#!/usr/bin/env bash
set -e

echo "🔧 Google Cloud ADC Setup Script"
echo "--------------------------------"

# 1️⃣ Check OS
if ! command -v apt >/dev/null; then
  echo "❌ This script currently supports apt-based systems only."
  exit 1
fi

# 2️⃣ Install gcloud if missing
if ! command -v gcloud >/dev/null; then
  echo "📦 Google Cloud SDK not found. Installing..."

  sudo apt update
  sudo apt install -y apt-transport-https ca-certificates gnupg curl

  curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg \
    | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg

  echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] \
https://packages.cloud.google.com/apt cloud-sdk main" \
  | sudo tee /etc/apt/sources.list.d/google-cloud-sdk.list

  sudo apt update
  sudo apt install -y google-cloud-sdk

  echo "✅ Google Cloud SDK installed"
else
  echo "✅ Google Cloud SDK already installed"
fi

# 3️⃣ ADC login with scopes
echo
echo "🔐 Starting Application Default Credentials login..."
echo "ℹ️  Authenticating with Google Sheets and Drive scopes..."

# Check for existing client secrets
DEFAULT_SECRET=$(find whoa -name "client_secret_181713295829-toc6bsk6hak3rdd6huaer6kp06eq7529.apps.googleusercontent.com.json" -print -quit 2>/dev/null)

read -rp "🔑 Enter path to client_secret.json [${DEFAULT_SECRET:-none}]: " CLIENT_SECRET_INPUT
CLIENT_SECRET=${CLIENT_SECRET_INPUT:-$DEFAULT_SECRET}

OPTS=""
if [[ -n "$CLIENT_SECRET" && -f "$CLIENT_SECRET" ]]; then
  echo "Using client secret: $CLIENT_SECRET"
  OPTS="--client-id-file=$CLIENT_SECRET"
else
  echo "⚠️  No client secret provided. You may see 'This app is blocked' errors."
fi

gcloud auth application-default login $OPTS \
  --scopes=https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/cloud-platform

echo "✅ ADC login complete"

# 4️⃣ Ask for project ID
echo
read -rp "🧾 Enter your GCP Project ID [elvoro-483807]: " PROJECT_ID
PROJECT_ID=${PROJECT_ID:-elvoro-483807}

if [[ -z "$PROJECT_ID" ]]; then
  echo "❌ Project ID cannot be empty"
  exit 1
fi

# 5️⃣ Set quota project
echo
echo "📊 Setting quota project to '$PROJECT_ID'..."
gcloud auth application-default set-quota-project "$PROJECT_ID"

# 6️⃣ Optional: set default project
echo
read -rp "⚙️  Set this as default gcloud project? [Y/n]: " SET_DEFAULT
SET_DEFAULT=${SET_DEFAULT:-Y}

if [[ "$SET_DEFAULT" =~ ^[Yy]$ ]]; then
  gcloud config set project "$PROJECT_ID"
fi

# 7️⃣ Verify
echo
echo "🧪 Verifying ADC setup..."

python3 - <<EOF
from google.auth import default
creds, _ = default()
print("✅ ADC OK")
print("Quota project:", creds.quota_project_id)
print("Scopes:", creds.scopes if hasattr(creds, 'scopes') else 'N/A')
EOF

echo
echo "🎉 Setup complete!"
echo "You can now run your Python scripts locally using ADC."
echo
echo "Note: Your credentials are stored at:"
echo "  ~/.config/gcloud/application_default_credentials.json"