#!/usr/bin/env bash
# The simplest grant, and what the token customiser does and does not add to it.
set -u
cd "$(dirname "$0")/.."
. scripts/lib.sh
OUT="../docs/output/${1:-as-client-credentials}.txt"
mkdir -p ../docs/output
{
  section "POST /oauth2/token   grant_type=client_credentials"
  echo "\$ curl -su demo-service:service-secret -d grant_type=client_credentials \\"
  echo "       -d scope=orders.read $AS/oauth2/token"
  RESP=$(curl -s -u demo-service:service-secret \
              -d grant_type=client_credentials -d scope=orders.read \
              "$AS/oauth2/token")
  echo "$RESP" | python3 -m json.tool

  TOKEN=$(echo "$RESP" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("access_token",""))')
  if [ -z "$TOKEN" ]; then echo "no access token - stopping"; exit 1; fi

  case "$TOKEN" in
    *.*.*)
      section "JOSE header"
      jwt_header "$TOKEN"
      section "Claims"
      jwt_payload "$TOKEN"
      ;;
    *)
      section "Not a JWT"
      echo "The access token is an opaque reference: $TOKEN"
      echo "Length ${#TOKEN}. It carries no claims; the resource server must introspect it."
      section "POST /oauth2/introspect"
      curl -s -u demo-service:service-secret -d "token=$TOKEN" \
           "$AS/oauth2/introspect" | python3 -m json.tool
      ;;
  esac

  section "Wrong secret"
  echo "\$ curl -si -u demo-service:WRONG -d grant_type=client_credentials $AS/oauth2/token"
  curl -s -i -u demo-service:WRONG -d grant_type=client_credentials \
       "$AS/oauth2/token" | sed -n '1p;/^WWW-Authenticate/p;/^{/p'

  section "A grant the client is not registered for"
  echo "\$ curl -si -u demo-service:service-secret -d grant_type=authorization_code -d code=x $AS/oauth2/token"
  curl -s -i -u demo-service:service-secret -d grant_type=authorization_code -d code=x \
       "$AS/oauth2/token" | sed -n '1p;/^{/p'

  section "A scope the client is not registered for"
  echo "\$ curl -s -u demo-service:service-secret -d grant_type=client_credentials -d scope=orders.write $AS/oauth2/token"
  curl -s -u demo-service:service-secret -d grant_type=client_credentials -d scope=orders.write \
       "$AS/oauth2/token"
  echo

  section "Calling the resource server with the token"
  for path in /public /api/orders /api/admin; do
    CODE=$(curl -s -o /tmp/rsbody -w '%{http_code}' -H "Authorization: Bearer $TOKEN" "$RS$path")
    WWW=$(curl -s -D - -o /dev/null -H "Authorization: Bearer $TOKEN" "$RS$path" | grep -i '^WWW-Authenticate' || true)
    echo "GET $path -> $CODE"
    [ -n "$WWW" ] && echo "  $WWW"
    head -c 400 /tmp/rsbody; echo
  done
} > "$OUT" 2>&1
sed -i 's/[[:space:]]*$//' "$OUT"
echo "wrote $OUT"