/**
 * Admin-session cookie name per ADR-0020 §"Sessions — distinct from
 * `portal-shell`". The admin SPA carries `__Host-portal_admin_session`
 * (prod) so a browser holding both cookies can switch between
 * portal-shell and portal-admin without one signing the user in to
 * the other.
 *
 * Same `__Host-` posture as the user-portal session: `Secure` + no
 * `Domain` + `Path=/`. The dev variant drops the prefix because
 * local servers are plain HTTP.
 *
 * The cookie scoping is the only thing keeping the two sessions
 * apart at the browser level — the BFF further isolates them in
 * Redis under a distinct key prefix (`session:admin:`).
 */
const PRODUCTION_NAME = '__Host-portal_admin_session';
const DEVELOPMENT_NAME = 'portal_admin_session';

export function adminSessionCookieName(): string {
  return process.env['NODE_ENV'] === 'production' ? PRODUCTION_NAME : DEVELOPMENT_NAME;
}
