"""The owner's operational reads under `/api/ops/*` (R1: active impersonations only).

Sources of truth: this module, `app/services/sessions.py` (`active_impersonations`),
`app/services/access.py` (the route is classified `owner`), `docs/ACCOUNTS.md`. R3 adds the
collection oversight reads beside it under `sources.manage`.
"""

from fastapi import APIRouter, HTTPException, Request

from app.services import accounts, identity, sessions

router = APIRouter(prefix="/api/ops", tags=["ops"])


@router.get("/impersonations")
def impersonations(request: Request) -> dict:
    """Every live session with a View As on it: one SELECT, no heartbeat protocol. The
    access policy admits the owner only; this check is the route's own belt."""
    if not accounts.is_owner(identity.real_user(request)):
        raise HTTPException(status_code=403, detail={"error_code": "FORBIDDEN", "summary": "Owner only."})
    return {"impersonations": sessions.active_impersonations()}