> ## Documentation Index
> Fetch the complete documentation index at: https://docs.district79.school/llms.txt
> Use this file to discover all available pages before exploring further.

# Role preview

> Super Admin impersonation of demo Principal and Assistant Principal accounts.

Google Workspace will not issue tokens for fake `@schools.nyc.gov` mailboxes. Super Admins still need to walk a **principal** and **assistant principal** UI. Role preview does that by rewriting the JWT claims to a seeded demo `User` without changing the Google identity of the actor.

![Preview school roles](https://placehold.co/600x400)
*Caption: Add screenshot of the Overview Preview school roles card and the yellow impersonation banner.*

## Who can preview

Only **level 5**. The JWT callback loads the actor from MongoDB, then — if `token.impersonateEmail` is set — swaps `session.user` to the target **only when**:

* The actor’s stored level is 5
* The target exists, is active, and has **level \< 5**

You cannot preview another Super Admin. Stopping preview clears `impersonateEmail` and restores the actor.

## Demo users

Constants: `src/lib/demoUsers.js`. Seed:

```bash theme={null}
node src/scripts/create-demo-users.js
```

| Role                     | Level | Email                                | School                          |
| ------------------------ | ----- | ------------------------------------ | ------------------------------- |
| Demo Principal           | 4     | `d79.demo.principal@schools.nyc.gov` | Pathways to Graduation Brooklyn |
| Demo Assistant Principal | 3     | `d79.demo.ap@schools.nyc.gov`        | Pathways to Graduation Brooklyn |

These addresses **cannot** sign in with Google. Use **Preview as** on Overview (`RolePreviewCard`). The script assigns every plan at that school to the demo AP (`assignedForms` with `permissions: "edit"`).

## How the session changes

Client: `session.update({ impersonateEmail })` or `session.update({ stopImpersonation: true })`.

After reload, `getServerSession` exposes:

<ResponseField name="user.email" type="string">
  Demo user’s email (APIs authorize as this user).
</ResponseField>

<ResponseField name="user.level" type="number">
  `4` or `3` while previewing.
</ResponseField>

<ResponseField name="user.id" type="string">
  Demo `User._id`, not the Super Admin’s id.
</ResponseField>

<ResponseField name="impersonating" type="boolean">
  `true` while a preview is active.
</ResponseField>

<ResponseField name="actorEmail" type="string">
  The real Super Admin mailbox (banner + stop-preview).
</ResponseField>

JWT still belongs to the actor (`token.actorEmail`). `jti` is unchanged. Sign-out revokes that `jti` as usual.

<Callout type="warning">
  While previewing, mutating APIs use the **demo** email and level. A Super Admin sidebar is hidden. Stop preview from the yellow banner (`ImpersonationBanner` in `src/app/providers.js`) before running district tools.
</Callout>

## What you should see

<Tabs>
  <Tab title="Principal">
    Same-school plans are editable without a share. School users (levels 1–3 at that school). Collaboration share. Create/duplicate/attest/submit for that school only. Super Admin pages redirect to `/dashboard`.
  </Tab>

  <Tab title="Assistant Principal">
    Plans appear when they are in `assignedForms` or `sharedWithEmails`. Edit after assignment. No school user admin, no new plan, no attest/submit.
  </Tab>
</Tabs>

<Steps>
  <Step title="Sign in as Super Admin">
    Use your real `@schools.nyc.gov` account (for example the Data Systems Administrator).
  </Step>

  <Step title="Seed demo users if needed">
    `node src/scripts/create-demo-users.js` against the same `MONGODB_URI` as the app.
  </Step>

  <Step title="Overview → Preview school roles">
    Choose Principal or Assistant Principal. Confirm the yellow banner.
  </Step>

  <Step title="Stop preview">
    Banner **Stop preview**, or `session.update({ stopImpersonation: true })`.
  </Step>
</Steps>