import { betterAuth } from "better-auth";
import { impersonation } from "better-auth-impersonation";

const auth = betterAuth({
  plugins: [
    impersonation({
      // Who can impersonate
      permissions: {
        roles: ["admin", "support"],
        userIds: ["admin-123"],
        customCheck: async (impersonator, target) => {
          // Custom permission logic
          return impersonator.role === "admin";
        },
      },
      // Security settings
      security: {
        requireReason: true,
        maxDuration: 60 * 30, // 30 minutes
        notifyUser: true,
        allowedActions: ["read"], // Restrict to read-only
        blockedPaths: ["/settings", "/billing"],
      },
      // Audit settings
      audit: {
        logAll: true,
        includeActions: true,
        retention: 90, // days
      },
      // UI customization
      ui: {
        showBanner: true,
        bannerText: "Impersonating {{userName}}",
      },
      // Events
      onImpersonationStart: async (session) => {
        // Log to external service
        console.log(`Admin ${session.impersonatorId} started impersonating ${session.targetId}`);
      },
      onImpersonationEnd: async (session) => {
        // Cleanup or notifications
      },
    }),
  ],
});