#!/usr/bin/env bash
# What the provider advertises, and the difference between the two metadata documents.
set -u
cd "$(dirname "$0")/.."
. scripts/lib.sh
OUT=../docs/output/as-discovery.txt
mkdir -p ../docs/output
{
  section "OpenID Connect discovery: GET /.well-known/openid-configuration"
  echo "\$ curl -s $AS/.well-known/openid-configuration"
  curl -s "$AS/.well-known/openid-configuration" | python3 -m json.tool

  section "OAuth2 metadata: GET /.well-known/oauth-authorization-server"
  echo "Present even with .oidc(...) switched off. The OIDC document above is the one"
  echo "that additionally advertises userinfo_endpoint and id_token signing algorithms."
  echo "\$ curl -s $AS/.well-known/oauth-authorization-server"
  curl -s "$AS/.well-known/oauth-authorization-server" | python3 -m json.tool

  section "JWK Set: GET /oauth2/jwks"
  echo "Public keys only. No 'd' member - if you ever see one here, stop the server."
  curl -s "$AS/oauth2/jwks" | python3 -m json.tool

  section "Resolved endpoint settings, read back from AuthorizationServerSettings"
  curl -s "$AS/diag/settings" | python3 -m json.tool

  section "Registered clients, as the server actually holds them"
  curl -s "$AS/diag/clients" | python3 -m json.tool
} > "$OUT" 2>&1
sed -i 's/[[:space:]]*$//' "$OUT"
echo "wrote $OUT"; wc -l "$OUT"