#!/usr/bin/env bash
# Compares the built-in resource server with and without a token_type validator.
# Requires two runs; see docs/09-manual-filter-vs-resource-server.md
set -u
BASE="${1:-http://localhost:8080}"
LABEL="${2:-resourceserver}"
show() {
  local out; out=$(curl -sS -D /tmp/.h -o /tmp/.b -w '%{http_code}' "$@")
  printf 'HTTP %s\n' "$out"
  grep -iE '^www-authenticate:' /tmp/.h | sed 's/\r$//'
  [ -s /tmp/.b ] && { python3 -m json.tool < /tmp/.b 2>/dev/null | head -10 || cat /tmp/.b; echo; }
}
hr(){ printf '\n%s\n' "--------------------------------------------------------------------------"; }

echo "=========================================================================="
echo " jwt-auth-demo - built-in resource server"
echo " profiles: $LABEL"
echo "=========================================================================="

R=$(curl -sS -X POST "$BASE/api/auth/login" -H 'Content-Type: application/json' \
    -d '{"username":"alice","password":"alice-password"}')
ACCESS=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["accessToken"])')
REFRESH=$(echo "$R" | python3 -c 'import json,sys;print(json.load(sys.stdin)["refreshToken"])')

hr; echo "# 1. The filter chain. Note BearerTokenAuthenticationFilter in place of our"
echo "#    hand-written JwtAuthenticationFilter - same slot, framework-owned."
echo; show "$BASE/api/public/filters"

hr; echo "# 2. Access token -> 200."; echo; show "$BASE/api/me" -H "Authorization: Bearer $ACCESS"

hr; echo "# 3. Non-admin on an admin route -> 403 insufficient_scope."
echo; show "$BASE/api/admin/stats" -H "Authorization: Bearer $ACCESS"

hr; echo "# 4. REFRESH token presented as an access token."
echo "#    This is the line to watch when comparing the two runs."
echo; show "$BASE/api/me" -H "Authorization: Bearer $REFRESH"

hr; echo "# end"