`remediate.sh`

64 lines
#!/bin/bash
# GCP security case #72846716 — gen-lang-client project flagged compromised (Gemini API abuse).
# Remediation via API Keys API: delete the two leaked orphan keys (last-4 ejMo / S2ic),
# restrict every kept key to the Generative Language API, and surface billing.
#
# DRY-RUN by default. Pass --apply to actually delete/restrict.
# Deletes are soft: `gcloud services api-keys undelete` restores within 30 days.
#
# Prereq (the only step that needs a human): a live Google login that can see the
# gen-lang-client project — run one of:
#   gcloud auth login info@designerwallcoverings.com
#   gcloud auth login steveabramsdesigns@gmail.com
set -euo pipefail
export PATH=/opt/homebrew/bin:$PATH

APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
LEAK_SUFFIXES=("ejMo" "S2ic")

echo "== Accounts =="
gcloud auth list --format="value(account,status)" || true

echo "== Locating gen-lang-client project =="
PROJECT=$(gcloud projects list --filter="projectId:gen-lang-client*" --format="value(projectId)" | head -1)
if [ -z "$PROJECT" ]; then
  echo "FATAL: no gen-lang-client* project visible to the active account."
  echo "Log in with the Google account that owns the Gemini/AI Studio keys, then re-run."
  exit 1
fi
echo "project: $PROJECT"

echo "== API keys in $PROJECT =="
gcloud services api-keys list --project="$PROJECT" \
  --format="table(uid,displayName,createTime,restrictions.apiTargets[].service)"

echo "== Classifying keys =="
KEYS=$(gcloud services api-keys list --project="$PROJECT" --format="value(uid)")
for UID in $KEYS; do
  KEYSTRING=$(gcloud services api-keys get-key-string "$UID" --project="$PROJECT" --format="value(keyString)")
  LAST4=${KEYSTRING: -4}
  NAME="projects/$PROJECT/locations/global/keys/$UID"
  LEAKED=0
  for S in "${LEAK_SUFFIXES[@]}"; do [ "$LAST4" = "$S" ] && LEAKED=1; done
  if [ $LEAKED -eq 1 ]; then
    echo "LEAKED key …$LAST4 ($UID) -> DELETE"
    if [ $APPLY -eq 1 ]; then
      gcloud services api-keys delete "$UID" --project="$PROJECT" --quiet
      echo "  deleted (undelete window: 30 days)"
    fi
  else
    echo "kept key …$LAST4 ($UID) -> restrict to generativelanguage.googleapis.com"
    if [ $APPLY -eq 1 ]; then
      gcloud services api-keys update "$UID" --project="$PROJECT" \
        --api-target=service=generativelanguage.googleapis.com --quiet
      echo "  restricted"
    fi
  fi
done

echo "== Billing on $PROJECT =="
gcloud billing projects describe "$PROJECT" 2>/dev/null || \
  echo "(billing API not enabled or no permission — check console Billing page for rogue spend)"

[ $APPLY -eq 0 ] && echo "DRY-RUN complete. Re-run with --apply to execute." || echo "APPLIED."