Don't force password change while admin is impersonating

The mustChangePassword guard redirected an impersonating admin to
/change-password, which sits outside the student layout (no
return-to-admin banner) — a dead end. Skip the guard when impersonating,
and add the stop-impersonate banner to the change-password page as a
fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/(student)/layout.tsx

@@ -11,12 +11,16 @@ export default async function StudentLayout({ children }: { children: React.Reac
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
-  // Force password change for auto-provisioned buyers (temp password)
+  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
+
+  // Force password change for auto-provisioned buyers (temp password).
+  // Skip while an admin is impersonating — they only view the client's cabinet;
+  // the client sets their own password on a real first login.
   const dbUser = await prisma.user.findUnique({
     where: { id: session.user.id },
     select: { mustChangePassword: true },
   });
-  if (dbUser?.mustChangePassword) redirect("/change-password");
+  if (dbUser?.mustChangePassword && !isImpersonating) redirect("/change-password");
 
   // Maintenance mode: non-admin users see the maintenance page
   if (session.user.role !== "admin") {
@@ -35,8 +39,6 @@ export default async function StudentLayout({ children }: { children: React.Reac
       getSetting("orgRequisites"),
     ]);
 
-  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
-
   return (
     <div className="min-h-screen flex flex-col" style={{ backgroundColor: "var(--background)" }}>
       {isImpersonating && <StopImpersonateBanner userName={session.user.name} />}

src/app/change-password/page.tsx

@@ -2,24 +2,30 @@ import { headers } from "next/headers";
 import { auth } from "@/lib/auth";
 import { redirect } from "next/navigation";
 import { ForceChangeForm } from "./force-change-form";
+import { StopImpersonateBanner } from "@/components/admin/stop-impersonate-banner";
 
 export default async function ChangePasswordPage() {
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
+  const isImpersonating = !!(session.session as { impersonatedBy?: string }).impersonatedBy;
+
   return (
     <div
-      className="min-h-screen flex items-center justify-center p-4"
+      className="min-h-screen flex flex-col"
       style={{ backgroundColor: "var(--background)" }}
     >
-      <div className="w-full max-w-sm">
+      {isImpersonating && <StopImpersonateBanner userName={session.user.name} />}
-        <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
+      <div className="flex-1 flex items-center justify-center p-4">
-          Задайте свой пароль
+        <div className="w-full max-w-sm">
-        </h1>
+          <h1 className="text-xl font-bold mb-2" style={{ color: "var(--foreground)" }}>
-        <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
+            Задайте свой пароль
-          Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
+          </h1>
-        </p>
+          <p className="text-sm mb-6" style={{ color: "var(--muted-foreground)" }}>
-        <ForceChangeForm />
+            Вы вошли с временным паролем. Перед началом работы задайте постоянный — это займёт минуту.
+          </p>
+          <ForceChangeForm />
+        </div>
       </div>
     </div>
   );