"""
Generates an authentic, cryptographically signed Firebase ID Token
for your project 'sahih-islam-app' using Firebase Admin and Identity Toolkit.
"""
import sys
import os
import json
import urllib.request
import firebase_admin
from firebase_admin import credentials, auth

base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
cred_path = os.path.join(base_dir, "firebase_credentials.json")

if not os.path.exists(cred_path):
    print(f"Error: Credentials file not found at {cred_path}")
    sys.exit(1)

if not firebase_admin._apps:
    cred = credentials.Certificate(cred_path)
    firebase_admin.initialize_app(cred)

uid = sys.argv[1] if len(sys.argv) > 1 else "loadtest_user_pro"

# 1. Create custom token
custom_token = auth.create_custom_token(uid)
if isinstance(custom_token, bytes):
    custom_token = custom_token.decode("utf-8")

# 2. Exchange for genuine Firebase ID token
WEB_API_KEY = os.getenv("FIREBASE_WEB_API_KEY", "").strip()
if not WEB_API_KEY:
    print("❌ ERROR: FIREBASE_WEB_API_KEY environment variable is required to exchange token.")
    sys.exit(1)
url = f"https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key={WEB_API_KEY}"

payload = json.dumps({"token": custom_token, "returnSecureToken": True}).encode("utf-8")
req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"})

try:
    with urllib.request.urlopen(req) as resp:
        data = json.loads(resp.read().decode("utf-8"))
        id_token = data.get("idToken")
        print("\n" + "=" * 76)
        print("COPIABLE POWERSHELL COMMAND:")
        print("=" * 76)
        print(f'$env:LOCUST_BEARER_TOKEN = "{id_token}"')
        print("=" * 76)
except Exception as e:
    print(f"Failed to exchange token: {e}")