Variable: VIEW_AS_COOKIE

const VIEW_AS_COOKIE: "view_as" = 'view_as'

Defined in: src/server/auth/impersonation.ts:15

Owner-only READ-ONLY "View as" (impersonation). The owner stays authenticated as themselves; this cookie only changes the EFFECTIVE permission/identity lens used to RENDER the app, so the owner can see exactly what a staff role or a contractor sees without guessing. It never switches the Supabase session — data still reads under the owner (a superset) — and it is honored ONLY when the real user is an owner, so a forged cookie is inert for everyone else and can only ever DOWNGRADE the owner's own view. Mutations stay bound to the real identity (see readOnlyWhileViewingAs).