[XTR] Login as User 1.0.4

[XTR] Login as User
Enterprise-Grade Account Management for XenForo

---

What Is This Add-on?

[XTR] Login as User is a professional account management add-on that allows authorized XenForo administrators and moderators to temporarily access a member's account for support, debugging, or technical review — in a fully secure, auditable, and controlled manner.

Unlike basic alternatives available in the community, this add-on treats account impersonation not merely as a convenience feature, but as a governed administrative process — with layered security filters, complete lifecycle audit logging, CSRF protection, and ecosystem-wide guards.

---

Why [XTR] Login as User?

Various free add-ons exist that claim to provide this functionality. However, the vast majority of them suffer from critical architectural security gaps:

---

Security Architecture

1. Three-Tier Permission Hierarchy
Far beyond a single "can use this feature" permission, the add-on implements a complete role hierarchy. Each level is independently assignable:

• Regular Members: xentr_login_regular permission
• Moderator Accounts: xentr_login_moderator permission
• Administrator Accounts: xentr_login_admin permission (operator must also be an admin)
• Super Administrator: Inaccessible to anyone — code-level absolute protection

2. Password Confirmation (Sudo Mode)
Before accessing any account, the operator must verify their own password within the last 5 minutes. This protects against unattended computers and hijacked sessions.

3. Security Page Shield
While in impersonation mode, the following pages are completely locked:

• Password change (account/security)
• Email address change (account/email)
• Two-step verification management (account/two-step/*)
• Passkey management
• Connected social accounts
• Application passwords

4. Financial Action Guard
While in the target account, the following actions are automatically blocked:

• Account upgrade purchases
• XENTR Credits transfer, exchange, and purchase
• XENTR DigitalStore checkout and order processing
• DBTech eCommerce payment and cart operations

5. Full CSRF Protection
All operations including login and revert are protected by XenForo's CSRF token system.

6. Session Timeout
Configurable timeout (0–1440 minutes). If the operator forgets to revert, the system automatically returns them to their original account and updates the log record.

---

Full Audit Logging

Every session records the following information completely:


Configuration Options

---

Access Entry Points

1. Member Tooltip Card — "Login" button in the member popover card
2. Member Profile Page — In the profile header action buttons
3. Moderator Tools — "Login as User" option in the moderator dropdown menu
4. Staff Bar — Quick access link and active session badge in the staff navigation bar
5. AdminCP User Edit — Quick action in the admin panel user edit screen

---

Security Features Summary

• 3-tier permission system (regular member / moderator / administrator)
• Super Administrator absolute protection (code-level)
• Password confirmation requirement (Sudo Mode — 5-minute validity)
• Security page shield (password / email / 2FA / Passkey)
• Financial and commercial action protection
• Full CSRF protection (login and revert)
• Configurable session timeout with automatic revert
• Dynamic session context validation
• Full lifecycle audit log (start + end + reason)
• Stealth IP logging (operator IP not linked to target account)
• Stealth mode — read marker and tracking preservation
• Group and user-based access restriction
• Automatic log pruning (configurable retention period)
• Banned/locked account access attempt protection
• Login reason justification (optional or required)
• Full XenForo Phrase system compliance (multilingual)