# Reminds to rotate service account key after chat/WhatsApp exposure.
$ErrorActionPreference = 'Continue'
$root = Split-Path $PSScriptRoot -Parent

$exposedKeyId = '7b344d0c41db87bd3251080af6aa240c38076c37'
$localPaths = @(
    (Join-Path $root 'api\firebase-service-account.local.json'),
    (Join-Path $root 'super-admin-panel\api\firebase-service-account.local.json')
)

Write-Host "SECURITY: Service account key was shared outside secure storage." -ForegroundColor Yellow
Write-Host "Follow: $root\FIREBASE_KEY_ROTATION.md" -ForegroundColor Yellow
Write-Host ""

foreach ($p in $localPaths) {
    if (-not (Test-Path $p)) { continue }
    $j = Get-Content $p -Raw | ConvertFrom-Json
    if ($j.private_key_id -eq $exposedKeyId) {
        Write-Host "STILL USING EXPOSED KEY: $p (id $exposedKeyId)" -ForegroundColor Red
        Write-Host "  -> Rotate in Google Cloud Console, then replace all 4 JSON copies + production server."
    } else {
        Write-Host "OK rotated or different key: $p" -ForegroundColor Green
    }
}

$whatsappPatterns = @(
    "$env:LOCALAPPDATA\Packages\*\LocalState\sessions\*\transfers\*\arafstore-14938-firebase-adminsdk*.json",
    "$env:USERPROFILE\Downloads\arafstore-14938-firebase-adminsdk*.json"
)
foreach ($pat in $whatsappPatterns) {
    Get-ChildItem -Path $pat -ErrorAction SilentlyContinue | ForEach-Object {
        Write-Host "DELETE exposed copy: $($_.FullName)" -ForegroundColor Red
    }
}

Write-Host ""
Write-Host "Never commit firebase-service-account.local.json (gitignored)."
