import { useMyProxies } from '../../hooks/useMyProxies.tsx';
import ProofingBanner from './ProofingBanner.tsx';

// The act-as-era mount for the identity-proofing prompt.
//
// WHY THIS EXISTS: ProofingBanner's two original mount sites (DashboardPage's RelatedPerson branch,
// ProfilePage's RelatedPerson branch) both require RelatedPerson ROLE, and AuthService derives that
// role from `loggedInAs` - the legacy "Sign In As -> Related Person" login selector. Under the act-as
// model a caregiver signs in as THEMSELVES (a Patient with a home Patient record) and switches into
// the person they help, so `userRole` is PATIENT and neither mount ever fired. The verify surface was
// stranded by that migration: `startVerification()` has exactly one caller in the client, and it was
// unreachable for every account created the new way. That is why proofing had never been run end to
// end, not a configuration problem.
//
// THE GATE: ProofingBanner's own header comment names the blocker - "there is no client-readable
// signal for 'this related person holds a full-proxy grant'" - which is why it cannot simply be shown
// to everyone. useMyProxies is that signal now: it returns the proxy grants the CALLER holds. So the
// prompt reaches actual caregivers and no ordinary patient ever sees "verify your identity".
//
// It is deliberately NOT gated on the full-proxy TIER, which is still not client-readable (the
// authority grant is self-scoped to the patient who granted it). Holding any proxy is the honest
// available proxy for "this prompt could apply to you", and ProofingBanner's copy is written
// conditionally ("If you've been granted full-proxy caregiver access...") for exactly that reason.
// Over-showing here costs a caregiver an optional verification; under-showing leaves full-proxy
// access permanently inert, which is the failure we are fixing.
//
// SAFE TO MOUNT IN THE SHELL: useMyProxies self-gates on the caller being a Patient, so it issues no
// request for staff or pre-auth renders (see its own comment re: the provider auth-gate reload loop),
// and it passes bypassActingAs - so while the caregiver is switched INTO someone else this still
// reflects THEIR OWN grants, not the subject's. ProofingBanner itself renders null once verified.
const CaregiverProofingBanner = () => {
    const { proxies, isLoading } = useMyProxies();

    // Nothing until the list resolves: a verification prompt that flashes in and vanishes on every
    // dashboard load reads as a glitch in a security surface.
    // Only a grant that verification is actually holding down. A guardian's full proxy over a minor is
    // effective without it, and the server sends the flag only on a grant it has reduced.
    if (isLoading || !proxies.some((proxy) => proxy.tierReducedForProofing === true)) {
        return null;
    }

    return <ProofingBanner />;
};

export default CaregiverProofingBanner;