# banking/middleware.py
from django.contrib.auth import get_user_model
from django.utils.deprecation import MiddlewareMixin

User = get_user_model()


class ReadOnlyImpersonateMiddleware(MiddlewareMixin):

    def process_request(self, request):

        imp_id = request.session.get("impersonate_user_id")
        read_only = request.session.get("impersonate_read_only", False)

        request.is_impersonating = bool(imp_id)

        if imp_id:
            try:
                impersonated = User.objects.get(pk=imp_id)
                request.user = impersonated
            except User.DoesNotExist:

                request.session.pop("impersonate_user_id", None)
                request.is_impersonating = False


        if request.is_impersonating and read_only:
            if request.method not in ("GET", "HEAD", "OPTIONS"):
                from django.http import HttpResponseForbidden
                return HttpResponseForbidden("Read-only impersonation mode.")

        return None