#!/usr/bin/env bash
# PBAC Quickstart Seed Script
# Seeds resource types and creates two clients with software statements so you
# can immediately request a token and introspect it.
#
# Usage:
#   export PBAC_URL=https://pbac.example.com
#   export ADMIN_KEY=your-admin-api-key
#   bash quickstart-seed.sh
#
# After running, get a token:
#   curl -s -X POST $PBAC_URL/token \
#     -u quickstart-app:app-secret \
#     -d 'grant_type=client_credentials&scope=read&resource_types=urn:quickstart:data'

set -euo pipefail

: "${PBAC_URL:?Set PBAC_URL to your PBAC instance URL}"
: "${ADMIN_KEY:?Set ADMIN_KEY to your admin API key}"

echo "Seeding PBAC quickstart data at $PBAC_URL..."

# Step 1: Seed resource types (system-level config)
echo -n "  Seeding resource types... "
RESOURCE_TYPES='{"resource":{"types":{"urn:as:introspect":{"scopes":["uma_protection","introspection"]},"urn:quickstart:data":{"scopes":["read","write"]}}}}'

STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X PUT "$PBAC_URL/admin/api/policy-data/by-key?dataKey=oauth_config" \
  -H "X-Admin-API-Key: $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"dataKey\":\"oauth\",\"payload\":$(echo "$RESOURCE_TYPES" | jq -Rs .)}")
if [ "$STATUS" = "200" ] || [ "$STATUS" = "201" ]; then
  echo "OK ($STATUS)"
else
  echo "FAILED ($STATUS)"
  exit 1
fi

# Step 2: Register application client with software statement
echo -n "  Creating quickstart-app client... "
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$PBAC_URL/admin/api/clients" \
  -H "X-Admin-API-Key: $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "quickstart-app",
    "clientSecret": "app-secret",
    "clientType": "confidential",
    "clientName": "Quickstart App",
    "softwareStatement": {
      "sub": "quickstart-app",
      "grant_types": ["client_credentials"],
      "granted_resources": [
        {"type": "urn:quickstart:data", "scopes": ["read"]}
      ]
    }
  }')
if [ "$STATUS" = "201" ] || [ "$STATUS" = "409" ]; then
  echo "OK ($STATUS)"
else
  echo "FAILED ($STATUS)"
  exit 1
fi

# Step 3: Register resource server client with software statement
echo -n "  Creating quickstart-rs client... "
STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$PBAC_URL/admin/api/clients" \
  -H "X-Admin-API-Key: $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "quickstart-rs",
    "clientSecret": "rs-secret",
    "clientType": "confidential",
    "clientName": "Quickstart Resource Server",
    "softwareStatement": {
      "sub": "quickstart-rs",
      "grant_types": ["client_credentials"],
      "granted_resources": [
        {"type": "urn:as:introspect", "scopes": ["uma_protection"]}
      ]
    }
  }')
if [ "$STATUS" = "201" ] || [ "$STATUS" = "409" ]; then
  echo "OK ($STATUS)"
else
  echo "FAILED ($STATUS)"
  exit 1
fi

echo ""
echo "Done! Wait a few seconds for OPA to pick up the bundle, then:"
echo ""
echo "  # Get a token"
echo "  curl -s -X POST $PBAC_URL/token \\"
echo "    -u quickstart-app:app-secret \\"
echo "    -d 'grant_type=client_credentials&scope=read&resource_types=urn:quickstart:data' | jq ."
echo ""
echo "  # Introspect it"
echo "  TOKEN=\$(curl -s -X POST $PBAC_URL/token -u quickstart-app:app-secret -d 'grant_type=client_credentials&scope=read&resource_types=urn:quickstart:data' | jq -r .access_token)"
echo "  curl -s -X POST $PBAC_URL/introspect -u quickstart-rs:rs-secret -d \"token=\$TOKEN\" | jq ."