#!/usr/bin/env bash
# Append hostname(s) to Firebase Auth authorizedDomains via Identity Platform API v2.
# Usage: ./scripts/add-firebase-auth-domain.sh [domain ...]
# Example: ./scripts/add-firebase-auth-domain.sh cyberhybridhub.com www.cyberhybridhub.com
set -euo pipefail

PROJECT="${FIREBASE_PROJECT_ID:-cyberhybridhub}"
DOMAINS=("$@")

if [ "${#DOMAINS[@]}" -eq 0 ]; then
  DOMAINS=(cyberhybridhub.com www.cyberhybridhub.com)
fi

if ! command -v gcloud >/dev/null 2>&1; then
  echo "gcloud not found. Add domains manually in Firebase Console, or install gcloud and run:" >&2
  echo "  gcloud auth login" >&2
  exit 1
fi

TOKEN="$(gcloud auth print-access-token)"
BASE="https://identitytoolkit.googleapis.com/v2/projects/${PROJECT}/config"

echo "Reading current config for project ${PROJECT}..."
CURRENT="$(curl -s -H "Authorization: Bearer ${TOKEN}" -H "x-goog-user-project: ${PROJECT}" "${BASE}")"

if ! echo "$CURRENT" | python3 -c "import json,sys; json.load(sys.stdin)" 2>/dev/null; then
  echo "Failed to read config:" >&2
  echo "$CURRENT" >&2
  exit 1
fi

UPDATED="$(echo "$CURRENT" | DOMAINS="${DOMAINS[*]}" python3 -c "
import json, os, sys
data = json.load(sys.stdin)
domains = list(data.get('authorizedDomains', []))
for d in os.environ['DOMAINS'].split():
    d = d.strip().lower()
    if d and d not in domains:
        domains.append(d)
data['authorizedDomains'] = domains
print(json.dumps({'authorizedDomains': domains}))
")"

echo "Patching authorizedDomains: ${DOMAINS[*]}"
RESPONSE="$(curl -s -X PATCH \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "x-goog-user-project: ${PROJECT}" \
  -H "Content-Type: application/json" \
  "${BASE}?updateMask=authorizedDomains" \
  -d "${UPDATED}")"

if echo "$RESPONSE" | python3 -c "import json,sys; json.load(sys.stdin)" 2>/dev/null; then
  echo "$RESPONSE" | python3 -m json.tool
  echo ""
  echo "Done. Verify:"
  echo "  ./scripts/check-firebase-auth-domains.sh"
else
  echo "Patch failed:" >&2
  echo "$RESPONSE" >&2
  exit 1
fi