fix

apps/api/internal/httpapi/auth_handlers.go

@@ -379,16 +379,20 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	}
-	if !s.Config.IsProduction() {
-		canSwitch := impersonating
-		if !canSwitch {
+	canUserSwitch := impersonating
+	if !canUserSwitch {
+		if accessErr == nil && access.FullAdmin && access.Role == auth.StaffRoleAdmin {
+			canUserSwitch = true
+		} else if !s.Config.IsProduction() {
 			if accessErr == nil && access.FullAdmin {
-				canSwitch = true
+				canUserSwitch = true
 			} else if isLocalDemoEmail(user.Email) {
-				canSwitch = true
+				canUserSwitch = true
 			}
 		}
-		out["dev_user_switch"] = canSwitch
+	}
+	if canUserSwitch {
+		out["dev_user_switch"] = true
 	}
 	JSON(w, http.StatusOK, out)
 }