Connect your app to Google Cloud API

#!/usr/bin/env bash
set -euo pipefail

# ---- FILL THESE IN ----
GCP_PROJECT="YOUR_GCP_PROJECT_ID"
WORKSPACE_ID="YOUR_WORKSPACE_ID"

# Roles granted to the service account on GCP_PROJECT. roles/viewer covers
# read-only inventory, monitoring, and logging. Add service-specific roles
# only for the changes your app makes. Leave the list empty to grant roles
# yourself in the console, for example on a folder or organization.
ROLES=("roles/viewer")

# ---- Defaults ----
POOL_ID="lovable"
PROVIDER_ID="lovable-gateway"
SA_NAME="lovable-gcp"
LOCATION="global"
GATEWAY_SA_EMAIL="connector-gateway@lovable-core-prod.iam.gserviceaccount.com"

# ---- Validate placeholders ----
for VAR in GCP_PROJECT WORKSPACE_ID; do
  if [[ -z "${!VAR}" || "${!VAR}" == YOUR_* ]]; then
    echo "ERROR: set ${VAR} at the top of this script" >&2
    exit 1
  fi
done

# ---- Derived ----
SA_EMAIL="${SA_NAME}@${GCP_PROJECT}.iam.gserviceaccount.com"
SUBJECT_TOKEN_AUDIENCE="https://connector-gateway.lovable.dev/workspaces/${WORKSPACE_ID}"

# Enable APIs first. Cloud Resource Manager is not enabled by default on
# a new project, and the gcloud projects commands below depend on it.
gcloud services enable \
  iam.googleapis.com sts.googleapis.com \
  iamcredentials.googleapis.com cloudresourcemanager.googleapis.com \
  --project="${GCP_PROJECT}"

PROJECT_NUMBER=$(gcloud projects describe "${GCP_PROJECT}" --format="value(projectNumber)")
POOL_RESOURCE="projects/${PROJECT_NUMBER}/locations/${LOCATION}/workloadIdentityPools/${POOL_ID}"

# Create the workload identity pool
if ! gcloud iam workload-identity-pools describe "${POOL_ID}" \
    --location="${LOCATION}" --project="${GCP_PROJECT}" &>/dev/null; then
  gcloud iam workload-identity-pools create "${POOL_ID}" \
    --location="${LOCATION}" \
    --project="${GCP_PROJECT}" \
    --display-name="Lovable WIF Pool"
fi

# Create the OIDC provider, restricted to Lovable's connector gateway.
# An existing provider that already matches is left alone. One with
# different settings is only overwritten after you confirm, because the
# binding below trusts every identity this pool admits.
EXPECTED_CONDITION="assertion.email == '${GATEWAY_SA_EMAIL}'"

if gcloud iam workload-identity-pools providers describe "${PROVIDER_ID}" \
    --location="${LOCATION}" \
    --workload-identity-pool="${POOL_ID}" \
    --project="${GCP_PROJECT}" &>/dev/null; then
  CURRENT_CONDITION=$(gcloud iam workload-identity-pools providers describe "${PROVIDER_ID}" \
    --location="${LOCATION}" \
    --workload-identity-pool="${POOL_ID}" \
    --project="${GCP_PROJECT}" \
    --format="value(attributeCondition)")

  CURRENT_AUDIENCE=$(gcloud iam workload-identity-pools providers describe "${PROVIDER_ID}" \
    --location="${LOCATION}" \
    --workload-identity-pool="${POOL_ID}" \
    --project="${GCP_PROJECT}" \
    --format="value(oidc.allowedAudiences)")

  # The impersonation binding below matches on attribute.email, so the
  # provider has to map it.
  CURRENT_EMAIL_MAPPING=$(gcloud iam workload-identity-pools providers describe "${PROVIDER_ID}" \
    --location="${LOCATION}" \
    --workload-identity-pool="${POOL_ID}" \
    --project="${GCP_PROJECT}" \
    --format="value(attributeMapping['attribute.email'])")

