feat: enable AI features with Google Vertex AI service account support

.env.example

@@ -211,6 +211,13 @@ GOOGLE_VERTEX_LOCATION="global"
 # OPTIONAL: API key for Google Vertex AI (Gemini). Get your key from:
 # https://console.cloud.google.com/vertex-ai/studio/settings/api-keys
 GOOGLE_VERTEX_API_KEY=""
+# OPTIONAL: Service account credentials for Google Vertex AI, 
+# as a JSON string (the contents of a downloaded service account key file). 
+# Used instead of GOOGLE_VERTEX_API_KEY.
+GOOGLE_VERTEX_SERVICE_ACCOUNT_JSON=""
+# OPTIONAL: Set to "true" to rely on Application Default Credentials instead of an
+# API key or service account JSON
+GOOGLE_VERTEX_USE_ADC=""
 
 # [[CLOUDFLARE TURNSTILE]]
 # OPTIONAL: Cloudflare Turnstile site key (public). When configured, Turnstile challenges

cloudbuild.yaml

@@ -25,6 +25,7 @@ steps:
       - --image=${_IMAGE}
       - --region=us-west1
       - --project=$PROJECT_ID
+      - --service-account=keepcontracts-vertex-ai@keepcontracts.iam.gserviceaccount.com
 
 images:
   - ${_IMAGE}

packages/lib/constants/app.ts

@@ -24,7 +24,11 @@ export const SUPPORT_EMAIL = env('NEXT_PUBLIC_SUPPORT_EMAIL') ?? 'mangelsona@dat
 
 export const USE_INTERNAL_URL_BROWSERLESS = () => env('NEXT_PUBLIC_USE_INTERNAL_URL_BROWSERLESS') === 'true';
 
-export const IS_AI_FEATURES_CONFIGURED = () => !!env('GOOGLE_VERTEX_PROJECT_ID') && !!env('GOOGLE_VERTEX_API_KEY');
+export const IS_AI_FEATURES_CONFIGURED = () =>
+  !!env('GOOGLE_VERTEX_PROJECT_ID') &&
+  (!!env('GOOGLE_VERTEX_API_KEY') ||
+    !!env('GOOGLE_VERTEX_SERVICE_ACCOUNT_JSON') ||
+    env('GOOGLE_VERTEX_USE_ADC') === 'true');
 
 /**
  * Temporary flag to toggle between Playwright-based and Konva-based PDF generation

packages/lib/server-only/ai/google.ts

@@ -2,8 +2,15 @@ import { createVertex } from '@ai-sdk/google-vertex';
 
 import { env } from '../../utils/env';
 
+const serviceAccountJson = env('GOOGLE_VERTEX_SERVICE_ACCOUNT_JSON');
+
+// Auth resolution order (handled by the SDK, see createVertex2 in
+// @ai-sdk/google-vertex): an explicit apiKey wins if set; otherwise it uses
+// googleAuthOptions.credentials if we provide them; otherwise it falls back to
+// Application Default Credentials
 export const vertex = createVertex({
   project: env('GOOGLE_VERTEX_PROJECT_ID'),
   location: env('GOOGLE_VERTEX_LOCATION') || 'global',
   apiKey: env('GOOGLE_VERTEX_API_KEY'),
+  googleAuthOptions: serviceAccountJson ? { credentials: JSON.parse(serviceAccountJson) } : undefined,
 });