#!/usr/bin/env bash
# Real demos for P109 "JWT vs Session Cookies: Which One Should You Use?". Made on the Mac with Docker Desktop.
# Four containers on their own network, names under the reserved .test domain (RFC 6761):
#   sessions  the session store: Redis 8 (plus show-store, a lab script that lists what is stored)
#   api1      api1.kettle.test, Ana's shop API and login server: signs tokens with the private key (lab/shop.py)
#   api2      api2.kettle.test, a second API server: has only the public key; starts with no session store
#   laptop    Ana's laptop: Ubuntu 24.04, curl, jq and a real Chromium (lab/browser)
# The signing key pair is made fresh on every run. Every command shown is typed into a real interactive bash in a
# pty (demo_driver.py); servers are restarted with new settings off-screen, and the video says so.
set -euo pipefail
cd "$(dirname "$0")"
P=ce-p109
BOXES="sessions api1 api2 laptop"
cleanup() {
  for b in $BOXES; do docker rm -f $P-$b >/dev/null 2>&1 || true; done
  docker network rm $P-net >/dev/null 2>&1 || true
}
cleanup
[ -n "${KEEP:-}" ] || trap cleanup EXIT
docker build -q -t $P-api -f lab/Dockerfile.api lab >/dev/null
docker build -q -t $P-store -f lab/Dockerfile.store lab >/dev/null
docker build -q -t $P-laptop -f lab/Dockerfile.laptop lab >/dev/null
K=$(mktemp -d)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$K/private.pem" 2>/dev/null
openssl pkey -in "$K/private.pem" -pubout -out "$K/public.pem"
chmod 644 "$K"/*.pem
docker network create $P-net >/dev/null
docker run -d --name $P-sessions --hostname sessions --network $P-net --network-alias sessions $P-store >/dev/null
docker run -d --name $P-laptop --hostname laptop --network $P-net --ipc=host $P-laptop sleep infinity >/dev/null
for b in api1 api2; do
  docker create --name $P-$b --hostname $b --network $P-net --network-alias $b.kettle.test $P-api sleep infinity >/dev/null
  docker cp "$K/public.pem" $P-$b:/srv/public.pem
done
docker cp "$K/private.pem" $P-api1:/srv/private.pem
rm -rf "$K"
docker start $P-api1 $P-api2 >/dev/null
[ -n "${SETUP_ONLY:-}" ] && { echo "lab up"; trap - EXIT; exit 0; }
python3 - "$P" < demo_driver.py