setup.sh

#!/usr/bin/env bash
# ============================================================================
# Google Workspace AI Security Analyzer — Automated Setup
# ============================================================================
# Uses OAuth 2.0 (Desktop app) — no service account keys required.
#
# This script automates:
#   1. Python virtual environment + dependencies
#   2. GCP project selection/creation
#   3. Admin SDK API enabling
#   4. OAuth consent screen + client ID creation
#   5. .env file generation
# ============================================================================

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
BOLD='\033[1m'
DIM='\033[2m'
NC='\033[0m'

print_step()   { echo -e "\n${CYAN}${BOLD}[$1/${TOTAL_STEPS}]${NC} ${BOLD}$2${NC}"; }
print_ok()     { echo -e "  ${GREEN}✔${NC} $1"; }
print_warn()   { echo -e "  ${YELLOW}⚠${NC} $1"; }
print_err()    { echo -e "  ${RED}✖${NC} $1"; }

TOTAL_STEPS=5
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CLIENT_SECRET_FILE="${SCRIPT_DIR}/client_secret.json"

echo -e "${BOLD}"
echo "╔══════════════════════════════════════════════════════════╗"
echo "║   Google Workspace Admin — AI Security Analyzer Setup   ║"
echo "║           (OAuth 2.0 — no service account keys)         ║"
echo "╚══════════════════════════════════════════════════════════╝"
echo -e "${NC}"

# ── Pre-flight checks ──────────────────────────────────────────
print_step 0 "Pre-flight checks"

if ! command -v python3 &>/dev/null; then
    print_err "python3 is not installed. Please install Python 3.8+ first."
    exit 1
fi
print_ok "python3 found: $(python3 --version)"

if ! command -v gcloud &>/dev/null; then
    print_err "gcloud CLI is not installed."
    echo ""
    echo "  Install it from: https://cloud.google.com/sdk/docs/install"
    echo "  Then run:  gcloud auth login"
    exit 1
fi
print_ok "gcloud CLI found: $(gcloud version 2>/dev/null | head -1)"

GCLOUD_ACCOUNT=$(gcloud config get-value account 2>/dev/null || true)
if [[ -z "$GCLOUD_ACCOUNT" || "$GCLOUD_ACCOUNT" == "(unset)" ]]; then
    print_warn "You are not logged into gcloud. Launching login..."
    gcloud auth login
    GCLOUD_ACCOUNT=$(gcloud config get-value account 2>/dev/null)
fi
print_ok "Authenticated as: ${GCLOUD_ACCOUNT}"

# ── Step 1: Python environment ─────────────────────────────────
print_step 1 "Setting up Python virtual environment"

if [[ ! -d "${SCRIPT_DIR}/venv" ]]; then
    python3 -m venv "${SCRIPT_DIR}/venv"
    print_ok "Created virtual environment at ./venv"
else
    print_ok "Virtual environment already exists"
fi

source "${SCRIPT_DIR}/venv/bin/activate"
pip install -q -r "${SCRIPT_DIR}/requirements.txt"
print_ok "Dependencies installed"

# ── Step 2: GCP Project ────────────────────────────────────────
print_step 2 "Google Cloud Project"

echo ""
echo "  Your existing projects:"
gcloud projects list --format="table(projectId, name)" 2>/dev/null | head -15
echo ""

read -rp "  Enter a GCP Project ID to use (or type 'new' to create one): " PROJECT_INPUT

if [[ "$PROJECT_INPUT" == "new" ]]; then
    read -rp "  Enter a new Project ID (lowercase, hyphens ok): " NEW_PROJECT_ID
    read -rp "  Enter a display name for the project: " NEW_PROJECT_NAME
    gcloud projects create "$NEW_PROJECT_ID" --name="$NEW_PROJECT_NAME"
    PROJECT_ID="$NEW_PROJECT_ID"
    print_ok "Created project: ${PROJECT_ID}"
else
    PROJECT_ID="$PROJECT_INPUT"
fi

gcloud config set project "$PROJECT_ID" 2>/dev/null
print_ok "Active project set to: ${PROJECT_ID}"

