Support sessions admin

For admins

Support sessions

Support sessions are the structured way for Alresford’s support team to access a customer account — see the requester-side approval flow. This admin page is the audit trail.

What the admin sees

A reverse-chronological list of every support session — requested, approved, active, expired, or revoked. For each row:

Support user — who from Alresford requested access.
Target user — whose account they wanted to act as.
Reason — the text Alresford typed when raising the request.
Status — requested, approved, active, expired, revoked.
Timestamps — requested_at, approved_at, started_at, expires_at, ended_at.
End reason — expired, revoked-by-support, revoked-by-customer, etc.
Live indicator — bright badge for sessions currently active.

The state machine

requested → approved → active → ended (any reason)
         ↘ revoked-before-approval

Requested — Alresford raised, customer hasn’t acted.
Approved — customer clicked Approve.
Active — support agent began the session.
Expired — 60 minutes elapsed.
Revoked — customer or support ended early.

Reading the audit

The list itself is the audit. If your DPO asks “who from Alresford has impersonated anyone in this workspace this quarter?”, this is your answer.

Combine with the platform-wide audit log — every action taken during an active support session is recorded with both identities (support user + impersonated user). The support-sessions row is the scope; the audit log is the detail.

When to revoke

Active session running longer than the work seems to need.
Customer-visible behaviour during the session looks off.
The customer never approved in the first place — but the row says active (shouldn’t happen, but if it does, revoke immediately and contact Alresford).

Revoking ends the session immediately. The support agent loses access on their next page load.

Gotchas

The page itself is admin-only. A target user can’t see the admin support-sessions list — they only see their own approval URL.
Sessions that expire don’t auto-clean from the list. The audit trail keeps them. Use the date range filter for recent activity.
The customer’s approval is captured in the row’s approved_at plus approved_by_user_id. Anonymous approvals aren’t possible.