// Pulumi OIDC Configuration
const issuer = '<https://api.pulumi.com/oidc>';
const pulumiOrg = pulumi.getOrganization();

// Update the audience to use the correct format
const subIdPrefix = `pulumi:deploy:org:${pulumiOrg}:project:core:stack:${env}:operation`;
const subOperations = ['preview:scope:write', 'update:scope:write', 'refresh:scope:write', 'destroy:scope:write'];
const subIds = subOperations.map((operation) => `${subIdPrefix}:${operation}`);

// Create a Workload Identity Pool
const identityPool = new gcp.iam.WorkloadIdentityPool('pulumiOidcWorkloadIdentityPool', {
  workloadIdentityPoolId: `pl-oidc-id-pool-${env}`,
  description: 'Pulumi OIDC Workload Identity Pool',
  displayName: 'Pulumi OIDC Identity Pool',
});

// Create a Workload Identity Provider
const identityProvider = new gcp.iam.WorkloadIdentityPoolProvider('pulumiOidcIdentityProvider', {
  workloadIdentityPoolId: identityPool.workloadIdentityPoolId,
  workloadIdentityPoolProviderId: `pl-oidc-provider-${env}`,
  attributeMapping: {
    'google.subject': 'assertion.sub',
  },
  oidc: {
    issuerUri: issuer,
    allowedAudiences: [pulumiOrg],
  },
});

// Create a service account for OIDC
const oidcServiceAccount = new gcp.serviceaccount.Account('pulumiOidcServiceAccount', {
  accountId: `pl-oidc-sa-${env}`,
  displayName: 'Pulumi OIDC Service Account',
});

// Grant the service account editor role
const editorPolicyBinding = new gcp.projects.IAMMember('pulumiEditorIamBinding', {
  member: pulumi.interpolate`serviceAccount:${oidcServiceAccount.email}`,
  // TODO: Use a custom role instead of owner
  role: 'roles/owner',
  project: projectId,
});

const members = subIds.map(
  (subId) => pulumi.interpolate`<principal://iam.googleapis.com/${identityPool.name}/subject/${subId}>`
);

// Allow the workload identity pool to impersonate the service account
const iamPolicyBinding = new gcp.serviceaccount.IAMBinding('pulumiIamPolicyBinding', {
  serviceAccountId: oidcServiceAccount.name,
  role: 'roles/iam.workloadIdentityUser',
  members,
});

const settings = new pulumiService.DeploymentSettings('pulumiDeploymentSettings', {
  organization: pulumiOrg,
  project: repoName,
  stack: env,
  operationContext: {
    environmentVariables: {},
    oidc: {
      gcp: {
        projectId: projectId,
        providerId: identityProvider.workloadIdentityPoolProviderId,
        serviceAccount: oidcServiceAccount.email,
        tokenLifetime: '1h0m0s',
        workloadPoolId: identityPool.workloadIdentityPoolId,
      },
    },
  },
  sourceContext: {
    git: {
      branch: 'kaden/fix_pulumi_oidc',
      repoDir: 'pulumi',
    },
  },
  github: {
    repository: `OrgName/${repoName}`,
    previewPullRequests: true,
    deployCommits: true,
    paths: ['pulumi/**'],
  },
  cacheOptions: {
    enable: true,
  },
});

pulumi:pulumi:Stack my-project-id running warning: resource plugin pulumiservice is expected to have version >=0.27.4, but has 0.0.1; the wrong version may be on your path, or this may be a bug in the plugin 
  ~  gcp:sql:DatabaseInstance corePostgresql updating (0s) [diff: ~settings] 
     gcp:sql:DatabaseInstance corePostgresql 
   error:   sdk-v2/provider2.go:515: sdk.helper_schema: Error when reading or editing SQL Database Instance "core-postgresql-staging-us-west3": Get "<https://sqladmin.googleapis.com/sql/v1beta4/projects/my-project-id/instances/core-postgresql-staging-us-west3?alt=json&prettyPrint=false>": oauth2/google: unable to generate access token: Post "<https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/pl-oidc-sa-staging@my-project-id.iam.gserviceaccount.com:generateAccessToken>": oauth2/google: status code 400: {"error":"invalid_target","error_description":"The target service indicated by the \"audience\" parameters is invalid. This might either be because the pool or provider is disabled or deleted or because it doesn't exist."}: provider=google-beta@8.16.0 
  ~  gcp:sql:DatabaseInstance corePostgresql updating (0s) [diff: ~settings]; error: 1 error occurred: 
  ~  gcp:sql:DatabaseInstance corePostgresql **updating failed** [diff: ~settings]; error: 1 error occurred: 
     pulumi:pulumi:Stack my-project-id running error: update failed 
     pulumi:pulumi:Stack my-project-id **failed** 1 error; 1 warning 
     gcp:sql:DatabaseInstance corePostgresql 
  **failed** 1 error 
 Diagnostics: 
   gcp:sql:DatabaseInstance (corePostgresql 
 ): 
     error:   sdk-v2/provider2.go:515: sdk.helper_schema: Error when reading or editing SQL Database Instance "core-postgresql-staging-us-west3": Get "<https://sqladmin.googleapis.com/sql/v1beta4/projects/my-project-id/instances/core-postgresql-staging-us-west3?alt=json&prettyPrint=false>": oauth2/google: unable to generate access token: Post "<https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/pl-oidc-sa-staging@my-project-id.iam.gserviceaccount.com:generateAccessToken>": oauth2/google: status code 400: {"error":"invalid_target","error_description":"The target service indicated by the \"audience\" parameters is invalid. This might either be because the pool or provider is disabled or deleted or because it doesn't exist."}: provider=google-beta@8.16.0