source ./env.sh

# Switch to the workload identity federation configuration created by test_wif.sh
gcloud config configurations activate wif-test

# Check the agent pool
gcloud transfer agent-pools describe "${STS_AGENT_POOL}"

# Create the transfer job and wait for its first run
gcloud transfer jobs create "posix://${STS_SOURCE_DIR}/" "gs://${BUCKET}/ext-storage/" \
    --name="${STS_JOB_NAME}" \
    --source-agent-pool="${STS_AGENT_POOL}" \
    --overwrite-when=different \
    --no-async

# List the operations of the job and the transferred objects
gcloud transfer operations list --job-names="${STS_JOB_NAME}" --expand-table
gcloud storage ls --recursive "gs://${BUCKET}/ext-storage/"

# Then, switch back to your original account
gcloud config configurations activate default

# List the audit log of the operations made by the service account, including the Storage Transfer calls
gcloud logging read \
    "protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
    --project="${PROJECT_ID}" \
    --freshness=1h \
    --order=asc \
    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"