{# CC6 — persistent banner while a super-admin support session (impersonation) is active.
Self-contained (model: _subscription_readonly_banner). Ruling #5: the banner is mandatory —
the impersonated tenant view must always show that support is inside and that everything is
logged. Included from header.html.twig (legacy pages) + @System main_layout (cp-shell). #}
{% if app.session.get('hb_support_session') == 1 %}
<div style="position:sticky;top:0;z-index:2000;background:#7c2d12;color:#fff;padding:8px 16px;font-size:var(--cp-fs-base);display:flex;align-items:center;gap:12px;flex-wrap:wrap;box-shadow:0 2px 6px rgba(0,0,0,.25);">
<span style="font-weight:700;">🛠 SUPPORT SESSION</span>
<span>{{ app.session.get('hb_support_admin_name') ?: 'Platform support' }} is viewing as <b>{{ app.session.get('userName') }}</b> — every action is logged.</span>
<span style="opacity:.75;">Reason: {{ app.session.get('hb_support_reason') }}</span>
<span style="opacity:.75;">Approvals, signatures & user management are disabled.</span>
<a href="{{ path('support_access_end') }}" style="margin-left:auto;background:#fff;color:#7c2d12;border-radius:5px;padding:3px 12px;font-weight:700;text-decoration:none;">End support session</a>
</div>
{% endif %}