#!/usr/bin/env bash
# Print Firebase Auth authorized domains and verify production hostnames.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
API_KEY="${FIREBASE_WEB_API_KEY:-AIzaSyDbYBh6nO-UasqwM-dkVVJAvw5wMhRTsIs}"

# Hostnames the app uses (no scheme, no port).
REQUIRED_DOMAINS=(
  cyberhybridhub.com
)

OPTIONAL_DOMAINS=(
  www.cyberhybridhub.com
)

echo "Fetching authorized domains for project cyberhybridhub..."
JSON="$(curl -s "https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=${API_KEY}")"
echo "$JSON" | python3 -m json.tool

DOMAINS="$(echo "$JSON" | python3 -c "import json,sys; d=json.load(sys.stdin); print('\n'.join(d.get('authorizedDomains',[])))")"

echo ""
echo "=== Check ==="
MISSING=0
for domain in "${REQUIRED_DOMAINS[@]}"; do
  if echo "$DOMAINS" | grep -Fxq "$domain"; then
    echo "OK   $domain"
  else
    echo "FAIL $domain (required — Google sign-in will not work on https://$domain)"
    MISSING=1
  fi
done
for domain in "${OPTIONAL_DOMAINS[@]}"; do
  if echo "$DOMAINS" | grep -Fxq "$domain"; then
    echo "OK   $domain"
  else
    echo "WARN $domain (optional; add if users visit https://$domain)"
  fi
done

if [ "$MISSING" -ne 0 ]; then
  echo ""
  echo "Fix (pick one):"
  echo "  1. Firebase Console → project cyberhybridhub → Authentication → Settings"
  echo "     → Authorized domains → Add domain → cyberhybridhub.com (no https://)"
  echo "  2. After editing firebase.json redirect URIs:"
  echo "       firebase login && firebase deploy --only auth --project cyberhybridhub"
  echo "  3. Run: ./scripts/add-firebase-auth-domain.sh cyberhybridhub.com"
  echo "     (needs gcloud auth with Firebase Admin permissions)"
  exit 1
fi

echo ""
echo "All required domains are authorized."