/**
 * passkeys-firefox.ts — MAIN-world detection layer for Firefox 150+.
 *
 * Firefox does not expose `chrome.webAuthenticationProxy`, so Peach cannot
 * intercept WebAuthn calls the way it does on Chrome. Instead, this script
 * runs in the page's main world (per `manifest.firefox.json`'s `world: "MAIN"`)
 * and monkey-patches `navigator.credentials.create` / `.get` to *observe*
 * passkey activity and emit CustomEvents the rest of Peach can react to.
 *
 * The original calls always proceed unchanged. Peach never blocks, modifies,
 * or replaces the page's own WebAuthn flow from here. Registration and
 * authentication on behalf of the user happen separately, from the popup
 * context, where Firefox 150+ allows extensions to call `navigator.credentials`
 * directly with their own host-permitted RP ID.
 *
 * Events emitted:
 *   `peach:passkey-create` — page invoked navigator.credentials.create with
 *                            a publicKey option set. detail = { rpId, userName }
 *   `peach:passkey-get`    — page invoked navigator.credentials.get with a
 *                            publicKey option set. detail = { rpId, allowCredentials }
 */

(() => {
  const credentials = navigator.credentials;
  if (!credentials || typeof credentials.create !== "function" || typeof credentials.get !== "function") {
    return;
  }

  const FLAG = "__peachPasskeysFirefoxAttached";
  const w = window as unknown as Record<string, unknown>;
  if (w[FLAG]) return;
  w[FLAG] = true;

  const originalCreate = credentials.create.bind(credentials);
  const originalGet = credentials.get.bind(credentials);

  credentials.create = async function patchedCreate(options) {
    const publicKey = options?.publicKey;
    if (publicKey) {
      try {
        window.dispatchEvent(
          new CustomEvent("peach:passkey-create", {
            detail: {
              rpId: publicKey.rp?.id ?? location.hostname,
              userName: publicKey.user?.name,
            },
          })
        );
      } catch { /* dispatching must never break the page */ }
    }
    return originalCreate(options);
  };

  credentials.get = async function patchedGet(options) {
    const publicKey = options?.publicKey;
    if (publicKey) {
      try {
        window.dispatchEvent(
          new CustomEvent("peach:passkey-get", {
            detail: {
              rpId: publicKey.rpId ?? location.hostname,
              allowCredentials: publicKey.allowCredentials,
            },
          })
        );
      } catch { /* dispatching must never break the page */ }
    }
    return originalGet(options);
  };
})();