feat: admin impersonates a user (#38614)

* fix #3631
* fix #21599

by the way, refactored the "profile avatar card" to simplify the code.

services/auth/session.go

@@ -8,6 +8,7 @@ import (
 
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/log"
+	"gitea.dev/modules/session"
 )
 
 // Ensure the struct implements the interface.
@@ -32,20 +33,14 @@ func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataSto
 		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
-	// Get user ID
-	uid := sess.Get("uid")
-	if uid == nil {
-		return nil, nil //nolint:nilnil // the auth method is not applicable
-	}
-	log.Trace("Session Authorization: Found user[%d]", uid)
-
-	id, ok := uid.(int64)
+	// Get session user ID
+	uid, ok := sess.Get(session.KeyUID).(int64)
 	if !ok {
 		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	// Get user object
-	user, err := user_model.GetUserByID(req.Context(), id)
+	user, err := user_model.GetUserByID(req.Context(), uid)
 	if err != nil {
 		if !user_model.IsErrUserNotExist(err) {
 			log.Error("GetUserByID: %v", err)
@@ -58,3 +53,15 @@ func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataSto
 	log.Trace("Session Authorization: Logged in user %-v", user)
 	return user, nil
 }
+
+func ClearSessionKeysForSignIn(sess SessionStore) {
+	_ = sess.Delete("openid_verified_uri")
+	_ = sess.Delete("openid_signin_remember")
+	_ = sess.Delete("openid_determined_email")
+	_ = sess.Delete("openid_determined_username")
+	_ = sess.Delete("twofaUid")
+	_ = sess.Delete("twofaRemember")
+	_ = sess.Delete("webauthnAssertion")
+	_ = sess.Delete("linkAccount")
+	_ = sess.Delete("linkAccountData")
+}