#!/usr/bin/env bash
# Reproduces the "permitAll() endpoint still returns 403" failure.
# Requires: --spring.profiles.active=hs256,csrfon
set -u
BASE="${1:-http://localhost:8080}"
show() {
  local out
  out=$(curl -sS -D /tmp/.h -o /tmp/.b -w '%{http_code}' "$@")
  printf 'HTTP %s\n' "$out"
  grep -iE '^(www-authenticate|content-type):' /tmp/.h | sed 's/\r$//'
  [ -s /tmp/.b ] && { python3 -m json.tool < /tmp/.b 2>/dev/null || cat /tmp/.b; echo; }
}
hr(){ printf '\n%s\n' "--------------------------------------------------------------------------"; }

echo "=========================================================================="
echo " jwt-auth-demo - CSRF vs permitAll()"
echo " app started with: --spring.profiles.active=hs256,csrfon"
echo "=========================================================================="

hr; echo "# A. The login endpoint is permitAll(). POST it anyway."
echo "#    403 - and nothing in the authorization rules explains why."
echo
show -X POST "$BASE/api/auth/login" -H 'Content-Type: application/json' \
     -d '{"username":"alice","password":"alice-password"}'

hr; echo "# B. GET on the same permitAll() path family works. Only unsafe methods break."
echo
show "$BASE/api/public/ping"

hr; echo "# C. The filter chain, with CsrfFilter present. Count the positions:"
echo "#    CsrfFilter is 5th, AuthorizationFilter is last. The request never"
echo "#    reaches the filter that knows about permitAll()."
echo
show "$BASE/api/public/filters"

hr; echo "# end"