#!/bin/bash

# SKYXOPS GCP IAM Setup Script
# This script creates a service account and grants minimal read-only permissions
# for SKYXOPS to access client GCP resources for billing and resource metadata analysis

# Script creates:
# - A service account for SKYXOPS cross-project access
# - Read-only permissions for billing data analysis
# - Read-only access to resource metadata and monitoring
# - Organization and project hierarchy access
# - Service account key for authentication

set -e

# Configuration Variables - UPDATE THESE VALUES
CLIENT_ID=""                    # Client identifier (required)
PROJECT_ID=""                   # GCP Project ID (required)
SKYXOPS_PROJECT_ID=""          # SKYXOPS Project ID for cross-project access (required)
BILLING_DATASET=""             # BigQuery billing dataset name (optional)

# Validate required parameters
if [[ -z "$CLIENT_ID" || -z "$PROJECT_ID" || -z "$SKYXOPS_PROJECT_ID" ]]; then
    echo "Error: CLIENT_ID, PROJECT_ID, and SKYXOPS_PROJECT_ID must be set"
    echo "Please edit this script and set the configuration variables"
    exit 1
fi

# Service Account Configuration
SERVICE_ACCOUNT_NAME="skyxops-${CLIENT_ID}-focus-billing-readonly"
SERVICE_ACCOUNT_EMAIL="${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"
DISPLAY_NAME="SKYXOPS ${CLIENT_ID} Focus Billing Resource Readonly"

echo "Creating SKYXOPS service account for client: ${CLIENT_ID}"
echo "Project: ${PROJECT_ID}"
echo "Service Account: ${SERVICE_ACCOUNT_EMAIL}"

# Create service account
echo "Creating service account..."
if gcloud iam service-accounts describe "${SERVICE_ACCOUNT_EMAIL}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
    echo "Service account ${SERVICE_ACCOUNT_EMAIL} already exists, skipping creation"
else
    gcloud iam service-accounts create "${SERVICE_ACCOUNT_NAME}" \
        --project="${PROJECT_ID}" \
        --display-name="${DISPLAY_NAME}" \
        --description="SKYXOPS service account for billing and resource metadata access"
fi

# Grant IAM roles at project level
echo "Granting project-level permissions..."

# Basic viewer access for resource discovery
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/viewer"

# Monitoring access for metrics and performance data
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/monitoring.viewer"

# Cloud Asset API access for resource inventory
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/cloudasset.viewer"

# BigQuery access for billing data (if billing dataset specified)
if [[ -n "$BILLING_DATASET" ]]; then
    echo "Granting BigQuery billing dataset access..."
    gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
        --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
        --role="roles/bigquery.dataViewer"
fi

# Organization-level permissions (if organization exists)
ORG_ID=$(gcloud organizations list --format="value(name)" --limit=1 2>/dev/null || echo "")
if [[ -n "$ORG_ID" ]]; then
    echo "Granting organization-level permissions..."
    
    # Organization viewer
    gcloud organizations add-iam-policy-binding "${ORG_ID}" \
        --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
        --role="roles/resourcemanager.organizationViewer" || echo "Warning: Could not grant organization viewer role"
    
    # Folder viewer
    gcloud organizations add-iam-policy-binding "${ORG_ID}" \
        --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
        --role="roles/resourcemanager.folderViewer" || echo "Warning: Could not grant folder viewer role"
else
    echo "No organization found, skipping organization-level permissions"
fi

# Grant cross-project access to SKYXOPS project
echo "Granting cross-project access to SKYXOPS project..."
gcloud projects add-iam-policy-binding "${SKYXOPS_PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/iam.serviceAccountTokenCreator" || echo "Warning: Could not grant token creator role to SKYXOPS project"

# Create and download service account key
KEY_FILE="skyxops-${CLIENT_ID}-service-account-key.json"
echo "Creating service account key..."
gcloud iam service-accounts keys create "${KEY_FILE}" \
    --iam-account="${SERVICE_ACCOUNT_EMAIL}" \
    --project="${PROJECT_ID}"

# Set labels on service account (if supported)
echo "Setting labels on service account..."
gcloud iam service-accounts update "${SERVICE_ACCOUNT_EMAIL}" \
    --project="${PROJECT_ID}" \
    --update-labels="vendor=skyxops-com,client=${CLIENT_ID},purpose=billing-readonly" || echo "Warning: Could not set labels"

echo ""
echo "=== SKYXOPS GCP IAM Setup Complete ==="
echo "Service Account: ${SERVICE_ACCOUNT_EMAIL}"
echo "Key File: ${KEY_FILE}"
echo ""
echo "IMPORTANT: Securely share the key file (${KEY_FILE}) with SKYXOPS"
echo "Do not commit this key file to version control"
echo ""
echo "Roles granted:"
echo "- roles/viewer (project-level resource access)"
echo "- roles/monitoring.viewer (monitoring metrics)"
echo "- roles/cloudasset.viewer (asset inventory)"
if [[ -n "$BILLING_DATASET" ]]; then
    echo "- roles/bigquery.dataViewer (billing data access)"
fi
if [[ -n "$ORG_ID" ]]; then
    echo "- roles/resourcemanager.organizationViewer (organization structure)"
    echo "- roles/resourcemanager.folderViewer (folder structure)"
fi
echo "- roles/iam.serviceAccountTokenCreator (cross-project access to SKYXOPS)"
echo ""