Staff permissions and opening a user's mailbox

Staff

Everyone who signs in to the admin panel is a staff member with a set of permissions. Staff in the admin panel lists them; adding someone takes an email, a password and a role:

Role	Permissions
Owner	everything (`*`)
Support	read, tenants, support, approvals, reports, impersonate
Billing	read, tenants, plans
Abuse desk	read, approvals, reports
Read only	read

Permissions on a staff member picks them one by one:

Permission	Allows
`read`	seeing every page and record
`tenants`	changing tenants, users, domains, aliases, filters and limits
`support`	answering and changing tickets, notes on users
`approvals`	approving and rejecting signups, verifying accounts
`reports`	handling spam and phishing reports, downloading reported messages
`plans`	changing plans
`settings`	platform, spam, sign-in, abuse and MTA-STS settings, shared domains, invitations
`legal`	legal exports and their audit log
`impersonate`	opening webmail as a user, where the team allows it
`content`	writing, changing and deleting blog posts
`staff`	managing staff

A staff member without a permission gets "does not have the ... permission" and the panel hides what they cannot use. Changing someone's permissions, disabling them or setting a new password signs them out. There is always at least one enabled member who can manage staff.

The platform API key (for platform services) and sudo corpsuite on the server have every permission. From the command line: corpsuite staff, staff add email=help@example.com password=- permissions:='["read","reports"]', staff set ID disabled:=true. corpsuite admin set still makes an owner.

Opening webmail as a user (impersonation)

Support sometimes needs to see what a user sees. Each team decides whether that is allowed, under Joining the team → Who may open webmail as one of the team's users (owners only):

Nobody (the default).
The platform's support staff: staff with the impersonate permission, and the platform API key.
Support staff and the team's owners and admins: also the team's own administrators. An admin cannot open an owner's mailbox, and nobody their own.

Open as user next to the user asks for a reason and opens webmail in a new tab. Every time:

the reason is required, and the user is emailed who opened their mailbox and why;
it shows in the user's sign-in history ("opened as you by ...");
webmail shows a banner saying whose mailbox it is and who opened it;
the session lasts an hour, and cannot change the password, recovery address, two-step sign-in, app passwords or alerts.

The link itself works once, for five minutes. Opening it in a browser where you are signed in to webmail yourself replaces that session; sign in again afterwards.

From the command line: corpsuite mailbox impersonate bob@acme.com reason="Ticket 4182" prints the link.