/**
 * CLS (Continuation-Local Storage) keys.
 *
 * These keys are used to store request-scoped context
 * that propagates automatically through the async call chain.
 *
 * Per CLAUDE.md:
 * - tenant_id stored in CLS via TenantMiddleware
 * - user_id stored in CLS via JwtStrategy (after auth)
 * - TenantAwareRepository reads from CLS automatically
 * - No manual setTenantId() calls
 */
export const CLS_TENANT_ID = 'tenant_id';
export const CLS_USER_ID = 'user_id';
export const CLS_USER_ROLE_NAME = 'user_role_name';
export const CLS_USER_ROLE_ID = 'user_role_id';
export const CLS_USER_PERMISSIONS = 'user_permissions'; // Map of module -> access_level
/** Role flag: expand row visibility when combined with module view permission. */
export const CLS_ROLE_VIEW_ALL_BOOKINGS_QUERIES = 'role_view_all_bookings_queries';
export const CLS_IP_ADDRESS = 'ip_address';
export const CLS_USER_AGENT = 'user_agent';
export const CLS_REQUEST_ID = 'request_id';
/**
 * Read-only impersonation ("View as user"). When a session is a view-as
 * session, CLS_READ_ONLY is true and CLS_IMPERSONATOR_ID holds the real
 * admin's user id (the person acting as the target). Set by JwtStrategy
 * from the JWT claims; read by the global read-only interceptor to block
 * every write, and recorded on audit so actions trace back to the admin.
 */
export const CLS_READ_ONLY = 'read_only';
export const CLS_IMPERSONATOR_ID = 'impersonator_id';