Impersonation system implementation

nonpacks/profiles/models.py

@@ -53,4 +53,27 @@ class ApiToken(models.Model):
         ]
 
     def __str__(self):
-        return f'{self.user.username} - {self.label} ({self.key_prefix}...)'
+        return f'{self.user.username} - {self.label} ({self.key_prefix}...)'
+
+
+class ImpersonationLog(models.Model):
+    """Audit trail of staff impersonation sessions (reviewed in Django admin)."""
+    impersonator = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='impersonation_sessions',
+    )
+    target = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name='impersonated_sessions',
+    )
+    reason = models.CharField(max_length=255, blank=True, default='')
+    started_at = models.DateTimeField(auto_now_add=True)
+    ended_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        ordering = ['-started_at']
+
+    def __str__(self):
+        return f'{self.impersonator.username} → {self.target.username}'