<?php

namespace App\Http\Controllers;

use App\Models\Customer;
use App\Models\Operator;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;

/**
 * Admin impersonation: an admin can log in as a customer's portal account to
 * inspect their portal during an incident, then return to the admin session.
 *
 * Both guards are named explicitly throughout, never the ambient default: the
 * operator and the customer are two different models on two different guards
 * now, and this is exactly the code that swaps which one is "the" signed-in
 * user for the request. The full signed-link rewrite (for hosts that do not
 * share a cookie at all) is a separate piece of work; this keeps today's
 * same-session handover correct across the split identity in the meantime.
 */
class ImpersonationController extends Controller
{
    /** Admin-gated: become the customer. */
    public function start(Customer $customer): RedirectResponse
    {
        $this->authorize('customers.impersonate');
        $user = $customer->ensureUser();

        session(['impersonator_id' => Auth::guard('operator')->id()]);
        Auth::guard('web')->login($user);

        return redirect()->route('dashboard');
    }

    /** Return to the admin session (available while impersonating). */
    public function leave(): RedirectResponse
    {
        $operatorId = session()->pull('impersonator_id');

        if ($operatorId !== null && ($operator = Operator::query()->find($operatorId)) !== null) {
            // Ends the customer session rather than leaving it dangling
            // alongside the restored operator one.
            Auth::guard('web')->logout();
            Auth::guard('operator')->login($operator);

            return redirect()->route('admin.overview');
        }

        return redirect()->route('dashboard');
    }
}