I do wonder if this whole feature needs a rethink.
Impersonate was always a super sharp tool that was implemented as kind of a hack.
A non-hacky implementation may be significantly less creepy and far easier to justify as a default feature Discourse has.
- When you are impersonating a user you only have a “readonly” view (unless some special hidden site setting is enabled)
- Banner on top like @John_Lehmann suggested
- More ceremony when impersonating eg: with great power comes great responsibility
Overall the feature is very useful for debugging things, but acting on behalf of someone else is super dangerous.
I wonder if for starters @codinghorror it makes sense to make the current “impersonate” feature a feature that is disabled on Discourse sites and required changing a hidden site setting to enable? Not sure?