#!/usr/bin/env bash
# JEP 536: JFR in-process data redaction. Start a JVM that has secrets in its arguments, system
# properties and environment, record it with JFR, and print what ended up in the recording.
#   ./scripts/jfr-redaction.sh   -> docs/output/40-jfr-redaction.txt
set -euo pipefail
source "$(dirname "$0")/env.sh"
B="$ROOT/build/jfr"; rm -rf "$B"; mkdir -p "$B"
"$JDK27/bin/javac" --release 26 -d "$B" "$ROOT/jep-tour/src/Idle.java"

# record <label> <jdk> <FlightRecorderOptions value or empty>
record() {
  local label="$1" jdk="$2" opts="${3:-}" jfr="$B/$1.jfr"
  local fropt=(); [ -n "$opts" ] && fropt=("-XX:FlightRecorderOptions:$opts")
  DB_PASSWORD=hunter2 "$jdk/bin/java" -Dapi.token=abc123 -Dregion=ap-south-1 "${fropt[@]}" \
      -XX:StartFlightRecording:filename="$jfr" -cp "$B" Idle --password=hunter2 --user=ankur >/dev/null 2>&1
  echo "=== $label"
  [ -n "$opts" ] && echo "    -XX:FlightRecorderOptions:$opts"
  "$jdk/bin/jfr" print --events jdk.JVMInformation "$jfr"          | grep -E 'jvmArguments|javaArguments' | sed 's/^ *//' | sed -E 's/(-XX:StartFlightRecording:filename=)[^ "]*/\1<file>/'
  "$jdk/bin/jfr" print --events jdk.InitialSystemProperty "$jfr"   | grep -A1 -E 'key = "(api.token|region)"' | grep -v -- '^--$' | sed 's/^ *//' | paste - -
  "$jdk/bin/jfr" print --events jdk.InitialEnvironmentVariable "$jfr" | grep -A1 -E 'key = "DB_PASSWORD"'      | grep -v -- '^--$' | sed 's/^ *//' | paste - -
  echo
}

{
  echo "# The process under test: java -Dapi.token=abc123 -Dregion=ap-south-1 ... Idle --password=hunter2 --user=ankur"
  echo "# with DB_PASSWORD=hunter2 in the environment. Which of those values reach the recording?"
  echo
  record "jdk26-default"                     "$JDK26"
  record "jdk27-default"                     "$JDK27"
  record "jdk27-own-list-replaces-defaults"  "$JDK27" "redact-argument=--user*,redact-key=region"
  record "jdk27-plus-extends-defaults"       "$JDK27" "redact-argument=+--user*,redact-key=+region"
  record "jdk27-none-disables-redaction"     "$JDK27" "redact-argument=none,redact-key=none"
} > "$OUT/40-jfr-redaction.txt" 2>&1
cat "$OUT/40-jfr-redaction.txt"