#!/usr/bin/env bash
# Start all four processes and wait until each answers.
#
#   ./scripts/run.sh
#   STRICT=true ./scripts/run.sh          # downstream validates issuer and audience
#   RS_LOG_LEVEL=DEBUG ./scripts/run.sh   # resource-server decisions at DEBUG
#
# | Process     | Port | Main class                |
# |-------------|------|---------------------------|
# | authserver  | 9000 | AuthServerApplication     |
# | gateway     | 8080 | GatewayApplication        |
# | edge        | 8081 | EdgeApplication           |
# | downstream  | 8082 | DownstreamApplication     |
#
# These are launched with plain `java`, not `spring-boot:run`. Four Maven JVMs each forking an
# application JVM is eight processes, and on a small machine that is how you meet the OOM
# killer rather than the demo. `mvn dependency:build-classpath` once, then `java -cp` four
# times, is two hundred megabytes of heap instead of two gigabytes.
set -eu
cd "$(dirname "$0")/.."

./scripts/stop.sh
mvn -B -q compile
if [ ! -f target/cp.txt ]; then
  mvn -B -q dependency:build-classpath -Dmdep.outputFile=target/cp.txt -Dmdep.includeScope=runtime
fi
CP="target/classes:$(cat target/cp.txt)"

start() {   # start <main-class> <port> <health-path> <extra-jvm-args...>
  local main="$1" port="$2" path="$3"
  shift 3
  setsid nohup java -Xmx192m -XX:TieredStopAtLevel=1 "$@" ${JVM_ARGS:-} \
    -cp "$CP" "com.ankurm.s2s.$main" \
    > "/tmp/s2s-${main##*.}.log" 2>&1 < /dev/null &
  for _ in $(seq 1 60); do
    if curl -s -o /dev/null "http://127.0.0.1:$port$path" 2>/dev/null; then
      echo "  ${main##*.} up on $port"
      return 0
    fi
    sleep 1
  done
  echo "${main##*.} did not start; see /tmp/s2s-${main##*.}.log" >&2
  tail -20 "/tmp/s2s-${main##*.}.log" >&2
  return 1
}

# STRICT=true turns on RFC 9068 end to end: the authorization server types its access tokens
# `at+jwt` and adds a client_id claim, and the downstream service validates issuer, audience
# and the required-claim set instead of only signature and expiry.
STRICT_ARGS=()
AS_ARGS=()
if [ "${STRICT:-false}" = "true" ]; then
  STRICT_ARGS=(-DSTRICT=true)
  AS_ARGS=(-DAT_JWT=true)
fi

# The authorization server must be first and must be READY before the others: `edge` is an
# OAuth2 client, and a client whose provider is configured with issuer-uri fetches the
# discovery document during context refresh. See docs/01-the-four-processes.md.
start authserver.AuthServerApplication 9000 /oauth2/jwks "${AS_ARGS[@]}"
start downstream.DownstreamApplication 8082 /orders "${STRICT_ARGS[@]}"
start edge.EdgeApplication             8081 /edge/naive
start gateway.GatewayApplication       8080 /edge/naive
echo "all four up"