feat(webapp): put the admin dashboard behind an env var flag

[myftija]

Adds an ADMIN_DASHBOARD_ENABLED env var (default: enabled) that turns the admin dashboard and user impersonation off for an entire instance.

When disabled:

• every admin dashboard page redirects away, and the admin navigation isn't rendered
• existing impersonation cookies are ignored, and any lingering session is actively terminated with an audit record
• every flow that could start an impersonation responds 404, and no impersonation tokens are minted

Stopping an impersonation always works regardless of the flag, so nothing gets stuck. Machine-to-machine admin API endpoints are not affected. The variable is documented for self-hosters; instances that don't set it are unaffected.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 17fb90b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Walkthrough

The pull request renames IMPERSONATION_ENABLED to ADMIN_DASHBOARD_ENABLED. The flag gates admin dashboard access, impersonation reads and writes, authorization checks, routes, links, and controls. Disabled instances clear lingering impersonation sessions while preserving raw cookie access for auditing. Tests, preview configuration, documentation, and a server change note are updated.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.18% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 15 files. (3 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	The description accurately explains the feature and its disabled-state behavior, but it omits the required issue reference, checklist, Testing, Changelog, and Screenshots sections from the repository …	Update the description to include Closes #<issue>, the complete checklist, testing steps, a short changelog entry, and screenshots or an explicit statement that screenshots are not applicable.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: gating the admin dashboard with an environment variable flag.

Full details: Docstring Coverage

Explanation

Docstring coverage is 18.18% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 15 files. (3 skipped: 3 unsupported.)

Full details: Description check

Explanation

The description accurately explains the feature and its disabled-state behavior, but it omits the required issue reference, checklist, Testing, Changelog, and Screenshots sections from the repository template.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/webapp-impersonation-flag-sec-436

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[trigger-dot-bot]

Preview Deployment

Status	Preview	Commit	Updated
⚪ Removed	–	17fb90b	Aug 25, 13:43 UTC

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

Observability map

As of 17fb90b.

19/100 over 449 measured of 467 entry points (base 19, no change)

What this PR changed

route	base	head	now failing
/admin/api/v1/vercel-external-ids/backfill	new	0	request-context

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 23 of 449 entry points name a tenant on a failure path. 347 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  181 applicable, 103 pass,   0 sole, global without it 12
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 16
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 19
  request-context       449 applicable,  23 pass, 246 sole, global without it 64
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.