#!/usr/bin/env bash
# Setup Firebase + Google Sign-In for cyberhybridhub (Ubuntu).
# Run from anywhere: ./scripts/setup-firebase-google-auth.sh
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
ANDROID_PACKAGE="com.cyberhybridhub.cyberhybridhub"
IOS_BUNDLE_ID="com.cyberhybridhub.cyberhybridhub"
BASHRC_MARKER="# cyberhybridhub: dart pub global + project paths"

log() { printf '\n==> %s\n' "$*"; }
warn() { printf 'WARN: %s\n' "$*" >&2; }

ensure_bashrc() {
  if grep -qF "$BASHRC_MARKER" "$HOME/.bashrc" 2>/dev/null; then
    log "bashrc already configured ($BASHRC_MARKER)"
    return
  fi

  log "Appending PATH entries to ~/.bashrc"
  cat >>"$HOME/.bashrc" <<'EOF'

# cyberhybridhub: dart pub global + project paths
if [ -d "$HOME/.pub-cache/bin" ]; then
  case ":$PATH:" in
    *":$HOME/.pub-cache/bin:"*) ;;
    *) export PATH="$HOME/.pub-cache/bin:$PATH" ;;
  esac
fi
export CYBERHYBRIDHUB_ROOT="$HOME/cyberhybridhub.com"
EOF
  # shellcheck source=/dev/null
  source "$HOME/.bashrc" 2>/dev/null || true
}

ensure_nvm() {
  export NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
  if [ -s "$NVM_DIR/nvm.sh" ]; then
    # shellcheck source=/dev/null
    . "$NVM_DIR/nvm.sh"
  fi
}

ensure_node_tools() {
  ensure_nvm
  if ! command -v node >/dev/null 2>&1; then
    warn "Node.js not found. Install nvm, then: nvm install --lts"
    exit 1
  fi
  if ! command -v firebase >/dev/null 2>&1; then
    log "Installing Firebase CLI (firebase-tools)"
    npm install -g firebase-tools
  else
    log "Firebase CLI: $(firebase --version)"
  fi
}

ensure_flutter_tools() {
  if ! command -v flutter >/dev/null 2>&1; then
    warn "Flutter not on PATH. Ensure ~/github-open/flutter/bin is in ~/.bashrc"
    exit 1
  fi
  log "Flutter: $(flutter --version | head -1)"
  if ! command -v flutterfire >/dev/null 2>&1; then
    log "Installing FlutterFire CLI"
    dart pub global activate flutterfire_cli
  else
    log "FlutterFire CLI already installed"
  fi
}

login_if_needed() {
  log "Firebase login (browser may open; FlutterFire uses this session)"
  firebase login --no-localhost 2>/dev/null || firebase login
}

ensure_firebaserc() {
  local project="${FIREBASE_PROJECT_ID:-cyberhybridhub}"
  if [ ! -f "$ROOT/.firebaserc" ]; then
    log "Creating .firebaserc (default project: $project)"
    printf '%s\n' "{\"projects\":{\"default\":\"$project\"}}" >"$ROOT/.firebaserc"
  fi
}

enable_google_auth() {
  local project="${FIREBASE_PROJECT_ID:-cyberhybridhub}"
  if ! grep -q '"googleSignIn"' "$ROOT/firebase.json" 2>/dev/null; then
    warn "firebase.json has no auth.providers.googleSignIn — run: firebase init auth"
    return
  fi

  log "Enabling Google sign-in (firebase deploy --only auth)"
  (
    cd "$ROOT"
    firebase deploy --only auth --project="$project"
  )
}

configure_flutterfire() {
  cd "$ROOT"
  if [ -n "${FIREBASE_PROJECT_ID:-}" ]; then
    log "Running flutterfire configure for project: $FIREBASE_PROJECT_ID"
    flutterfire configure \
      --project="$FIREBASE_PROJECT_ID" \
      --platforms=android,ios,web \
      --android-package-name="$ANDROID_PACKAGE" \
      --ios-bundle-id="$IOS_BUNDLE_ID" \
      --out=lib/firebase_options.dart \
      --yes
  else
    log "Running flutterfire configure (interactive — pick your Firebase project)"
    log "Tip: export FIREBASE_PROJECT_ID=your-project-id to skip the project picker"
    flutterfire configure \
      --platforms=android,ios,web \
      --android-package-name="$ANDROID_PACKAGE" \
      --ios-bundle-id="$IOS_BUNDLE_ID" \
      --out=lib/firebase_options.dart
  fi
}

