#!/usr/bin/env bash
# Real demos for P048 "Gemini API vs Vertex AI: Which One Should You Use?". Runs on the Mac (Docker Desktop):
# the Gemini API key and the service account's key file live only on the Mac, never on render01.
# One container, ce-p048-laptop: a stock Ubuntu 24.04 with curl, jq and Google's Gen AI SDK (lab/Dockerfile),
# Ana's shop scripts in ~/shop. Every command shown is typed into a real interactive bash in a pty
# (demo_driver.py) and sent to the real Gemini API or the real Vertex AI API.
#   GEMINI_API_KEY  the key of our paid project ("My First Project"), which AI Studio restricts to the Gemini API
#   ~/keys/shop-bot.json  a key file for the service account shop-bot of our lab project ce-vertex-p048
#                   (its own Google Cloud project, made for this video), mounted read-only, never printed
# Off camera the driver turns the lab project's billing off and on and removes and grants shop-bot's role
# (gcloud on the Mac), so the billing and permission errors on screen are real. Nothing secret is saved:
# the driver refuses any output containing the API key, a sign-in token or the key file's private key.
set -euo pipefail
cd "$(dirname "$0")"
P=ce-p048
LAB=ce-vertex-p048
SA_KEY="${SA_KEY:-$HOME/.ce-secrets/p048-shop-bot.json}"
KEYS="$(git rev-parse --show-toplevel)/.gemini_keys.json"
[ -f "$KEYS" ] || KEYS="$HOME/cloudexplainers/.gemini_keys.json"
[ -f "$SA_KEY" ] || { echo "no service account key at $SA_KEY (gcloud iam service-accounts keys create)"; exit 1; }
cleanup() { docker rm -f $P-laptop >/dev/null 2>&1 || true; }
cleanup
[ -n "${KEEP:-}" ] || trap cleanup EXIT
docker build -q -t $P-laptop lab >/dev/null
key() { python3 -c "import json,sys; print([k for k in json.load(open(sys.argv[1]))['projects'][sys.argv[2]]['keys'] if k['display_name'] == sys.argv[3]][0]['key_string'])" "$KEYS" "$1" "$2"; }
GEMINI_API_KEY=$(key project-593e5bf6-d8b6-4ffd-878 "Gemini API Key")
export GEMINI_API_KEY LAB
docker run -d --name $P-laptop --hostname laptop -e GEMINI_API_KEY \
  -v "$SA_KEY":/home/ana/keys/shop-bot.json:ro $P-laptop sleep infinity >/dev/null
SA_PRIVATE=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1]))['private_key_id'])" "$SA_KEY")
export SA_PRIVATE
python3 - "$P" < demo_driver.py