# yaml-language-server: $schema=https://taskfile.dev/schema.json

# Copyright 2024 Google LLC. This software is provided as-is, without
# warranty or representation for any use or purpose. Your use of it is
# subject to your agreement with Google.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


version: "3"

tasks:
  core-login:
    run: once
    desc: Login to gcloud CLI and set the Application Default Credentials to your user account in a single step
    interactive: true
    internal: true
    silent: true
    cmds:
      - gcloud auth login --no-launch-browser --brief
      - gcloud config set project {{ .GCP_PROJECT_ID }} > /dev/null 2>&1
    # Only run this task if the authentication is expired
    status:
      # First check if the user login has expired
      - gcloud auth print-access-token > /dev/null 2>&1
      # Second, verify that a user is logged as the ADC in and not an impersonated service account
      - bash ./is_user_adc.sh
    requires:
      vars: [GCP_PROJECT_ID]

  core-login-update-adc:
    run: once
    desc: Login to gcloud CLI and set the Application Default Credentials to your user account in a single step
    interactive: true
    internal: true
    silent: true
    cmds:
      - gcloud auth login --no-launch-browser --update-adc --brief
      - gcloud auth application-default set-quota-project {{ .GCP_PROJECT_ID }} > /dev/null 2>&1
      - gcloud config set project {{ .GCP_PROJECT_ID }} > /dev/null 2>&1
    # Only run this task if the authentication is expired
    status:
      # First check if the user login has expired
      - gcloud auth print-access-token > /dev/null 2>&1
      # Second check if the ADC authentication has expired
      - gcloud auth application-default print-access-token > /dev/null 2>&1
      # Third, verify that a user is logged as the ADC in and not an impersonated service account
      - bash ./is_user_adc.sh
    requires:
      vars: [GCP_PROJECT_ID]

  adc-login-impersonate-sa:
    run: once
    internal: true
    interactive: true    
    cmds:
    - gcloud auth application-default login --impersonate-service-account {{ .GCP_SERVICE_ACCOUNT }}
    deps: [core-login]
    # Only run this task if the authentication is expired and the service account doesn't match what's in the creds json
    status:
      # First check if the ADC authentication has expired
      - gcloud auth application-default print-access-token > /dev/null 2>&1
      # Second, verify that ADC is set to the impersonated service account
      - bash ./is_service_account_adc.sh {{ .GCP_SERVICE_ACCOUNT }}
    requires:
      vars: [GCP_PROJECT_ID, GCP_SERVICE_ACCOUNT]

  login:
    desc: Login to gcloud CLI to '{{ .GCP_PROJECT_ID }}' with ADC as user
    run: once
    silent: true
    cmds:
      - task: core-login-update-adc
      - gcloud config list --format="table[all-box, title='User Signed In'](core.account,core.project)"
    requires:
      vars: [GCP_PROJECT_ID]

  login-sa:
    desc: Login to gcloud CLI to '{{ .GCP_PROJECT_ID }}' with ADC as Service Account '{{ .GCP_SERVICE_ACCOUNT }}'
    run: once
    silent: true
    cmds:
      - task: adc-login-impersonate-sa
      - gcloud config list --format="table[all-box, title='User Signed In'](core.account,core.project)"
    requires:
      vars: [GCP_PROJECT_ID]

  revoke:
    desc: Revoke both Application Default Credentials and User Credentials
    run: once
    silent: true
    cmds:
      - cmd: gcloud auth application-default revoke --quiet
        ignore_error: true
      - cmd: gcloud auth revoke --quiet
        ignore_error: true
      - gcloud config list --format="table[all-box, title='User Signed In'](core.account,core.project)"