#!/usr/bin/env sh
set -eu

jq -e '
  .revokeRefreshToken == true
  and .refreshTokenMaxReuse == 0
  and .accessTokenLifespan <= 300
' keycloak/import/keycloak-patterns-realm.json >/dev/null

rg -Fq 'assert.notEqual(rotated.refresh_token, secondTokenSet.refresh_token)' \
  e2e/pattern1.mjs
rg -Fq 'a consumed refresh token must not be accepted again' e2e/pattern1.mjs
rg -Fq 'refresh revoke is not an immediate deny-list' e2e/pattern1.mjs

echo "Refresh rotation/reuse/revocation contract verified"
echo "Run ./scripts/verify-pattern1.sh for the destructive live-token E2E"