  if [[ "${CURRENT_CONDITION}" == "${EXPECTED_CONDITION}" \
     && "${CURRENT_AUDIENCE}" == "${SUBJECT_TOKEN_AUDIENCE}" \
     && "${CURRENT_EMAIL_MAPPING}" == "assertion.email" ]]; then
    echo "Provider '${PROVIDER_ID}' already matches this workspace."
  else
    echo ""
    echo "Provider '${PROVIDER_ID}' already exists with different settings:"
    echo "  audience       now:  ${CURRENT_AUDIENCE:-(none)}"
    echo "                 new:  ${SUBJECT_TOKEN_AUDIENCE}"
    echo "  condition      now:  ${CURRENT_CONDITION:-(none)}"
    echo "                 new:  ${EXPECTED_CONDITION}"
    echo "  attribute.email now: ${CURRENT_EMAIL_MAPPING:-(unmapped)}"
    echo "                 new:  assertion.email"
    echo ""
    echo "Overwriting replaces these values. Any other audience on this provider is dropped."
    CONFIRM=""
    read -r -p "Overwrite it? (y/N) " CONFIRM < /dev/tty || CONFIRM="n"
    case "${CONFIRM}" in
      [Yy]|[Yy][Ee][Ss]) ;;
      *) echo "Aborted."; exit 1 ;;
    esac

    gcloud iam workload-identity-pools providers update-oidc "${PROVIDER_ID}" \
      --location="${LOCATION}" \
      --workload-identity-pool="${POOL_ID}" \
      --project="${GCP_PROJECT}" \
      --issuer-uri="https://accounts.google.com" \
      --allowed-audiences="${SUBJECT_TOKEN_AUDIENCE}" \
      --attribute-mapping="google.subject=assertion.sub,attribute.email=assertion.email" \
      --attribute-condition="${EXPECTED_CONDITION}"
  fi
else
  gcloud iam workload-identity-pools providers create-oidc "${PROVIDER_ID}" \
    --location="${LOCATION}" \
    --workload-identity-pool="${POOL_ID}" \
    --project="${GCP_PROJECT}" \
    --issuer-uri="https://accounts.google.com" \
    --allowed-audiences="${SUBJECT_TOKEN_AUDIENCE}" \
    --attribute-mapping="google.subject=assertion.sub,attribute.email=assertion.email" \
    --attribute-condition="assertion.email == '${GATEWAY_SA_EMAIL}'"
fi

# Create the service account Lovable impersonates
if ! gcloud iam service-accounts describe "${SA_EMAIL}" \
    --project="${GCP_PROJECT}" &>/dev/null; then
  gcloud iam service-accounts create "${SA_NAME}" \
    --project="${GCP_PROJECT}" \
    --display-name="Lovable Google Cloud API"
fi

# Wait for the service account to become visible to IAM. Reads are
# eventually consistent, so a new service account can take 60s or more
# to appear.
PROPAGATION_TIMEOUT=120
echo "Waiting up to ${PROPAGATION_TIMEOUT}s for service account to propagate..."
PROPAGATION_DEADLINE=$((SECONDS + PROPAGATION_TIMEOUT))
until gcloud iam service-accounts describe "${SA_EMAIL}" \
    --project="${GCP_PROJECT}" &>/dev/null; do
  if (( SECONDS >= PROPAGATION_DEADLINE )); then
    echo "ERROR: ${SA_EMAIL} did not become available after ${PROPAGATION_TIMEOUT}s" >&2
    exit 1
  fi
  sleep 2
done

# ---- Confirm before granting roles ----
if (( ${#ROLES[@]} > 0 )); then
  echo ""
  echo "Service account ${SA_EMAIL} will be granted on project ${GCP_PROJECT}:"
  for ROLE in "${ROLES[@]}"; do
    echo "  ${ROLE}"
  done
  echo ""
  REPLY=""
  read -r -p "Continue? (Y/n) " REPLY < /dev/tty || REPLY="n"
  case "${REPLY}" in
    ""|[Yy]|[Yy][Ee][Ss]) ;;
    *) echo "Aborted."; exit 1 ;;
  esac

  for ROLE in "${ROLES[@]}"; do
    gcloud projects add-iam-policy-binding "${GCP_PROJECT}" \
      --member="serviceAccount:${SA_EMAIL}" \
      --role="${ROLE}" --condition=None --quiet
  done
fi

# Allow the pool to impersonate the service account
gcloud iam service-accounts add-iam-policy-binding "${SA_EMAIL}" \
  --project="${GCP_PROJECT}" \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/${POOL_RESOURCE}/attribute.email/${GATEWAY_SA_EMAIL}" \
  --condition=None --quiet

AUDIENCE="//iam.googleapis.com/${POOL_RESOURCE}/providers/${PROVIDER_ID}"

echo ""
echo "=== Paste these into the Google Cloud API connector in Lovable ==="
echo ""
echo "  WIF Audience:          ${AUDIENCE}"
echo "  Service Account Email: ${SA_EMAIL}"
echo ""
echo "NOTE: IAM bindings can take up to 5 minutes to propagate."
echo "NOTE: Enable the APIs your app calls under APIs & Services in the console."