Introduce Login As Customer token generation REST API with full test coverage

[mimou78]

Description (*)

This Pull Request introduces a new Login As Customer Token Generation API, providing a secure and extensible WebAPI endpoint used to initiate customer login sessions from the Admin panel.

This enhancement modernizes the Login As Customer workflow by adding a dedicated token-generation mechanism with proper ACL control, REST exposure, fixtures, unit tests and API-functional tests.

What’s included

• Added LoginAsCustomerTokenServiceInterface + implementation
• New REST endpoint:
  POST /V1/integration/customer/login-as-customer
• Added WebAPI configuration with dedicated ACL:
  Magento_LoginAsCustomerApi::token
• Added API-functional tests (REST)
• Added unit tests for secret validation and token generation logic
• Added integration fixtures for:
  • Customer creation
  • Admin user with isolated role + correct ACL
  • Secret generation
  • Rollback cleanup
• Minor DI / config updates required for the new service

Backward Compatibility

• No backward-incompatible changes
• No existing APIs modified
• Feature fully isolated to the new LoginAsCustomerApi module

Security Considerations

• Token generation strictly restricted by ACL
• Admin authentication required via Bearer admin token
• Secrets validated through existing GenerateAuthenticationSecret service
• No sensitive customer data returned

---

Manual testing scenarios (*)

1. Enable module config:

Stores → Configuration → Customers → Login as Customer → Enable = Yes

2. Generate an admin token:

POST /V1/integration/admin/token

3. Generate a secret (via admin UI or fixture).
4. Call the new endpoint:

`POST /V1/integration/customer/login-as-customer
Authorization: Bearer <admin_token>

{
"secret": "<valid_secret>"
}`

5. Expected: a valid integration token is returned
6. Using this token on the storefront authenticates the customer session

---

Questions or comments

If any additional scenarios or test coverage are required, I’m happy to expand this PR.

---

Contribution checklist (*)

• Pull request has a clear description
• Commit messages are meaningful
• All new or changed code is covered with unit + integration/API tests
• README or module documentation updated where appropriate
• All automated tests pass (green build)

[m2-assistant]

Hi @mimou78. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.
❗ Automated tests can be triggered manually with an appropriate comment:

• @magento run all tests - run or re-run all required tests against the PR changes
• @magento run <test-build(s)> - run or re-run specific test build(s)
  For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:

1. Database Compare
2. Functional Tests CE
3. Functional Tests EE
4. Functional Tests B2B
5. Integration Tests
6. Magento Health Index
7. Sample Data Tests CE
8. Sample Data Tests EE
9. Sample Data Tests B2B
10. Static Tests
11. Unit Tests
12. WebAPI Tests
13. Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

---

For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[mimou78]

@magento run all tests

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[ct-prd-pr-scan]

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email [email protected].

[mimou78]

@magento run all tests