swagger: '2.0'
info:
  # Title of the api gateway
  title: gateway
  description: Sample API on API Gateway with a Cloud Run backend
  version: 1.0.0
schemes:
  - https
produces:
  - application/json
# The cloud run service url, this could also be defined per path as well in case you have multiple cloud run services that
# make up a single gateway
x-google-backend:
  address: "YOUR-CLOUD_RUN-URL"
securityDefinitions:
  firebase:
    authorizationUrl: ""
    flow: "implicit"
    type: "oauth2"
    # Replace YOUR-PROJECT-ID with your project ID
    x-google-issuer: "https://securetoken.google.com/YOUR-PROJECT-ID"
    x-google-jwks_uri: "https://www.googleapis.com/service_accounts/v1/metadata/x509/securetoken@system.gserviceaccount.com"
    x-google-audiences: "YOUR-PROJECT-ID"
paths:
  /greet:
    get:
      summary: Greets the user
      operationId: greet
      # define that our service uses the firebase security definition
      security:
        - firebase: [ ]
      responses:
        '200':
          description: A successful response
          schema:
            type: object
            # our object look like `{name: ""}`
            properties:
              name:
                type: string
                description: The users name

func (s *server) routes() {
    s.router.HandleFunc("/greet", s.handleAuth(s.handleGreeting()))
}

//handleGreeting will fetch the UserInfo struct that is stored in context from our auth middleware and use that to greet the person that called our api
func (s *server) handleGreeting() http.HandlerFunc {

    type person struct {
        Name string `json:"name"`
    }

    return func(writer http.ResponseWriter, request *http.Request) {

        writer.Header().Set("Content-Type", "application/json")

        // fetch the token user object that is stored in context
        userObj := request.Context().Value(gatewayUserContext).(UserInfo)

        // greet the user 👋
        p := person{Name: fmt.Sprintf("Hello 👋 %s", userObj.Name)}
        decoder := json.NewEncoder(writer)

        if err := decoder.Encode(p); err != nil {
            http.Error(writer, err.Error(), http.StatusInternalServerError)
        }
    }
}

const gatewayUserInfoHeader = "X-Apigateway-Api-Userinfo"
const gatewayUserContext = "GATEWAY_USER"

type UserInfo struct {
    Name          string   `json:"name"`
    Picture       string   `json:"picture"`
    Iss           string   `json:"iss"`
    Aud           string   `json:"aud"`
    AuthTime      int      `json:"auth_time"`
    UserID        string   `json:"user_id"`
    Sub           string   `json:"sub"`
    Iat           int      `json:"iat"`
    Exp           int      `json:"exp"`
    Email         string   `json:"email"`
    EmailVerified bool     `json:"email_verified"`
    Firebase      Firebase `json:"firebase"`
}
type Identities struct {
    GoogleCom []string `json:"google.com"`
    Email     []string `json:"email"`
}
type Firebase struct {
    Identities     Identities `json:"identities"`
    SignInProvider string     `json:"sign_in_provider"`
}

// handleAuth is a piece of middleware that will parse the gatewayUserInfoHeader from the request and add the UserInfo to the request context
func (s *server) handleAuth(h http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {

        encodedUser := r.Header.Get(gatewayUserInfoHeader)
        if encodedUser == "" {
            http.Error(w, "User Not Available", http.StatusForbidden)
            return
        }
        decodedBytes, err := base64.RawURLEncoding.DecodeString(encodedUser)
        if err != nil {
            http.Error(w, "Invalid UserInfo", http.StatusForbidden)
            return
        }
        decoder := json.NewDecoder(bytes.NewReader(decodedBytes))
        var userToken UserInfo
        err = decoder.Decode(&userToken)
        if err != nil {
            http.Error(w, "Invalid UserInfo", http.StatusForbidden)
            return
        }

        ctx := context.WithValue(r.Context(), gatewayUserContext, userToken)
        h.ServeHTTP(w, r.WithContext(ctx))

    }
}

gcloud services enable apigateway.googleapis.com
gcloud services enable servicemanagement.googleapis.com
gcloud services enable servicecontrol.googleapis.com

gcloud iam service-accounts create api-gateway

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID --member "serviceAccount:api-gateway@YOUR_PROJECT_ID.iam.gserviceaccount.com" --role "roles/run.invoker"
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID --member "serviceAccount:api-gateway@YOUR_PROJECT_ID.iam.gserviceaccount.com" --role "roles/iam.serviceAccountUser"

steps:

  # Run the docker build
  - name: 'gcr.io/cloud-builders/docker'
    args: [ 'build', '-t', 'gcr.io/$PROJECT_ID/greeter', '.' ]

  # push the docker image to the private GCR registry
  - name: 'gcr.io/cloud-builders/docker'
    args: [ 'push', 'gcr.io/$PROJECT_ID/greeter' ]

  # deploy to cloud run
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: gcloud
    args: [ 'run', 'deploy', 'greeter', '--image', 'gcr.io/$PROJECT_ID/greeter', '--region', 'us-central1', '--platform', 'managed', '--no-allow-unauthenticated' ]

images:
  - 'gcr.io/$PROJECT_ID/greeter'

# The cloud run service url, this could also be defined per path as well in case you have multiple cloud run services that
# make up a single gateway
x-google-backend:
  address: "YOUR-CLOUD_RUN-URL"

# create api config
gcloud beta api-gateway api-configs create echoconf \
  --api=gateway --openapi-spec=openapi2-run.yaml \
  --backend-auth-service-account=api-gateway@YOUR_PROJECT_ID.iam.gserviceaccount.com


# create gateway with config
gcloud beta api-gateway gateways create gateway \
  --api=gateway --api-config=echoconf \
  --location=us-central1


#get hostname from gateway
gcloud beta api-gateway gateways describe gateway \
  --location=us-central1 --format 'value(defaultHostname)'

curl "https://$(gcloud beta api-gateway gateways describe gateway --location=us-central1 --format 'value(defaultHostname)')/greet"

curl "https://$(gcloud beta api-gateway gateways describe gateway --location=us-central1 --format 'value(defaultHostname)')/greet?access_token=ACCESS_TOKEN"