#!/usr/bin/env bash
# Real demos for P059 "How to Fix JWT Token Expired Errors (401 Unauthorized)". Runs on render01 (Docker).
# A private lab network on this machine only (192.168.59.0/24), deleted at the end:
#   login    the shop's login server (lab/login_server.py): access tokens (JWT, HS256, 5 minutes) + refresh tokens
#   api      the shop API (lab/api_server.py): checks each token's signature, then its exp against its own clock
#   laptop   Ana's laptop: curl, jq, and her shop dashboard (lab/shop), which refreshes an expired token once
# Every terminal is a real interactive bash in a pty (demo_driver.py). For the clock chapter the API server is
# restarted under libfaketime (+6 minutes), standing in for a server whose clock drifted; the video says so.
set -euo pipefail
cd "$(dirname "$0")"
P=ce-p059
BOXES="login api laptop"
cleanup() {
  for b in $BOXES; do docker rm -f $P-$b >/dev/null 2>&1 || true; done
  docker network rm $P-net >/dev/null 2>&1 || true
}
cleanup
[ -n "${KEEP:-}" ] || trap cleanup EXIT
W=/tmp/$P && rm -rf $W && mkdir -p $W/img && cp lab/* $W/img/

cat > $W/img/Dockerfile <<DOCKER
FROM ubuntu:26.04
RUN apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends \
      python3 python3-jwt faketime jq curl ca-certificates >/dev/null \
 && rm -rf /var/lib/apt/lists/* && (userdel -r ubuntu 2>/dev/null || true) \
 && useradd -m -s /bin/bash ana && useradd -m -s /bin/bash admin
COPY login_server.py api_server.py /srv/
COPY shop jwt-extend /usr/local/bin/
DOCKER
docker build -q -t $P-img $W/img >/dev/null
docker network create --subnet 192.168.59.0/24 $P-net >/dev/null
declare -A IP=([login]=192.168.59.5 [api]=192.168.59.6 [laptop]=192.168.59.10)
for b in $BOXES; do
  docker run -d --name $P-$b --hostname $b --network $P-net --ip ${IP[$b]} --network-alias $b $P-img sleep infinity >/dev/null
done
# One signing secret, shared by the login server and the API (never shown).
SECRET=$(head -c 32 /dev/urandom | base64 | tr -d '/+=')
for b in login api; do docker exec $P-$b sh -c "echo $SECRET > /srv/secret && chmod 644 /srv/secret"; done
docker exec -d $P-login python3 /srv/login_server.py
docker exec -d $P-api python3 /srv/api_server.py
sleep 2

python3 - "$P" < demo_driver.py