Fix "log as user" functionality - convert GET to POST requests

[Copilot]

The "log as user" feature in homework and project submission pages was non-functional because templates used GET requests while django-loginas requires POST for security.

Changes

Templates - Converted links to POST forms:

• cadmin/templates/cadmin/homework_submissions.html
• cadmin/templates/cadmin/project_submissions.html

<!-- Before: GET request via link -->
<a href="/admin/login/user/{{ user.id }}/?next=...">Log in as</a>

<!-- After: POST request via form -->
<form method="post" action="{% url 'loginas-user-login' user.id %}">
  {% csrf_token %}
  <input type="hidden" name="next" value="...">
  <button type="submit" class="btn btn-sm btn-info">Log in as</button>
</form>

Settings - Added authorization function restricting staff from impersonating other staff:

def can_login_as(request, target_user):
    """Staff can impersonate students only, not other staff/superusers."""
    return request.user.is_staff and not target_user.is_staff

CAN_LOGIN_AS = can_login_as

Tests - Added coverage for:

• GET requests properly rejected (405)
• POST requests work correctly
• Staff cannot impersonate staff

Screenshots

Homework submissions page with working "Log in as" buttons:

Successfully impersonated user (note navbar shows student email):

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• astral.sh
  • Triggering command: /usr/bin/curl curl -LsSf REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Log as user not working</issue_title>
<issue_description>In the latest PR (check it!) we implemented log as user functionality. It's not working. Let's cover it with tests first to make sure it fails and then fix it</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Log as user not working #138

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.