// lib/firebase.ts (Client-side)
import { initializeApp } from 'firebase/app'

const firebaseConfig = {
  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY,
  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,
  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
  storageBucket: process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET,
  messagingSenderId: process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID,
  appId: process.env.NEXT_PUBLIC_FIREBASE_APP_ID,
}

// Initialize Firebase
export const app = initializeApp(firebaseConfig)

// lib/firebase-admin.ts (Server-side)
import { initializeApp, getApps, cert } from 'firebase-admin/app'
import type { ServiceAccount } from 'firebase-admin'

// get file from the project console in firebase
import serviceAccount from './firebase-service-account.json'

// Initialize Firebase Admin if not already initialized
if (!getApps().length) {
  initializeApp({
    credential: cert(serviceAccount as ServiceAccount),
  })
}

export default getApps()[0]

// collections/Users.ts
import { APIError, type CollectionConfig, PayloadRequest } from 'payload'
import { firebaseStrategy } from '../auth/firebaseStrategy'
import { getAuth } from 'firebase-admin/auth'

export const Users: CollectionConfig = {
  slug: 'users',
  admin: {
    useAsTitle: 'email',
  },
  auth: {
    strategies: [
      {
        name: 'firebase',
        authenticate: firebaseStrategy.authenticate as any,
      },
    ],
  },
  access: {
    read: ({ req }) => {
      console.log('read', req.user?.email)
      return req.user ? true : false
    },
    create: ({ req }) => {
      console.log('create', req.user?.email)
      return req.user ? true : false
    },
    update: ({ req }) => {
      console.log('update', req.user?.email)
      return req.user ? true : false
    },
  },
  fields: [
    {
      name: 'firebaseUID',
      type: 'text',
      unique: true,
      // Remove required: true to allow admin creation
      admin: {
        description: 'Auto-generated for Firebase users. Leave blank for admin users.',
      },
    },
    {
      name: 'role',
      type: 'select',
      options: ['admin', 'user'],
      defaultValue: 'admin',
    },
  ],
  hooks: { },
  endpoints: [],
}

// src/auth/firebaseStrategy.ts
import { getAuth } from 'firebase-admin/auth'
import '@/lib/firebase-admin' // This ensures Firebase Admin is initialized
import { AuthStrategyResult, Payload, User } from 'payload'

export const firebaseStrategy = {
  name: 'firebase',
  /**
   * Authenticate a user with Firebase
   * @param payload - The Payload instance
   * @param headers - The headers object
   * @returns The authenticated user or null if the user is not found or the token is invalid
   */
  authenticate: async ({ payload, headers }: { payload: Payload; headers: Headers }) => {
    try {
      // Get the token from Authorization header
      const token = headers.get('authorization')?.split(' ')[1]
      if (!token) return { user: null }

      // Verify Firebase token
      const decodedToken = await getAuth().verifyIdToken(token, true)

      // Find or create user in Payload
      const { docs: users } = await payload.find({
        collection: 'users',
        where: {
          firebaseUID: {
            equals: decodedToken.uid,
          },
        },
      })

      if (users?.[0]) {
        console.log('User found in Payload:', users[0])
        return {
          user: users[0] as any,
        }
      }

      // Create new user if not found, even though password is optional,
      // we need to provide a value for it or the user will not be created
      const newUser = await payload.create({
        collection: 'users',
        data: {
          email: decodedToken.email!,
          firebaseUID: decodedToken.uid,
          password: 'password', // TODO: More Research on this
          role: 'user',
        },
      })

      return {
        user: newUser as unknown as User,
      } as AuthStrategyResult
    } catch (error) {
      console.error('Firebase auth error:', error)
      return { user: null }
    }
  },
}

  hooks: {
    // Validate that firebaseUID is present for non-admin users
    beforeValidate: [
      ({ data, operation }) => {
        console.log('data', data?.email, operation)
        // Skip validation for admin users
        if (data?.role === 'admin') {
          return data
        }

        // Require firebaseUID for regular users
        if (!data?.firebaseUID && operation === 'create') {
          throw new APIError('firebaseUID is required for non-admin users')
        }

        return data
      },
    ],
  },

endpoints: [
    /**
     * Revoke a Firebase token
     * @param token - The Firebase token to revoke
     * @returns A message indicating the token was revoked successfully
     */
    {
      path: '/revoke-token',
      method: 'post',
      handler: async (req: PayloadRequest) => {
        try {
          const token = req.headers.get('authorization')?.split(' ')[1]
          if (!token) {
            throw new APIError('No token provided', 401)
          }

          // Verify and revoke the token
          const decodedToken = await getAuth().verifyIdToken(token)
          await getAuth().revokeRefreshTokens(decodedToken.uid)
          console.log('Token revoked successfully', decodedToken)

          return Response.json(
            {
              message: 'Token revoked successfully',
            },
            {
              status: 200,
            },
          )
        } catch (error) {
          return Response.json(
            {
              error: error,
              message: 'Token revoked failed',
            },
            {
              status: 500,
            },
          )
        }
      },
    },
  ],

'use client'

import { getAuth, signInWithEmailAndPassword, signOut } from 'firebase/auth'
import { app } from '@/lib/firebase'

const auth = getAuth(app)

export default function FirebaseLogin() {
  /**
   * Sign in with Firebase
   * 1. Sign in with Firebase
   * 2. Get Firebase token
   * 3. Get Payload user
   * 4. Get Media, doing this to test the token
   *
   * @param email
   * @param password
   */
  async function signInWithFirebase(email: string, password: string) {
    try {
      // 1. Sign in with Firebase
      const result = await signInWithEmailAndPassword(auth, email, password)
      if (!result.user) {
        throw new Error('Failed to authenticate with Firebase')
      }

      // 2. Get Firebase token
      const firebaseToken = await result.user.getIdToken()
      localStorage.setItem('firebaseToken', firebaseToken)

      // 3. Get Payload user
      const response = await fetch(`/api/users?where[firebaseUID][equals]=${result.user.uid}`, {
        method: 'GET',
        headers: {
          Authorization: `Bearer ${firebaseToken}`,
        },
      })

      if (!response.ok) {
        throw new Error('Failed to get user: ' + response.statusText)
      }

      const data = await response.json()
      console.log('Payload user:', data)

      // 4. Get Media, doing this to test the token
      const mediaResponse = await fetch('/api/media', {
        method: 'GET',
        headers: {
          Authorization: `Bearer ${firebaseToken}`,
        },
      })

      const mediaData = await mediaResponse.json()
      console.log('Media:', mediaData)

      return data.user
    } catch (error) {
      console.error('Authentication error:', error)
      throw error
    }
  }

  /**
   * Sign out with Firebase
   * 1. Sign out from Firebase
   * 2. Revoke token on server
   * 3. Remove token from localStorage
   */
  async function signOutWithFirebase() {
    try {
      await signOut(auth)

      const token = localStorage.getItem('firebaseToken')
      if (token) {
        await fetch('/api/users/revoke-token', {
          method: 'POST',
          headers: {
            Authorization: `Bearer ${token}`,
          },
        })

        localStorage.removeItem('firebaseToken')
      }
    } catch (error) {
      console.error('Sign out error:', error)
      throw error
    }
  }

  return (
    <div>
      <button onClick={() => signInWithFirebase('aaron@mail.com', 'password')}>Sign in</button>
      <button onClick={() => signOutWithFirebase()}>Sign Out</button>
    </div>
  )
}