Firebase

SEQUENZY_PUBLIC_KEY=seq_pk_...

import { logger } from "firebase-functions";
import { defineSecret, defineString } from "firebase-functions/params";
import * as functionsV1 from "firebase-functions/v1";
import { HttpsError, onCall } from "firebase-functions/v2/https";

const SEQUENZY_API_KEY = defineSecret("SEQUENZY_API_KEY");
const SEQUENZY_PUBLIC_KEY = defineString("SEQUENZY_PUBLIC_KEY");
const SEQUENZY_API = "https://api.sequenzy.com/api/v1";

async function sequenzy(method: string, path: string, body?: unknown) {
  const response = await fetch(`${SEQUENZY_API}${path}`, {
    method,
    headers: {
      Authorization: `Bearer ${SEQUENZY_API_KEY.value()}`,
      "Content-Type": "application/json",
    },
    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
  });
  const data = await response.json().catch(() => ({}));
  return { ok: response.ok, status: response.status, data };
}

// Adds the user as a contact, or links an existing contact to their UID.
// "merge" only fills empty fields, so names edited in Sequenzy are kept.
async function syncContact(user: { uid: string; email: string; name?: string }) {
  const [firstName, ...rest] = (user.name ?? "").trim().split(/\s+/);
  const result = await sequenzy("POST", "/subscribers", {
    email: user.email,
    externalId: user.uid,
    ...(firstName ? { firstName } : {}),
    ...(rest.length > 0 ? { lastName: rest.join(" ") } : {}),
    duplicateStrategy: "merge",
  });
  if (!result.ok) {
    logger.warn("Sequenzy contact sync failed", { uid: user.uid, status: result.status, error: result.data });
  }
}

// Called by the app through the SDK's identity token provider.
export const sequenzyIdentityToken = onCall({ secrets: [SEQUENZY_API_KEY] }, async (request) => {
  const token = request.auth?.token;
  if (!request.auth || !token?.email) {
    throw new HttpsError("failed-precondition", "Sign in with an account that has an email address.");
  }
  // Firebase does not check email/password addresses at signup. Without this
  // check, anyone could sign up with another person's email and read their messages.
  if (!token.email_verified) {
    throw new HttpsError("permission-denied", "Verify your email address first.");
  }

  await syncContact({ uid: request.auth.uid, email: token.email, name: token.name });

  const minted = await sequenzy("POST", "/web-tracking-identities", {
    publicKey: SEQUENZY_PUBLIC_KEY.value(),
    email: token.email,
  });
  if (!minted.ok) {
    logger.error("Sequenzy identity token failed", { status: minted.status, error: minted.data });
    throw new HttpsError("unavailable", "Could not reach Sequenzy.");
  }
  return { identityToken: minted.data.identityToken as string };
});

// Optional: users who sign up without opening the app.
export const sequenzyUserCreated = functionsV1
  .runWith({ secrets: [SEQUENZY_API_KEY] })
  .auth.user()
  .onCreate(async (user) => {
    // Google, Apple and other providers verify the address. Email/password
    // users are added by sequenzyIdentityToken once they verify.
    if (!user.email || !user.emailVerified) return;
    await syncContact({ uid: user.uid, email: user.email, name: user.displayName });
  });

// Optional: permanently deletes the contact and erases their recorded data.
export const sequenzyUserDeleted = functionsV1
  .runWith({ secrets: [SEQUENZY_API_KEY] })
  .auth.user()
  .onDelete(async (user) => {
    const result = await sequenzy("DELETE", `/subscribers/external?externalId=${encodeURIComponent(user.uid)}`);
    if (!result.ok && result.status !== 404) {
      // Throwing makes the function fail; enable retries on it to try again.
      throw new Error(`Sequenzy delete failed with status ${result.status}`);
    }
  });

export { sequenzyIdentityToken, sequenzyUserCreated, sequenzyUserDeleted } from "./sequenzy";