# Validates local Firebase service account JSON (no PHP required).
# OAuth test still needs PHP on server: see deploy/firebase-server-files/README-DEPLOY.txt

$ErrorActionPreference = 'Stop'
$root = Split-Path $PSScriptRoot -Parent

$paths = @(
    (Join-Path $root 'api\firebase-service-account.local.json'),
    (Join-Path $root 'super-admin-panel\api\firebase-service-account.local.json'),
    (Join-Path $root 'deploy\firebase-server-files\api\firebase-service-account.local.json'),
    (Join-Path $root 'deploy\firebase-server-files\super-admin-panel\api\firebase-service-account.local.json')
)

$expectedProject = 'arafstore-14938'
$fail = 0

foreach ($p in $paths) {
    if (-not (Test-Path $p)) {
        Write-Host "FAIL missing: $p" -ForegroundColor Red
        $fail++
        continue
    }
    $j = Get-Content $p -Raw | ConvertFrom-Json
    $ok = ($j.project_id -eq $expectedProject) `
        -and ($j.client_email -match '@arafstore-14938\.iam\.gserviceaccount\.com$') `
        -and ($j.private_key -match 'BEGIN PRIVATE KEY')
    if ($ok) {
        Write-Host "OK $p" -ForegroundColor Green
    } else {
        Write-Host "FAIL invalid content: $p" -ForegroundColor Red
        $fail++
    }
}

if ($fail -gt 0) { exit 1 }
Write-Host "All service account JSON files valid for $expectedProject."
