feat: owner read-only view-as from team users table

Allow org owners to inspect any member's data scope via dual JWT; server blocks mutations and team page stays reachable for return.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/auth/jwt.strategy.ts

@@ -16,6 +16,8 @@ export type JwtPayload = {
   sub: string;
   organizationId: string;
   role: string;
+  impersonatorUserId?: string;
+  viewAsReadOnly?: boolean;
 };
 
 @Injectable()
@@ -43,6 +45,28 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     if (!payload.sub || !payload.organizationId) {
       throw new UnauthorizedException();
     }
+
+    let impersonatorUserId: string | undefined;
+    let impersonatorRole: string | undefined;
+    const viewAsReadOnly = Boolean(payload.viewAsReadOnly && payload.impersonatorUserId);
+    if (viewAsReadOnly && payload.impersonatorUserId) {
+      const ownerMembership = await this.prisma.membership.findFirst({
+        where: {
+          userId: payload.impersonatorUserId,
+          organizationId: payload.organizationId,
+          isActive: true,
+          role: 'owner',
+          organization: { isActive: true },
+        },
+        select: { userId: true, role: true },
+      });
+      if (!ownerMembership) {
+        throw new UnauthorizedException();
+      }
+      impersonatorUserId = ownerMembership.userId;
+      impersonatorRole = ownerMembership.role;
+    }
+
     const user = await this.prisma.user.findUnique({
       where: { id: payload.sub },
       select: { id: true, isActive: true },
@@ -111,6 +135,13 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
         priorGranted && membership.organization.priorArchiveEnabledAt
           ? membership.organization.priorArchiveEnabledAt
           : null,
+      ...(viewAsReadOnly && impersonatorUserId
+        ? {
+            impersonatorUserId,
+            impersonatorRole: impersonatorRole ?? 'owner',
+            viewAsReadOnly: true,
+          }
+        : {}),
     };
   }