# ── Step 3: Enable Admin SDK API ──────────────────────────────
print_step 3 "Enabling Admin SDK API"

if gcloud services list --enabled --filter="name:admin.googleapis.com" --format="value(name)" 2>/dev/null | grep -q "admin"; then
    print_ok "Admin SDK API is already enabled"
else
    gcloud services enable admin.googleapis.com
    print_ok "Admin SDK API enabled"
fi

# ── Step 4: OAuth Client ID ───────────────────────────────────
print_step 4 "OAuth 2.0 Client ID"

if [[ -f "$CLIENT_SECRET_FILE" ]]; then
    print_ok "client_secret.json already exists"
    read -rp "  Overwrite it? (y/N): " OVERWRITE_CLIENT
    if [[ ! "$OVERWRITE_CLIENT" =~ ^[Yy]$ ]]; then
        echo "  Keeping existing client_secret.json"
    fi
fi

if [[ ! -f "$CLIENT_SECRET_FILE" ]] || [[ "${OVERWRITE_CLIENT:-}" =~ ^[Yy]$ ]]; then
    echo ""
    echo -e "  ${YELLOW}You need to create an OAuth Client ID in the GCP Console.${NC}"
    echo ""
    echo -e "  ${BOLD}1.${NC} Open: ${CYAN}https://console.cloud.google.com/apis/credentials?project=${PROJECT_ID}${NC}"
    echo -e "  ${BOLD}2.${NC} If prompted, configure the ${BOLD}OAuth Consent Screen${NC}:"
    echo -e "     • User Type: ${BOLD}Internal${NC} (for Workspace orgs)"
    echo -e "     • App name: ${BOLD}Workspace Security Analyzer${NC}"
    echo -e "     • Support email: your email"
    echo -e "     • Save"
    echo -e "  ${BOLD}3.${NC} Go to ${BOLD}Credentials${NC} → ${BOLD}Create Credentials${NC} → ${BOLD}OAuth Client ID${NC}"
    echo -e "     • Application type: ${BOLD}Desktop app${NC}"
    echo -e "     • Name: ${BOLD}Workspace Analyzer CLI${NC}"
    echo -e "  ${BOLD}4.${NC} Click ${BOLD}Download JSON${NC}"
    echo -e "  ${BOLD}5.${NC} Save the file as: ${GREEN}${CLIENT_SECRET_FILE}${NC}"
    echo ""
    read -rp "  Press Enter once you've saved client_secret.json..."

    if [[ ! -f "$CLIENT_SECRET_FILE" ]]; then
        print_err "client_secret.json not found. Please download it and try again."
        exit 1
    fi
    print_ok "client_secret.json found"
fi

# ── Step 5: Generate .env file ────────────────────────────────
print_step 5 "Generating .env configuration"

echo ""
read -rp "  Enter your Workspace domain (e.g., yourcompany.com): " WORKSPACE_DOMAIN
read -rp "  Enter your Gemini API Key (from https://aistudio.google.com/): " GEMINI_KEY

cat > "${SCRIPT_DIR}/.env" <<EOF
WORKSPACE_DOMAIN="${WORKSPACE_DOMAIN}"
OAUTH_CLIENT_FILE="client_secret.json"
TOKEN_FILE="token.json"
GEMINI_API_KEY="${GEMINI_KEY}"
EOF

print_ok ".env file created"

# ── Done ──────────────────────────────────────────────────────
echo ""
echo -e "${GREEN}${BOLD}╔══════════════════════════════════════╗${NC}"
echo -e "${GREEN}${BOLD}║         Setup Complete! 🎉           ║${NC}"
echo -e "${GREEN}${BOLD}╚══════════════════════════════════════╝${NC}"
echo ""
echo -e "  To run the analyzer:"
echo -e "    ${CYAN}source venv/bin/activate${NC}"
echo -e "    ${CYAN}python main.py${NC}"
echo ""
echo -e "  ${DIM}On first run, a browser will open for you to sign in"
echo -e "  with your Workspace admin account. The token is cached"
echo -e "  in token.json for future runs.${NC}"
echo ""