#!/usr/bin/env bash
# Gets a Mastodon API token for one persona through PrivaPub's real OAuth code flow, as a client would: register an app,
# sign in with the root's password at /oauth/login, choose the persona at /oauth/authorize, read the out-of-band code and
# exchange it. Prints "<access token> <client id> <client secret>" so the caller can revoke the token afterwards.
# usage: tools/smoke/oauth.sh <base url> <root login> <root password> <persona> [scopes]
set -euo pipefail
BASE="${1:?base url}"; LOGIN="${2:?root login}"; PASSWORD="${3:?root password}"; PERSONA="${4:?persona}"; SCOPES="${5:-read}"
jar=$(mktemp -d); trap 'rm -rf "$jar"' EXIT
json() { python3 -c "import sys,json; d=json.load(sys.stdin); print($1)"; }

app=$(curl -fsS -X POST "$BASE/api/v1/apps" --data-urlencode client_name=privapub-oauth \
	--data-urlencode redirect_uris=urn:ietf:wg:oauth:2.0:oob --data-urlencode "scopes=$SCOPES")
cid=$(echo "$app" | json "d['client_id']"); cs=$(echo "$app" | json "d['client_secret']")
scope_q=$(python3 -c "import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))" "$SCOPES")
q="client_id=$cid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=$scope_q"

xt=$(curl -fsS -c "$jar/c" -b "$jar/c" "$BASE/oauth/login?returnUrl=/oauth/authorize?$q" \
	| grep -o 'name="__RequestVerificationToken" type="hidden" value="[^"]*"' | sed 's/.*value="//;s/"//')
curl -sS -o /dev/null -c "$jar/c" -b "$jar/c" -X POST "$BASE/oauth/login" --data-urlencode "returnUrl=/oauth/authorize?$q" \
	--data-urlencode "__RequestVerificationToken=$xt" --data-urlencode "userName=$LOGIN" --data-urlencode "password=$PASSWORD"
curl -fsS -c "$jar/c" -b "$jar/c" "$BASE/oauth/authorize?$q&signed_in=1" > "$jar/choose.html"
form=$(python3 - "$jar/choose.html" "$PERSONA" <<'PY'
import re, sys, urllib.parse, html
page = open(sys.argv[1]).read()
pairs = [(k, html.unescape(v)) for k, v in re.findall(r'<input type="hidden" name="([^"]*)" value="([^"]*)"', page)]
persona = None
for block in re.findall(r'<label[^>]*>(.*?)</label>', page, re.S):
    if '@' + sys.argv[2] + '@' in block or '@' + sys.argv[2] + '<' in block or '>' + sys.argv[2] + '<' in block:
        found = re.search(r'name="avatarId" value="([^"]*)"', block)
        if found:
            persona = found.group(1)
if persona is None:
    sys.exit("persona '%s' is not offered at /oauth/authorize" % sys.argv[2])
print(urllib.parse.urlencode(pairs + [("avatarId", persona), ("decision", "allow")]))
PY
)
code=$(curl -fsS -c "$jar/c" -b "$jar/c" -X POST "$BASE/oauth/authorize" --data "$form" | grep -o '<code>[^<]*</code>' | sed 's/<[^>]*>//g')
[ -n "$code" ] || { echo "no authorization code" >&2; exit 1; }
token=$(curl -fsS -X POST "$BASE/oauth/token" --data-urlencode grant_type=authorization_code --data-urlencode "code=$code" \
	--data-urlencode "client_id=$cid" --data-urlencode "client_secret=$cs" --data-urlencode redirect_uri=urn:ietf:wg:oauth:2.0:oob \
	| json "d['access_token']")
echo "$token $cid $cs"