#!/usr/bin/env sh
set -eu

npm --prefix frontend ci
npm --prefix frontend test

jq -e '
  .clients[]
  | select(.clientId == "spa-public")
  | .publicClient == true
    and .standardFlowEnabled == true
    and .implicitFlowEnabled == false
    and .directAccessGrantsEnabled == false
    and .attributes["pkce.code.challenge.method"] == "S256"
' keycloak/import/keycloak-patterns-realm.json >/dev/null

rg -q 'response_type: "code"' frontend/src/app.js
rg -q 'new InMemoryWebStorage' frontend/src/app.js
rg -Fq 'cryptoApi.subtle.digest(' frontend/src/pkce.js
rg -Fq '"SHA-256"' frontend/src/pkce.js
echo "PKCE stages verified: verifier -> S256 challenge -> code -> verifier exchange"