#!/bin/bash
# 00-authcheck.sh — Verify correct gcloud identity and project before any action
# Run in: local VS Code terminal OR Cloud Shell (identical behavior)

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-propane-will-491900-m5}"
REGION="${REGION:-us-central1}"

echo "=== OSVauco-NMTMD-GCOS :: Auth Check ==="

# 1. Confirm gcloud is installed
command -v gcloud >/dev/null 2>&1 || { echo "ERROR: gcloud CLI not found. Install from https://cloud.google.com/sdk/docs/install"; exit 1; }

# 2. Check active account
ACTIVE_ACCOUNT=$(gcloud config get-value account 2>/dev/null)
echo "Active account : $ACTIVE_ACCOUNT"
[ -z "$ACTIVE_ACCOUNT" ] && { echo "ERROR: No active account. Run: gcloud auth login"; exit 1; }

# 3. Set and confirm project
gcloud config set project "$PROJECT_ID" --quiet
ACTIVE_PROJECT=$(gcloud config get-value project)
echo "Active project : $ACTIVE_PROJECT"
[ "$ACTIVE_PROJECT" != "$PROJECT_ID" ] && { echo "ERROR: Project mismatch. Expected $PROJECT_ID, got $ACTIVE_PROJECT"; exit 1; }

# 4. Check Application Default Credentials
if ! gcloud auth application-default print-access-token >/dev/null 2>&1; then
  echo "WARNING: No ADC found. Run: gcloud auth application-default login"
fi

echo ""
echo "Auth check PASSED. Project: $PROJECT_ID | Region: $REGION"
echo "========================================"