#!/usr/bin/env sh
set -eu

if [ ! -f .env ]; then
  echo "missing .env" >&2
  exit 1
fi

set -a
. ./.env
set +a

keycloak_url="${KEYCLOAK_URL:-http://localhost:8080}"

admin_token="$(
  curl -fsS \
    -d client_id=admin-cli \
    -d grant_type=password \
    -d "username=$KC_BOOTSTRAP_ADMIN_USERNAME" \
    -d "password=$KC_BOOTSTRAP_ADMIN_PASSWORD" \
    "$keycloak_url/realms/master/protocol/openid-connect/token" |
    jq -er .access_token
)"

idp="$(
  curl -fsS \
    -H "Authorization: Bearer $admin_token" \
    "$keycloak_url/admin/realms/keycloak-patterns/identity-provider/instances/mock-google"
)"

printf '%s' "$idp" | jq -e '
  .providerId == "oidc" and
  .enabled == true and
  .trustEmail == false and
  .config.clientId == "mock-google-broker" and
  .config.defaultScope == "openid profile email" and
  .config.syncMode == "IMPORT" and
  .config.validateSignature == "true"
' >/dev/null

client="$(
  curl -fsS \
    -H "Authorization: Bearer $admin_token" \
    "$keycloak_url/admin/realms/mock-google/clients?clientId=mock-google-broker"
)"

printf '%s' "$client" | jq -e '
  length == 1 and
  .[0].publicClient == false and
  (.[0].redirectUris | index(
    "http://localhost:8080/realms/keycloak-patterns/broker/mock-google/endpoint"
  )) != null
' >/dev/null

location="$(
  curl -sS -D - -o /dev/null \
    "$keycloak_url/realms/keycloak-patterns/protocol/openid-connect/auth?client_id=spa-public&redirect_uri=http%3A%2F%2Flocalhost%3A8088%2F&response_type=code&scope=openid&code_challenge=K2qUEfBl-nQvF2gB4dNxC2zYVwZc1CVnZb5CsX2L7fI&code_challenge_method=S256&kc_idp_hint=mock-google" |
    awk 'BEGIN { IGNORECASE=1 } /^Location:/ { print $2 }' |
    tr -d '\r'
)"

case "$location" in
  "$keycloak_url/realms/keycloak-patterns/broker/mock-google/login"*) ;;
  *)
    echo "broker did not redirect to the controllable OIDC provider: $location" >&2
    exit 1
    ;;
esac

echo "Google broker contract verified with the local mock OIDC realm"