#!/usr/bin/env bash
# Real demos for P046 "How to Fix a Leaked Gemini API Key". Runs on the Mac (render01 holds no keys or logins),
# from ~/tea-shop-p046 outside this repo, typed into one real interactive bash (demo_driver.py).
# Everything happens in a throwaway Google Cloud project made for this video, ce-keylab-p046b: no billing account
# (free tier, so nothing in it can cost money), the Gemini API turned on, and only the keys this demo creates.
# The driver refuses to touch any other project, never prints a key (it checks every saved line for one), and
# deletes every key it made at the end. Delete the project itself once the video is out:
#   gcloud projects delete ce-keylab-p046b
# Nothing is pushed anywhere: the "leak" is a commit in a local Git repository, found with gitleaks (redacted).
set -euo pipefail
cd "$(dirname "$0")"
export CLOUDSDK_CORE_PROJECT=ce-keylab-p046b
[ "$(gcloud billing projects describe $CLOUDSDK_CORE_PROJECT --format='value(billingEnabled)')" = "False" ] ||
  { echo "the lab project must have no billing"; exit 1; }
LAB="$HOME/tea-shop-p046"
rm -rf "$LAB"; mkdir -p "$LAB"
python3 demo_driver.py "$LAB" "$PWD/lab/shop"
rm -rf "$LAB"