# Cloud Function: Signed URL generator
from google.cloud import storage
from datetime import timedelta
import google.auth

def generate_signed_url(request):
    # 1. Verify Firebase JWT
    token = request.headers.get(
        'Authorization', '').split(' ')[-1]
    decoded = verify_firebase_token(token)
    tenant = decoded['tenant_id']
    
    # 2. Build tenant-scoped path
    blob_name = request.args.get('key')
    full_path = f'tenants/{tenant}/{blob_name}'
    
    # 3. Block path traversal
    if '..' in full_path:
        return ('Forbidden', 403)
    
    # 4. Generate V4 signed URL
    client = storage.Client()
    bucket = client.bucket('app-data-prod')
    blob = bucket.blob(full_path)
    
    url = blob.generate_signed_url(
        version='v4',
        expiration=timedelta(minutes=15),
        method='GET'
    )
    return {'url': url}

# IAM binding with condition
resource "google_storage_bucket_iam_member" "tenant" {
  bucket = "app-data-prod"
  role   = "roles/storage.objectViewer"
  member = "principalSet://iam.googleapis.com/
    locations/global/workforcePools/
    tenant-pool/attribute.tenant_id/
    acme-001"

  condition {
    title      = "tenant-prefix-only"
    expression = <<-EOT
      resource.name.startsWith(
        "projects/_/buckets/app-data-prod/
         objects/tenants/acme-001/")
    EOT
  }
}

# Generic policy (dynamic via attribute)
# Uses resource.name condition to match
# the tenant_id attribute from the token

# Bucket configuration
resource "google_storage_bucket" "data" {
  name     = "app-data-prod"
  location = "US"

  uniform_bucket_level_access = true

  versioning { enabled = true }

  lifecycle_rule {
    condition { age = 90 }
    action {
      type          = "SetStorageClass"
      storage_class = "NEARLINE"
    }
  }
  lifecycle_rule {
    condition { age = 365 }
    action {
      type          = "SetStorageClass"
      storage_class = "COLDLINE"
    }
  }

  encryption {
    default_kms_key_name = google_kms_crypto_key
      .default.id
  }

  logging {
    log_bucket = "app-data-access-logs"
  }
}