#!/usr/bin/env sh
set -eu

base="${KEYCLOAK_URL:-http://localhost:8080}"
main_issuer="$base/realms/keycloak-patterns"
mock_issuer="$base/realms/mock-google"

test "$(curl -fsS "$main_issuer/.well-known/openid-configuration" | jq -r .issuer)" \
  = "$main_issuer"
test "$(curl -fsS "$mock_issuer/.well-known/openid-configuration" | jq -r .issuer)" \
  = "$mock_issuer"

rg -Fq 'SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI:' docker-compose.yml
if rg -qi 'accounts\\.google\\.com|realms/mock-google' backend/src/main; then
  echo "backend must trust only the Keycloak issuer, not the upstream IdP" >&2
  exit 1
fi

echo "Three-leg trust anchors verified: upstream -> Keycloak -> Resource Server"