Impersonation Authorize

Body for POST /api/internal/auth0-actions/impersonation-authorize.

Sent by the Auth0 Custom Action whose source lives at infra/app/auth0/auth0_actions/impersonation_token_exchange.js. The Action passes through the actor / subject identifiers and the requested mode so the dock can resolve the canonical actor principal before letting the exchange complete.

Body returned to the Auth0 Custom Action.

The Action treats any non-2xx response (or allow=false) as a denial and rejects the exchange. When allow is true, target_* fields carry the dock-resolved canonical target identity for the Post-Login Action to stamp onto the minted token — caller-supplied target email / principal values on the OAuth body are never trusted.