- Shipped
- September 3, 2026 at 12:18 AM UTC
- Author
- Kamo
- Commit
- 8ee1d68
Gated on canEnterOrg, which is the VIEWER's own membership — and a platform operator has no membership in the organizations impersonation exists for. So the button rendered for a right-holder and refused every click target. Impersonation signs in as a member of the TARGET organization; the viewer's membership is not used for anything, and neither is a domain, since the org opens on the platform host when its own is not ready and the server returns the URL. So the answer is the same as canEnterOrgAsSystemMember's: always, for someone holding the right. This is the identical mistake that button was already fixed for, and its correction is documented eight lines above the predicate I reused. Hence a named canImpersonateInOrg rather than borrowing one whose meaning does not fit, and a test that pins the two disagreeing about an org the viewer cannot enter. Visibility was and remains correct: all three views render the button only under canImpersonate, so someone without the right sees no button at all rather than a disabled one.