const admin=require('firebase-admin'),path=require('path')
const SA=path.join(__dirname,'..','closer-app-22014-firebase-adminsdk-fbsvc-ed20bf6003.json')
const PROJECT='closer-app-22014',APIKEY='AIzaSyDAD7FnEYzhMsil41SzJ1XMjUNnJWmjie8',COUPLE='Xal3Kw3gjSdn0niERYKJ'
const QA='Y05AKO2IlTPMa0JQW1BiNIM0uzK2'
admin.initializeApp({credential:admin.credential.cert(require(SA))}); const db=admin.firestore()
const base=`https://firestore.googleapis.com/v1/projects/${PROJECT}/databases/(default)/documents`
const arr=u=>({arrayValue:u.length?{values:u.map(x=>({stringValue:x}))}:{}})
;(async()=>{
  const custom=await admin.auth().createCustomToken(QA)
  const tr=await fetch(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${APIKEY}`,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({token:custom,returnSecureToken:true})})
  const tok=(await tr.json()).idToken
  const snap=await db.collection('couples').doc(COUPLE).collection('sessions').get()
  let pos=null,fc=null
  snap.forEach(d=>{const x=d.data(); const j=x.joinedByUsers||[]; if(!pos && d.id!=='_active' && !j.includes(QA)) pos={id:d.id,j}; if(!fc && d.id!=='_active') fc={id:d.id,c:x.completedByUsers||[]}})
  if(pos){
    const r=await fetch(`${base}/couples/${COUPLE}/sessions/${pos.id}?updateMask.fieldPaths=joinedByUsers`,{method:'PATCH',headers:{Authorization:`Bearer ${tok}`,'Content-Type':'application/json'},body:JSON.stringify({fields:{joinedByUsers:arr([...new Set([...pos.j,QA])])}})})
    console.log(`  ${r.status===200?'✅':'❌❌'} own-uid add joinedByUsers: ${r.status===200?'ALLOWED(200)':'DENIED('+r.status+')'} (expected allow)  [${pos.id}]`)
  } else console.log('  (no session without QA in joinedByUsers to test own-add)')
  const r2=await fetch(`${base}/couples/${COUPLE}/sessions/${fc.id}?updateMask.fieldPaths=completedByUsers`,{method:'PATCH',headers:{Authorization:`Bearer ${tok}`,'Content-Type':'application/json'},body:JSON.stringify({fields:{completedByUsers:arr([...new Set([...fc.c,'bogus-'+Date.now()])])}})})
  console.log(`  ${r2.status!==200?'✅':'❌❌'} foreign-add completedByUsers: ${r2.status!==200?'DENIED('+r2.status+')':'ALLOWED(200)'} (expected deny)  [${fc.id}]`)
  process.exit(0)
})().catch(e=>{console.error('FATAL',e.message);process.exit(2)})