#!/usr/bin/env bash
# Reproducer for issue #37243
# Demonstrates that a resource of one FGAP type (Users) can be silently
# associated with a permission of a different type (Groups), returning 201
# instead of the expected 400.
#
# Prerequisites:
#   - Keycloak running at http://localhost:8080 in dev mode
#   - jq installed
#   - Admin credentials: admin / admin

set -e

BASE_URL="http://localhost:8080"
REALM="test"
TS=$(date +%s)

refresh_token() {
  TOKEN=$(curl -s -X POST "$BASE_URL/realms/master/protocol/openid-connect/token" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "client_id=admin-cli" \
    -d "username=admin" \
    -d "password=admin" \
    -d "grant_type=password" | jq -r '.access_token')
  echo "[token refreshed]"
}

# ─── Step 1: Create realm ────────────────────────────────────────────────────
echo ""
echo "=== Step 1: Create realm '$REALM' ==="
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" -X POST "$BASE_URL/admin/realms" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"realm\":\"$REALM\",\"enabled\":true}"

# ─── Step 2: Enable FGAP ─────────────────────────────────────────────────────
echo ""
echo "=== Step 2: Enable FGAP on realm '$REALM' ==="
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" -X PUT "$BASE_URL/admin/realms/$REALM" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"adminPermissionsEnabled":true}'

# ─── Step 3: Create user alice ───────────────────────────────────────────────
echo ""
echo "=== Step 3: Create user 'alice' ==="
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" -X POST "$BASE_URL/admin/realms/$REALM/users" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","enabled":true}'

# ─── Step 4: Get alice's UUID ────────────────────────────────────────────────
echo ""
echo "=== Step 4: Get alice's UUID ==="
refresh_token
ALICE_ID=$(curl -s "$BASE_URL/admin/realms/$REALM/users?username=alice" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.[0].id')
echo "Alice UUID: $ALICE_ID"

# ─── Step 5: Get the dedicated FGAP client ID from the realm ─────────────────
# When adminPermissionsEnabled is set, Keycloak creates a dedicated
# adminPermissionsClient — it is NOT realm-management.
echo ""
echo "=== Step 5: Get FGAP adminPermissionsClient ID ==="
refresh_token
FGAP_CLIENT_ID=$(curl -s "$BASE_URL/admin/realms/$REALM" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.adminPermissionsClient.id')
echo "FGAP Client ID: $FGAP_CLIENT_ID"

# ─── Step 6: Create a group ──────────────────────────────────────────────────
echo ""
echo "=== Step 6: Create group 'test-group' ==="
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" -X POST "$BASE_URL/admin/realms/$REALM/groups" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"test-group"}'

refresh_token
GROUP_ID=$(curl -s "$BASE_URL/admin/realms/$REALM/groups?search=test-group" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.[0].id')
echo "Group ID: $GROUP_ID"

# ─── Step 7: Create a Users permission for alice ─────────────────────────────
# This internally creates an authz resource whose name = alice's UUID
echo ""
echo "=== Step 7: Create Users permission for alice ==="
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  -X POST "$BASE_URL/admin/realms/$REALM/clients/$FGAP_CLIENT_ID/authz/resource-server/permission/scope" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"alice-users-permission-$TS\",
    \"resourceType\": \"Users\",
    \"resources\": [\"$ALICE_ID\"],
    \"scopes\": [\"view\", \"manage\", \"impersonate\", \"map-roles\", \"manage-group-membership\", \"reset-password\"]
  }"

# ─── Step 8: Fetch alice's internal authz resource ID ────────────────────────
echo ""
echo "=== Step 8: Fetch alice's internal authz resource ID ==="
refresh_token
ALICE_AUTHZ_RESOURCE_ID=$(curl -s \
  "$BASE_URL/admin/realms/$REALM/clients/$FGAP_CLIENT_ID/authz/resource-server/resource?name=$ALICE_ID&exactName=true&deep=true" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.[0]._id')
echo "Alice authz resource ID: $ALICE_AUTHZ_RESOURCE_ID"

# ─── Step 9: Create a Groups permission for the group ────────────────────────
# This creates a separate authz resource for the group
echo ""
echo "=== Step 9: Create Groups permission for test-group ==="
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  -X POST "$BASE_URL/admin/realms/$REALM/clients/$FGAP_CLIENT_ID/authz/resource-server/permission/scope" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"test-group-permission-$TS\",
    \"resourceType\": \"Groups\",
    \"resources\": [\"$GROUP_ID\"],
    \"scopes\": [\"view\", \"manage\", \"manage-membership\", \"manage-members\", \"view-members\"]
  }"

# ─── Step 10: THE BUG — cross-type resource assignment ───────────────────────
# Pass alice's Users authz resource ID to a Groups permission.
# WITHOUT the fix: returns 201 (wrong — Users resource silently added to Groups permission)
# WITH the fix:    returns 400 Bad Request
echo ""
echo "=== Step 10: THE BUG — create Groups permission using alice's Users resource ID ==="
echo "Expected: HTTP 400"
echo "Without fix: HTTP 201  ← bug"
refresh_token
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  -X POST "$BASE_URL/admin/realms/$REALM/clients/$FGAP_CLIENT_ID/authz/resource-server/permission/scope" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"bad-groups-permission-$TS\",
    \"resourceType\": \"Groups\",
    \"resources\": [\"$ALICE_AUTHZ_RESOURCE_ID\"],
    \"scopes\": [\"view\", \"manage\", \"manage-membership\", \"manage-members\", \"view-members\"]
  }"

echo ""
echo "=== Done ==="
echo "If Step 10 returned HTTP 201, the bug is present (unfixed code)."
echo "If Step 10 returned HTTP 400, the fix is working correctly."