// Visual-only impersonation state. Real impersonation requires an OAuth
// on-behalf-of grant or admin-impersonation token endpoint; this composable
// just tracks whether the modal is open + which tenant we're "viewing" so the
// red banner and topbar warning surface render correctly. Tracked as a
// follow-up in OPERATOR-PLAN.md.

import type { Tenant } from '~/types/tenant'

const candidate = ref<Tenant | null>(null) // shown in the confirm modal
const active = ref<Tenant | null>(null) // shown in the persistent banner
const asUser = ref<string>('first-user@example.com')

export const useImpersonation = () => ({
  candidate,
  active,
  asUser,
  open: (tenant: Tenant) => {
    candidate.value = tenant
  },
  cancel: () => {
    candidate.value = null
  },
  confirm: (reason: string, userLabel?: string) => {
    if (!candidate.value) return
    active.value = candidate.value
    asUser.value = userLabel ?? asUser.value
    candidate.value = null
    // eslint-disable-next-line no-console
    console.log('[impersonation] entered', { tenant: active.value.slug, reason, asUser: asUser.value })
  },
  exit: () => {
    active.value = null
  },
})