From 2ea9c6fda006afa73e12ee7313f0409d597afbdc Mon Sep 17 00:00:00 2001
From: dmitriylaukhin <laukhin@dementiy.com>
Date: Wed, 17 Jun 2026 11:03:58 +0500
Subject: [PATCH] Don't force password change while admin is impersonating
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mustChangePassword guard redirected an impersonating admin to
/change-password, which sits outside the student layout (no
return-to-admin banner) — a dead end. Skip the guard when impersonating,
and add the stop-impersonate banner to the change-password page as a
fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/app/(student)/layout.tsx     | 10 ++++++----
 src/app/change-password/page.tsx | 24 +++++++++++++++---------
 2 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/src/app/(student)/layout.tsx b/src/app/(student)/layout.tsx
index 69e42d5..c570fce 100644
--- a/src/app/(student)/layout.tsx
+++ b/src/app/(student)/layout.tsx
@@ -11,12 +11,16 @@ export default async function StudentLayout({ children }: { children: React.Reac
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
-  // Force password change for auto-provisioned buyers (temp password)
+  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
+
+  // Force password change for auto-provisioned buyers (temp password).
+  // Skip while an admin is impersonating — they only view the client's cabinet;
+  // the client sets their own password on a real first login.
   const dbUser = await prisma.user.findUnique({
     where: { id: session.user.id },
     select: { mustChangePassword: true },
   });
-  if (dbUser?.mustChangePassword) redirect("/change-password");
+  if (dbUser?.mustChangePassword && !isImpersonating) redirect("/change-password");
 
   // Maintenance mode: non-admin users see the maintenance page
   if (session.user.role !== "admin") {
@@ -35,8 +39,6 @@ export default async function StudentLayout({ children }: { children: React.Reac
       getSetting("orgRequisites"),
     ]);
 
-  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
-
   return (
     <div className="min-h-screen flex flex-col" style={{ backgroundColor: "var(--background)" }}>
       {isImpersonating && <StopImpersonateBanner userName={session.user.name} />}
diff --git a/src/app/change-password/page.tsx b/src/app/change-password/page.tsx
index 86357bb..0aaed00 100644
--- a/src/app/change-password/page.tsx
+++ b/src/app/change-password/page.tsx
@@ -2,24 +2,30 @@ import { headers } from "next/headers";
 import { auth } from "@/lib/auth";
 import { redirect } from "next/navigation";
 import { ForceChangeForm } from "./force-change-form";
+import { StopImpersonateBanner } from "@/components/admin/stop-impersonate-banner";
 
 export default async function ChangePasswordPage() {
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
+  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
+
   return (
     <div
-      className="min-h-screen flex items-center justify-center p-4"
+      className="min-h-screen flex flex-col"
       style={{ backgroundColor: "var(--background)" }}
     >
-      <div className="w-full max-w-sm">
-        <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
-          Задайте свой пароль
-        </h1>
-        <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
-          Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
-        </p>
-        <ForceChangeForm />
+      {isImpersonating && <StopImpersonateBanner userName={session.user.name} />}
+      <div className="flex-1 flex items-center justify-center p-4">
+        <div className="w-full max-w-sm">
+          <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
+            Задайте свой пароль
+          </h1>
+          <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
+            Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
+          </p>
+          <ForceChangeForm />
+        </div>
       </div>
     </div>
   );