add_android_debug_sha() {
  local keystore="$HOME/.android/debug.keystore"
  if [ ! -f "$keystore" ]; then
    warn "Debug keystore not found at $keystore — run the app once or create the keystore"
    return
  fi

  local sha1
  sha1="$(
    keytool -list -v \
      -keystore "$keystore" \
      -alias androiddebugkey \
      -storepass android -keypass android 2>/dev/null \
      | awk -F': ' '/SHA1:/ {print $2; exit}' \
      | tr -d '[:space:]'
  )"

  if [ -z "$sha1" ]; then
    warn "Could not read SHA-1 from debug keystore"
    return
  fi

  log "Android debug SHA-1: $sha1"

  if [ -z "${FIREBASE_PROJECT_ID:-}" ]; then
    warn "Set FIREBASE_PROJECT_ID to register SHA-1 via CLI, or add it in Google Cloud Console"
    return
  fi

  local android_app_id
  android_app_id="$(
    firebase apps:list --project="$FIREBASE_PROJECT_ID" --json 2>/dev/null \
      | python3 -c "
import json, sys
apps = json.load(sys.stdin).get('result', [])
for a in apps:
    if a.get('platform') == 'ANDROID':
        print(a['appId'])
        break
" 2>/dev/null || true
  )"

  if [ -z "$android_app_id" ]; then
    warn "Could not find Android app ID. Add SHA-1 manually in Firebase/Google Cloud Console"
    return
  fi

  log "Registering SHA-1 with Firebase app: $android_app_id"
  firebase apps:android:sha:create "$android_app_id" "$sha1" \
    --project="$FIREBASE_PROJECT_ID" 2>/dev/null \
    || warn "SHA-1 may already be registered (or run failed — add manually if needed)"

  log "Re-running flutterfire configure to refresh google-services.json"
  flutterfire configure \
    --project="$FIREBASE_PROJECT_ID" \
    --platforms=android,ios,web \
    --android-package-name="$ANDROID_PACKAGE" \
    --ios-bundle-id="$IOS_BUNDLE_ID" \
    --out=lib/firebase_options.dart \
    --yes
}

print_ios_url_scheme_hint() {
  local plist="$ROOT/ios/Runner/GoogleService-Info.plist"
  if [ ! -f "$plist" ]; then
    return
  fi
  if command -v /usr/libexec/PlistBuddy >/dev/null 2>&1; then
    local reversed
    reversed="$(/usr/libexec/PlistBuddy -c 'Print :REVERSED_CLIENT_ID' "$plist" 2>/dev/null || true)"
    if [ -n "$reversed" ] && [ "$reversed" != "com.googleusercontent.apps.REPLACE_ME" ]; then
      log "iOS: add URL scheme to ios/Runner/Info.plist: $reversed"
    fi
  fi
}

print_manual_steps() {
  cat <<'EOF'

----------------------------------------------------------------------
CLI already handled:
  • flutterfire configure → lib/firebase_options.dart, google-services.json, GoogleService-Info.plist
  • firebase deploy --only auth → Google sign-in provider enabled

Optional — raw web SDK JSON (not used by Flutter directly):
  firebase apps:sdkconfig WEB <web-app-id> --project=cyberhybridhub

Manual if needed:
  • Google Cloud → Credentials → Web client → Authorized JavaScript origins:
      http://localhost:8080  (see web_dev_config.yaml)
  • OAuth consent screen if Google prompts during first sign-in
  • iOS: add REVERSED_CLIENT_ID as URL scheme in Info.plist (see above)
----------------------------------------------------------------------

Then verify:
  cd ~/cyberhybridhub.com
  flutter pub get
  flutter run -d web-server

EOF
}

main() {
  log "Cyber Hybrid Hub — Firebase Google auth setup"
  ensure_bashrc
  ensure_node_tools
  ensure_flutter_tools
  login_if_needed
  ensure_firebaserc
  configure_flutterfire
  enable_google_auth
  add_android_debug_sha
  print_ios_url_scheme_hint

  cd "$ROOT"
  flutter pub get

  print_manual_steps
  log "Done."
}

main "$@"