#!/usr/bin/env bash
# The gap between "the signature is valid" and "this token was meant for me".
set -u
cd "$(dirname "$0")/.."
. scripts/lib.sh
OUT=../docs/output/as-audience.txt
mkdir -p ../docs/output
{
  section "A token for a DIFFERENT audience, signed by the SAME issuer"
  echo "demo-service's tokens carry aud=[orders-api] thanks to the token customiser."
  echo "Here we ask for one and then present it to a resource server configured to"
  echo "require a different audience - and to one that does not check at all."
  TOKEN=$(curl -s -u demo-service:service-secret -d grant_type=client_credentials \
               -d scope=orders.read "$AS/oauth2/token" \
          | python3 -c 'import sys,json;print(json.load(sys.stdin).get("access_token",""))')
  echo
  echo "aud claim in the token:"
  jwt_payload "$TOKEN" | grep -A3 '"aud"'

  section "Resource server running with demo.validate-audience=false"
  echo "This is the Spring Boot default: issuer-uri alone validates signature, exp/nbf"
  echo "and iss. Audience is not checked unless you add a validator."
  curl -s -o /tmp/b -w 'GET /api/orders -> %{http_code}\n' -H "Authorization: Bearer $TOKEN" "$RS/api/orders"
  head -c 300 /tmp/b; echo

  section "The same token with a deliberately mangled signature"
  BAD="${TOKEN%?}X"
  curl -s -D - -o /dev/null -H "Authorization: Bearer $BAD" "$RS/api/orders" \
    | sed -n '1p;/^WWW-Authenticate/p'

  section "No token at all"
  curl -s -D - -o /dev/null "$RS/api/orders" | sed -n '1p;/^WWW-Authenticate/p'
} > "$OUT" 2>&1
sed -i 's/[[:space:]]*$//' "$OUT"
echo "wrote $OUT"