CF token still gets redirected to CF auth (no regression)

Related

• JIRA: LFXV2-2367
• Auth service PR: (link once open)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 88046f09-57e2-4cd8-a53c-c0d4921a9c7e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/LFXV2-2367

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Fixes an admin impersonation edge case on /crowdfunding routes by preventing SSR from initiating the Crowdfunding auth-code redirect during impersonation, avoiding loading the admin’s CF token into an impersonated session, and (optionally) fetching/storing a target-user CF token via an audience-scoped CTE at impersonation start.

Changes:

• Skip the SSR crowdfunding auth-code redirect while impersonating, preventing redirect loops before Angular bootstraps.
• Ensure impersonation never reuses the admin’s CF token; optionally store a target-user CF token via audience-scoped CTE when available.
• Return a distinct CF “unavailable during impersonation” error when no CF token is available, allowing the client to fall back to empty-state instead of redirecting.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
apps/lfx-one/src/types/express.d.ts	Adds session typings for storing impersonated user’s CF token + expiry.
apps/lfx-one/src/server/utils/auth-helper.ts	Clears impersonation CF token fields when stopping impersonation.
apps/lfx-one/src/server/services/impersonation.service.ts	Adds optional audience to CTE exchange and stores a CF-audience token in the impersonation session when obtained.
apps/lfx-one/src/server/services/crowdfunding.service.ts	Adds impersonation-aware behavior when CF token is missing (prevent CF auth redirect loop).
apps/lfx-one/src/server/server.ts	Skips SSR CF auth redirect during impersonation to prevent loops.
apps/lfx-one/src/server/middleware/auth.middleware.ts	Loads impersonation CF token onto req.crowdfundingToken and avoids loading admin’s CF token while impersonating.
apps/lfx-one/src/server/controllers/impersonation.controller.ts	Best-effort CF-audience CTE during impersonation start; stores token if available.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.