#!/usr/bin/env bash
# Starts the packaged app, walks login -> refresh -> replay with curl, and writes output/12-http-walkthrough.txt.
# Tokens are shortened in the transcript; the real ones are used on the wire.
set -euo pipefail
cd "$(dirname "$0")/.."
mvn -B -q -DskipTests package
JAR=$(ls target/refresh-tokens-demo-*.jar | head -1)
PIDFILE=$(mktemp)
setsid nohup java -jar "$JAR" > /tmp/refresh-demo.log 2>&1 < /dev/null &
echo $! > "$PIDFILE"
trap 'kill "$(cat "$PIDFILE")" 2>/dev/null || true' EXIT
for i in $(seq 1 60); do
  curl -s -o /dev/null -X POST localhost:8080/api/auth/login && break
  sleep 1
done

short() { echo "${1:0:14}..."; }
post() { curl -s -w '\nHTTP %{http_code}' -X POST -H 'Content-Type: application/json' -d "$2" "localhost:8080$1"; }

OUT=output/12-http-walkthrough.txt
{
  echo '$ curl -X POST /api/auth/login  (alice)'
  LOGIN=$(curl -s -X POST -H 'Content-Type: application/json' -d '{"username":"alice","password":"alice-password"}' localhost:8080/api/auth/login)
  A=$(echo "$LOGIN" | jq -r .refresh_token); ACCESS=$(echo "$LOGIN" | jq -r .access_token)
  echo "$LOGIN" | jq -c --arg a "$(short "$ACCESS")" --arg r "$(short "$A")" '.access_token=$a | .refresh_token=$r'

  echo; echo '$ curl /api/me  (Bearer access token)'
  curl -s -w '\nHTTP %{http_code}\n' -H "Authorization: Bearer $ACCESS" localhost:8080/api/me | sed -E 's/"sid":"([0-9a-f]{8})[^"]*"/"sid":"\1..."/'

  echo; echo '$ curl -X POST /api/auth/refresh  (token A)'
  R1=$(curl -s -X POST -H 'Content-Type: application/json' -d "{\"refresh_token\":\"$A\"}" localhost:8080/api/auth/refresh)
  B=$(echo "$R1" | jq -r .refresh_token)
  echo "$R1" | jq -c --arg a "$(short "$(echo "$R1" | jq -r .access_token)")" --arg r "$(short "$B")" '.access_token=$a | .refresh_token=$r'

  echo; echo '$ curl -X POST /api/auth/refresh  (token A again: the replay)'
  post /api/auth/refresh "{\"refresh_token\":\"$A\"}"

  echo; echo; echo '$ curl -X POST /api/auth/refresh  (token B, the innocent holder)'
  post /api/auth/refresh "{\"refresh_token\":\"$B\"}"
  echo
} > "$OUT"
cat "$OUT"
echo; echo "--- server log lines about reuse ---"
grep -i 'REUSE' /tmp/refresh-demo.log | sed -E 's/^[0-9T:.+-]+ +//' || true