source ./env.sh

# Create a new gcloud configuration for the workload identity federation test
gcloud config configurations create wif-test

# Authenticate gcloud with the credentials configuration file
gcloud auth login --cred-file=cred.json

# Set the project
gcloud config set project "${PROJECT_ID}"

# Test the authentication by listing the project details
gcloud auth list
gcloud projects describe "${PROJECT_ID}"
gcloud projects get-iam-policy "${PROJECT_ID}" \
    --flatten="bindings[].members" \
    --format="table(bindings.role, bindings.members)"

# Test the bucket access by uploading and downloading a file
gcloud storage ls "gs://${BUCKET}"
gcloud storage cp README.md "gs://${BUCKET}/README.md"
gcloud storage ls "gs://${BUCKET}"
rm README.downloaded.md
gcloud storage cp "gs://${BUCKET}/README.md" README.downloaded.md
cmp README.md README.downloaded.md

# Then, switch back to your original account
gcloud config configurations activate default

# List the audit log of the operations made by the service account
gcloud logging read \
    "protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
    --project="${PROJECT_ID}" \
    --freshness=1h \
    --order=asc \
    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"

# optionally switch back to the service account for further testing
# gcloud config configurations activate wif-test