#!/usr/bin/env bash
# Sanitized command reference from Lesson 9, not an automatic setup script.
# Read each section and run selected commands in your authorized Cloud Shell.
# Existing resources should be inspected and reused; do not blindly recreate them.
# No credentials or production identifiers are included.

# 1. Select your own project after creating it and linking billing in the console.
# SWE_PROJECT=YOUR_PROJECT
# SWE_REGION=europe-west1
# gcloud config set project "$SWE_PROJECT"

# 2. Enable the services used by the GitHub-built container deployment.
# gcloud services enable run.googleapis.com artifactregistry.googleapis.com iam.googleapis.com iamcredentials.googleapis.com sts.googleapis.com --project="$SWE_PROJECT"

# 3. Create the container repository and two separate service accounts.
# gcloud artifacts repositories create learning-backend --repository-format=docker --location="$SWE_REGION" --project="$SWE_PROJECT"
# gcloud iam service-accounts create github-deploy --display-name="GitHub deployment" --project="$SWE_PROJECT"
# gcloud iam service-accounts create api-runtime --display-name="API runtime" --project="$SWE_PROJECT"
# SWE_DEPLOY="github-deploy@${SWE_PROJECT}.iam.gserviceaccount.com"
# SWE_RUNTIME="api-runtime@${SWE_PROJECT}.iam.gserviceaccount.com"

# 4. Grant the roles to the deployment identity at the documented scopes.
# gcloud artifacts repositories add-iam-policy-binding learning-backend --location="$SWE_REGION" --project="$SWE_PROJECT" --member="serviceAccount:$SWE_DEPLOY" --role=roles/artifactregistry.writer --condition=None
# gcloud projects add-iam-policy-binding "$SWE_PROJECT" --member="serviceAccount:$SWE_DEPLOY" --role=roles/run.developer --condition=None
# gcloud iam service-accounts add-iam-policy-binding "$SWE_RUNTIME" --project="$SWE_PROJECT" --member="serviceAccount:$SWE_DEPLOY" --role=roles/iam.serviceAccountUser --condition=None
# gcloud projects add-iam-policy-binding "$SWE_PROJECT" --member="serviceAccount:$SWE_DEPLOY" --role=roles/run.invoker --condition=None

# 5. Configure Workload Identity Federation using your real numeric GitHub IDs.
# SWE_OWNER_ID=YOUR_NUMERIC_OWNER_ID
# SWE_REPO_ID=YOUR_NUMERIC_REPOSITORY_ID
# SWE_PROJECT_NUMBER=$(gcloud projects describe "$SWE_PROJECT" --format='value(projectNumber)')
# gcloud iam workload-identity-pools create learning-github --location=global --display-name="Learning GitHub Actions" --project="$SWE_PROJECT"
# gcloud iam workload-identity-pools providers create-oidc github --location=global --workload-identity-pool=learning-github --project="$SWE_PROJECT" --issuer-uri=https://token.actions.githubusercontent.com --attribute-mapping="google.subject=assertion.sub,attribute.repository_id=assertion.repository_id,attribute.repository_owner_id=assertion.repository_owner_id,attribute.ref=assertion.ref" --attribute-condition="assertion.repository_owner_id == '$SWE_OWNER_ID' && assertion.repository_id == '$SWE_REPO_ID' && assertion.ref == 'refs/heads/main'"
# gcloud iam service-accounts add-iam-policy-binding "$SWE_DEPLOY" --project="$SWE_PROJECT" --role=roles/iam.workloadIdentityUser --member="principalSet://iam.googleapis.com/projects/${SWE_PROJECT_NUMBER}/locations/global/workloadIdentityPools/learning-github/attribute.repository_id/${SWE_REPO_ID}" --condition=None
# gcloud iam workload-identity-pools providers describe github --location=global --workload-identity-pool=learning-github --project="$SWE_PROJECT" --format='value(name)'

# 6. After deploying and verifying Auth0 application checks, an administrator
# with the required service IAM permissions can configure application access.
# This was a manual Cloud Shell step in the session. It is not required for
# a design that intentionally uses Google IAM as its invocation boundary.
# gcloud run services update YOUR_SERVICE --project="$SWE_PROJECT" --region="$SWE_REGION" --no-invoker-iam-check

# 7. Check the deployed service configuration; do not print access tokens.
# gcloud run services describe YOUR_SERVICE --project="$SWE_PROJECT" --region="$SWE_REGION" --format='value(status.url)'

# Firestore creation, runtime data permissions and persistence tests belong to
# the next milestone. No database has been created by this reference file.