#!/usr/bin/env bash
# Regenerates every file in ../docs/output that belongs to this project.
#
#   ./scripts/run-all.sh
#
# Starts and stops the servers itself. Takes a few minutes. The only non-deterministic
# content is timestamps, key ids and token values, which change on every run by design.
set -u
cd "$(dirname "$0")/.."
. scripts/lib.sh

start_auth() {
  kill_app AuthServerApplication 9000
  local profiles="${1:-}"
  local args=(-B -o -pl auth-server org.springframework.boot:spring-boot-maven-plugin:run)
  [ -n "$profiles" ] && args+=("-Dspring-boot.run.profiles=$profiles")
  setsid nohup mvn "${args[@]}" > /tmp/auth-server.log 2>&1 < /dev/null &
  wait_for "$AS/oauth2/jwks" 90
}
start_client() {
  kill_app ClientApplication 8080
  local profiles="${1:-}"
  local args=(-B -o -pl oidc-client org.springframework.boot:spring-boot-maven-plugin:run)
  [ -n "$profiles" ] && args+=("-Dspring-boot.run.profiles=$profiles")
  setsid nohup mvn "${args[@]}" > /tmp/oidc-client.log 2>&1 < /dev/null &
  wait_for "http://127.0.0.1:8080/" 90
}
start_rs() {
  kill_app ResourceServerApplication 8090
  local profiles="${1:-}"
  local args=(-B -o -pl resource-server org.springframework.boot:spring-boot-maven-plugin:run)
  [ -n "$profiles" ] && args+=("-Dspring-boot.run.profiles=$profiles")
  setsid nohup mvn "${args[@]}" > /tmp/rs.log 2>&1 < /dev/null &
  wait_for "$RS/public" 90
}

echo "== ClientSettings / TokenSettings defaults, 1.5.8 vs 7.1.1"
./scripts/settings-defaults.sh > /dev/null

echo "== the SAS 1.x configuration against 7.1.1 (compile only)"
./scripts/compile-legacy.sh > /dev/null

echo "== default profile"
start_auth ""
start_rs ""
./scripts/discovery.sh
./scripts/client-credentials.sh as-client-credentials
./scripts/authcode-pkce.sh as-authcode-pkce demo-spa
./scripts/authcode-pkce.sh as-authcode-web demo-web

echo "== why a confidential Spring client does not send PKCE by default"
./scripts/pkce-applier.sh > /dev/null

echo "== the real Spring OAuth2 client, end to end"
start_client ""
./scripts/client-flow.sh as-client-flow "client sends PKCE"
# Restart the authorization server too, so the consent already granted above does not
# short-circuit the second run.
start_auth ""
start_client "nopkce"
./scripts/client-flow.sh as-client-flow-nopkce "confidential client, no PKCE - the Boot default"
kill_app ClientApplication 8080

echo "== noclaims: the token customiser removed"
start_auth "noclaims"
./scripts/client-credentials.sh as-client-credentials-noclaims
./scripts/authcode-pkce.sh as-authcode-noclaims demo-spa

echo "== nopkce: the public client no longer requires a verifier"
start_auth "nopkce"
# With a challenge present, the server still demands the verifier - requireProofKey only
# controls whether a challenge is MANDATORY, not whether one that was sent is honoured.
./scripts/authcode-pkce.sh as-authcode-nopkce demo-spa
# Without any challenge at all, the code alone is enough. This is the actual exposure.
NO_CHALLENGE=1 ./scripts/authcode-pkce.sh as-authcode-nochallenge demo-spa

echo "== the same request against a client that DOES require PKCE"
start_auth ""
NO_CHALLENGE=1 ./scripts/authcode-pkce.sh as-authcode-pkce-enforced demo-spa

echo "== noconsent: consent turned off"
start_auth "noconsent"
./scripts/authcode-pkce.sh as-authcode-noconsent demo-spa

echo "== entry point and the Accept header"
rm -f ../docs/output/as-entrypoint-accept.txt
start_auth "acceptall"
./scripts/entrypoint-accept.sh "acceptall profile: setIgnoredMediaTypes NOT called"
start_auth ""
./scripts/entrypoint-accept.sh "default profile: setIgnoredMediaTypes(ALL) called"

echo "== opaque: reference tokens for the service client"
start_auth "opaque"
./scripts/client-credentials.sh as-client-credentials-opaque

echo "== audience validation off on the resource server"
start_auth ""
start_rs "noaud"
./scripts/audience.sh

echo "== the contract tests"
mvn -B -o -pl auth-server test 2>&1 | grep -E "Tests run:|^\[INFO\] Running" \
  > ../docs/output/as-test-run.txt || true

kill_app AuthServerApplication 9000
kill_app ResourceServerApplication 8090
kill_app ClientApplication 8080

echo "== resource server startup with no provider"
./scripts/rs-startup-failure.sh > /dev/null

echo
echo "docs/output:"
ls -1 ../docs/output/as-*.txt