source ./env.sh

# Enable the Storage Transfer API
gcloud services enable storagetransfer.googleapis.com --project="${PROJECT_ID}"

# Create the Storage Transfer service agent on first use and show its email
curl -s \
    -H "X-Goog-User-Project: ${PROJECT_ID}" \
    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
    "https://storagetransfer.googleapis.com/v1/googleServiceAccounts/${PROJECT_ID}"

# Allow the service agent to manage the Pub/Sub topics of the agent pools
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${STS_SERVICE_AGENT}" \
    --role=roles/storagetransfer.serviceAgent

# Allow the service agent to read the bucket metadata, check the transferred objects and write transfer logs
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
    --member="serviceAccount:${STS_SERVICE_AGENT}" \
    --role=roles/storage.legacyBucketReader
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
    --member="serviceAccount:${STS_SERVICE_AGENT}" \
    --role=roles/storage.objectViewer
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
    --member="serviceAccount:${STS_SERVICE_AGENT}" \
    --role=roles/storage.objectCreator

# Allow the service account to create and run transfer jobs
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role=roles/storagetransfer.user
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role=roles/iam.roleViewer

# Allow the service account to act as a transfer agent
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role=roles/storagetransfer.transferAgent

# Allow the transfer agent to write objects, including multipart uploads, to the bucket
gcloud storage buckets add-iam-policy-binding "gs://${BUCKET}" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role=roles/storage.objectAdmin

# Create the agent pool
gcloud transfer agent-pools create "${STS_AGENT_POOL}" \
    --project="${PROJECT_ID}" \
    --display-name="Dom Lab Agents" \
    --no-async