#!/bin/sh
# Fake `d-oauth-server` for the provision CLI-driver tests.
#
# State lives under $FAKE_STATE_DIR (a per-test tempdir). Every invocation is
# appended to $FAKE_STATE_DIR/call.log as one argv line. Secrets are never
# echoed: the only stdout token is the minted synthetic token, and tests assert
# it never appears in any log.
#
# The `issue` step mirrors the real CLI wire shape: a human label plus the
# token on ONE stdout line (`"<message>: <token>"`), never the bare token.
# The token is a deterministic 44-char base64url-alphabet value
# (`IATTEST` + zero-padded counter), never a real credential.
#
# Supported surface (argv-exact, no shell interpolation by the caller):
#   scope create <name>
#   user scopes --email <email>
#   user create --email <email> --password-file <path>
#   user grant-scope --email <email> --scope <scope>
#   redirect-uri create <uri> [--kind <kind>]
#   redirect-uri enable <uri> [--kind <kind>]
#   client attach-redirect-uri --client-id <id> --uri <uri> --kind <kind>
#   initial-access-token issue --uses <n> --ttl <secs>
#
# Failure hooks (env): FAKE_FAIL_STEP=grant forces `grant-scope` to fail as if
# the scope were missing from the catalog.

set -u

S="${FAKE_STATE_DIR:?FAKE_STATE_DIR must be set}"
echo "$*" >> "$S/call.log"

fail() {
  echo "$1" >&2
  exit 1
}

case "${1:-}" in
  scope)
    # scope create <name>
    [ "${2:-}" = "create" ] || fail "usage error: scope $*"
    echo "$3" >> "$S/scopes.txt"
    echo "created scope $3"
    ;;
  user)
    case "${2:-}" in
      scopes)
        # user scopes --email <email>
        email="${4:-}"
        if grep -qx "$email" "$S/users.txt" 2>/dev/null; then
          echo "demo.read"
        else
          fail "not found: user $email"
        fi
        ;;
      create)
        # user create --email <email> --password-file <path>
        email="${4:-}"
        if grep -qx "$email" "$S/users.txt" 2>/dev/null; then
          fail "already exists: user $email"
        fi
        echo "$email" >> "$S/users.txt"
        echo "created user $email"
        ;;
      grant-scope)
        # user grant-scope --email <email> --scope <scope>
        email="${4:-}"
        scope="${6:-}"
        if [ "${FAKE_FAIL_STEP:-}" = "grant" ]; then
          fail "not found: scope $scope"
        fi
        if ! grep -qx "$scope" "$S/scopes.txt" 2>/dev/null; then
          fail "not found: scope $scope"
        fi
        echo "$email:$scope" >> "$S/grants.txt"
        echo "granted scope $scope to $email"
        ;;
      *)
        fail "usage error: user $*"
        ;;
    esac
    ;;
  redirect-uri)
    kind="authorize"
    [ "${4:-}" = "--kind" ] && kind="${5:-authorize}"
    case "${2:-}" in
      create)
        # redirect-uri create <uri> [--kind <kind>]
        echo "$3:$kind" >> "$S/redirects.txt"
        echo "created redirect $3 ($kind)"
        ;;
      enable)
        # redirect-uri enable <uri> [--kind <kind>]
        echo "$3:$kind" >> "$S/redirects-enabled.txt"
        echo "enabled redirect $3 ($kind)"
        ;;
      *)
        fail "usage error: redirect-uri $*"
        ;;
    esac
    ;;
  client)
    case "${2:-}" in
      attach-redirect-uri)
        # client attach-redirect-uri --client-id <id> --uri <uri> --kind <kind>
        echo "${4:-}:${6:-}:${8:-authorize}" >> "$S/attachments.txt"
        echo "attached ${6:-} (${8:-authorize}) to ${4:-}"
        ;;
      *)
        fail "usage error: client $*"
        ;;
    esac
    ;;
  initial-access-token)
    n="$(cat "$S/iat-counter.txt" 2>/dev/null || echo 0)"
    n=$((n + 1))
    echo "$n" > "$S/iat-counter.txt"
    token="$(printf 'IATTEST%037d' "$n")"
    echo "issued initial access token (1 use): $token"
    ;;
  *)
    fail "usage error: $*"
    ;;
esac