Firebase Authentication in Android

dependencies {
    implementation(platform("com.google.firebase:firebase-bom:<latest>"))
    implementation("com.google.firebase:firebase-auth")
    // Google sign-in through Credential Manager
    implementation("androidx.credentials:credentials:<version>")
    implementation("androidx.credentials:credentials-play-services-auth:<version>")
    implementation("com.google.android.libraries.identity.googleid:googleid:<version>")
}

class AuthRepository(private val auth: FirebaseAuth = Firebase.auth) {

    /** Emits the current user (or null) and every change. */
    val currentUser: Flow<FirebaseUser?> = callbackFlow {
        val listener = FirebaseAuth.AuthStateListener { trySend(it.currentUser) }
        auth.addAuthStateListener(listener)
        awaitClose { auth.removeAuthStateListener(listener) }
    }

    suspend fun signIn(email: String, password: String): FirebaseUser =
        auth.signInWithEmailAndPassword(email.trim(), password).await().user!!

    suspend fun register(email: String, password: String): FirebaseUser {
        val user = auth.createUserWithEmailAndPassword(email.trim(), password).await().user!!
        user.sendEmailVerification().await()
        return user
    }

    suspend fun sendPasswordReset(email: String) { auth.sendPasswordResetEmail(email.trim()).await() }

    suspend fun signInWithGoogleIdToken(idToken: String): FirebaseUser =
        auth.signInWithCredential(GoogleAuthProvider.getCredential(idToken, null)).await().user!!

    /** Fresh ID token for calls to your own backend. */
    suspend fun idToken(forceRefresh: Boolean = false): String? =
        auth.currentUser?.getIdToken(forceRefresh)?.await()?.token

    fun signOut() = auth.signOut()
}

suspend fun requestGoogleIdToken(activity: Activity, webClientId: String): String? {
    val credentialManager = CredentialManager.create(activity)
    val option = GetGoogleIdOption.Builder()
        .setServerClientId(webClientId)              // "Web client" ID from your Firebase/Google Cloud project
        .setFilterByAuthorizedAccounts(false)        // show all Google accounts on the device
        .build()
    val request = GetCredentialRequest.Builder().addCredentialOption(option).build()

    return try {
        val credential = credentialManager.getCredential(activity, request).credential
        if (credential is CustomCredential && credential.type == GoogleIdTokenCredential.TYPE_GOOGLE_ID_TOKEN_CREDENTIAL) {
            GoogleIdTokenCredential.createFrom(credential.data).idToken
        } else null
    } catch (e: GetCredentialCancellationException) {
        null                                          // user dismissed the sheet
    } catch (e: GetCredentialException) {
        null                                          // no accounts, misconfiguration, etc.
    }
}
// val token = requestGoogleIdToken(activity, getString(R.string.default_web_client_id))
// token?.let { authRepository.signInWithGoogleIdToken(it) }

@Composable
fun AppRoot(authRepository: AuthRepository) {
    val user by authRepository.currentUser.collectAsStateWithLifecycle(initialValue = null)
    if (user == null) SignInFlow() else MainApp()
}

class FirebaseTokenInterceptor(private val auth: FirebaseAuth) : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        // getIdToken may refresh over the network; Tasks.await blocks this OkHttp thread (not main).
        val token = auth.currentUser?.let { Tasks.await(it.getIdToken(false)).token }
        val request = chain.request().newBuilder().apply {
            if (token != null) header("Authorization", "Bearer $token")
        }.build()
        return chain.proceed(request)
    }
}