{
  "version": "4.28.0",
  "title": "Super Admin Login As + Deep Audit",
  "focus": "Secure user impersonation for Administrator Utama / Super Admin without removing prior features",
  "audit_summary": {
    "php_files_checked": 145,
    "php_lint_errors": 0,
    "database_tables": 61,
    "foreign_keys": 111,
    "insert_statements_checked": 161,
    "update_statements_checked": 91,
    "alter_add_columns_checked": 95,
    "post_forms_checked": 154,
    "missing_local_includes": 0,
    "missing_local_php_links": 0,
    "missing_v427_files": 0,
    "missing_critical_files": 0
  },
  "login_as_security": [
    "Only effective superadmin can start impersonation",
    "Actor is revalidated in database as active superadmin before start",
    "Target must be active",
    "Target cannot be self or another superadmin",
    "Nested impersonation is blocked",
    "Start and return use POST + CSRF",
    "Session ID is regenerated at start and end",
    "Original superadmin session is isolated in impersonator_user",
    "Original superadmin is revalidated before return",
    "If original superadmin becomes inactive/non-superadmin, impersonation is forcibly ended and login is required",
    "Password changes are disabled during Login As",
    "Persistent warning banner identifies target and original Administrator Utama",
    "Logout closes the impersonation log",
    "Next real superadmin login closes stale active impersonation records",
    "All normal activity() entries during impersonation are marked with the original Administrator Utama identity"
  ],
  "audit_table": "impersonation_logs",
  "preserved_features": [
    "Import User Excel (Super Admin only)",
    "Import Jenis Jasa Excel + template",
    "Import Produk Excel + template",
    "Jenis Jasa add/edit/delete/activate/deactivate/defaults",
    "Member levels and automatic evaluation",
    "Member registration social/custom fields",
    "Member card front/back customization and Card Designer",
    "POS service/product/mixed transactions",
    "QRIS/Transfer/E-Wallet proof upload and payment approval",
    "Retail and operational inventory",
    "Operational service-product recipes",
    "Central upload policy",
    "Finance ledger/accounting/tax/payroll",
    "Staff portal and attendance",
    "ZKTeco SpeedFace V5L PUSH/wizard/connection/step diagnostics",
    "Thermal receipt and printer profiles",
    "Pointman Nuvia N15 card printing",
    "Renovation",
    "Backup/restore",
    "PWA/mobile"
  ],
  "new_files": [
    "exit_login_as.php",
    "login_as.php",
    "upgrade_v4_28_0.php"
  ],
  "checks": {
    "php_lint_all": true,
    "db_impersonation_table": true,
    "db_impersonation_columns": true,
    "db_fk_valid": true,
    "db_fk_order_valid": true,
    "insert_columns_valid": true,
    "update_columns_valid": true,
    "upgrade_vs_fresh_valid": true,
    "local_includes_valid": true,
    "local_links_valid": true,
    "post_csrf_valid": true,
    "base_files_preserved": true,
    "critical_files_preserved": true,
    "schema_release_428": true,
    "start_superadmin_only": true,
    "nested_impersonation_blocked": true,
    "target_active_required": true,
    "target_superadmin_blocked": true,
    "actor_db_revalidated": true,
    "session_regenerate_start": true,
    "session_regenerate_end": true,
    "csrf_start": true,
    "csrf_end": true,
    "return_actor_db_revalidated": true,
    "banner_visible": true,
    "return_endpoint_role_redirect_bypass": true,
    "password_change_blocked": true,
    "logout_closes_impersonation": true,
    "stale_sessions_closed_on_login": true,
    "activity_marker": true,
    "history_in_user_management": true,
    "login_as_button": true,
    "button_only_non_superadmin": true,
    "user_management_superadmin_only": true,
    "user_import_preserved": true,
    "catalog_import_preserved": true,
    "member_customization_preserved": true,
    "payment_approval_preserved": true,
    "central_upload_preserved": true,
    "zkteco_preserved": true,
    "retail_operational_preserved": true,
    "finance_preserved": true,
    "backup_restore_preserved": true,
    "no_create_database": true,
    "no_use_database": true
  },
  "deployment_notes": [
    "Preserve config/database.local.php and uploads when upgrading.",
    "Run upgrade_v4_28_0.php as Super Admin.",
    "Fresh database.sql contains the full impersonation_logs schema.",
    "database.sql contains no CREATE DATABASE and no USE statement."
  ]
}