#!/usr/bin/env bash
# The same resource server, the same code, a real Keycloak.
# Requires: docker compose -f docker/compose.yaml up -d
#           ./scripts/run-rs.sh keycloak,roles
set -eu
. "$(dirname "$0")/lib.sh"

head1 "Keycloak discovery document"
curl -s "$KC/realms/demo/.well-known/openid-configuration" \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); [print("  %-22s %s" % (k, d[k])) for k in ("issuer","jwks_uri","token_endpoint")]'

head1 "Keycloak JWK Set"
curl -s "$KC/realms/demo/protocol/openid-connect/certs" \
  | python3 -c '
import json,sys
d=json.load(sys.stdin)
print("  keys published:", len(d["keys"]))
for k in d["keys"]:
    print("   kid=%s alg=%s use=%s kty=%s" % (k.get("kid"), k.get("alg"), k.get("use"), k.get("kty")))'

head1 "1. alice, password grant"
T=$(kc_token alice alice-password)
claims "$T"
call "GET /api/me" "$RS/api/me" "$T"
call "GET /api/reports    (client role, from resource_access.reports-api.roles)" "$RS/api/reports" "$T"
call "GET /api/admin/stats (realm role ADMIN, which alice does not have)" "$RS/api/admin/stats" "$T"

head1 "2. root"
T=$(kc_token root root-password)
call "GET /api/admin/stats" "$RS/api/admin/stats" "$T"

head1 "3. nobody - a user with no client role"
T=$(kc_token nobody nobody-password)
claims "$T"
call "GET /api/reports" "$RS/api/reports" "$T"