generate-test-tokens.sh

#!/bin/bash

# Token Generator for Testing
# Generates various authorization tokens for testing the OBO authentication flow

set -e

OBO_SERVICE="http://localhost:3090"

# Colors
GREEN='\033[0;32m'
BLUE='\033[0;34m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'

echo "🔑 Authorization Token Generator"
echo "================================="
echo ""

# Check if OBO service is running
if ! curl -s $OBO_SERVICE/.well-known/jwks.json > /dev/null 2>&1; then
  echo -e "${YELLOW}⚠️  Warning: OBO service doesn't appear to be running on port 3090${NC}"
  echo "   Start it with: cd obo-service && npm start"
  echo ""
fi

echo -e "${BLUE}Generating test tokens...${NC}"
echo ""

# ================================================================
# 1. Standard Client Token
# ================================================================
echo -e "${CYAN}1. Standard Client Token${NC}"
echo "   Client ID: demo-client"
echo "   Scopes: api:read api:write"
echo ""

CLIENT_TOKEN_1=$(curl -s -X POST $OBO_SERVICE/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "demo-client",
    "client_secret": "demo-secret"
  }' | jq -r '.access_token')

echo -e "${GREEN}Token:${NC}"
echo "$CLIENT_TOKEN_1"
echo ""

echo -e "${CYAN}Claims:${NC}"
curl -s -X POST $OBO_SERVICE/introspect \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$CLIENT_TOKEN_1\"}" | jq '.'
echo ""
echo "---"
echo ""

# ================================================================
# 2. Alternative Client Token (different client_id)
# ================================================================
echo -e "${CYAN}2. Alternative Client Token${NC}"
echo "   Client ID: test-client"
echo "   Scopes: api:read api:write"
echo ""

CLIENT_TOKEN_2=$(curl -s -X POST $OBO_SERVICE/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "test-client",
    "client_secret": "test-secret"
  }' | jq -r '.access_token')

echo -e "${GREEN}Token:${NC}"
echo "$CLIENT_TOKEN_2"
echo ""

echo -e "${CYAN}Claims:${NC}"
curl -s -X POST $OBO_SERVICE/introspect \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$CLIENT_TOKEN_2\"}" | jq '.'
echo ""
echo "---"
echo ""

# ================================================================
# 3. Admin Client Token
# ================================================================
echo -e "${CYAN}3. Admin Client Token${NC}"
echo "   Client ID: admin-client"
echo "   Scopes: api:read api:write"
echo ""

CLIENT_TOKEN_ADMIN=$(curl -s -X POST $OBO_SERVICE/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "admin-client",
    "client_secret": "admin-secret"
  }' | jq -r '.access_token')

echo -e "${GREEN}Token:${NC}"
echo "$CLIENT_TOKEN_ADMIN"
echo ""

echo -e "${CYAN}Claims:${NC}"
curl -s -X POST $OBO_SERVICE/introspect \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$CLIENT_TOKEN_ADMIN\"}" | jq '.'
echo ""
echo "---"
echo ""

# ================================================================
# 4. OBO Token (Subgraph Access)
# ================================================================
echo -e "${CYAN}4. OBO Token (Subgraph Access)${NC}"
echo "   Exchanged from: demo-client"
echo "   Scope: subgraph:access"
echo "   Audience: supergraph-api (maintained)"
echo ""

OBO_TOKEN_1=$(curl -s -X POST $OBO_SERVICE/obo/exchange \
  -H "Authorization: Bearer $CLIENT_TOKEN_1" \
  -H "Content-Type: application/json" \
  -d '{
    "requested_token_use": "on_behalf_of",
    "scope": "subgraph:access"
  }' | jq -r '.access_token')

echo -e "${GREEN}Token:${NC}"
echo "$OBO_TOKEN_1"
echo ""

echo -e "${CYAN}Claims (note 'act' and 'azp' claims):${NC}"
curl -s -X POST $OBO_SERVICE/introspect \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$OBO_TOKEN_1\"}" | jq '.'
echo ""
echo "---"
echo ""

# ================================================================
# 5. OBO Token with Custom Scope (DEMONSTRATION ONLY)
# ================================================================
echo -e "${CYAN}5. OBO Token (Custom Scope: products:read) - DEMO ONLY${NC}"
echo "   Exchanged from: demo-client"
echo "   Scope: products:read"
echo ""
echo -e "${YELLOW}   ⚠️  WARNING: This token will NOT work with current subgraph validation!${NC}"
echo -e "${YELLOW}   Subgraphs require 'subgraph:access' scope. This is for demonstration only.${NC}"
echo ""

OBO_TOKEN_PRODUCTS=$(curl -s -X POST $OBO_SERVICE/obo/exchange \
  -H "Authorization: Bearer $CLIENT_TOKEN_1" \
  -H "Content-Type: application/json" \
  -d '{
    "requested_token_use": "on_behalf_of",
    "resource": "products-api",
    "scope": "products:read"
  }' | jq -r '.access_token')

echo -e "${GREEN}Token:${NC}"
echo "$OBO_TOKEN_PRODUCTS"
echo ""

echo -e "${CYAN}Claims:${NC}"
curl -s -X POST $OBO_SERVICE/introspect \
  -H "Content-Type: application/json" \
  -d "{\"token\": \"$OBO_TOKEN_PRODUCTS\"}" | jq '.'
echo ""
echo "---"
echo ""

# ================================================================
# Summary
# ================================================================
echo ""
echo -e "${GREEN}✅ Token Generation Complete!${NC}"
echo ""
echo "================================================================"
echo "SUMMARY OF GENERATED TOKENS"
echo "================================================================"
echo ""

echo -e "${BLUE}CLIENT TOKENS (✓ Use with Router at http://localhost:4000):${NC}"
echo "   ⚠️  Do NOT use these directly with subgraphs - they lack 'act' claim"
echo ""
echo "1. demo-client token:"
echo "   CLIENT_TOKEN=\"$CLIENT_TOKEN_1\""
echo ""
echo "2. test-client token:"
echo "   TEST_CLIENT_TOKEN=\"$CLIENT_TOKEN_2\""
echo ""
echo "3. admin-client token:"
echo "   ADMIN_TOKEN=\"$CLIENT_TOKEN_ADMIN\""
echo ""

echo -e "${BLUE}OBO TOKENS (✓ Use with Subgraphs at http://localhost:4001):${NC}"
echo "   ⚠️  Do NOT use these with the Router - use client tokens instead"
echo ""
echo "4. Standard OBO token (subgraph:access) - ✅ WORKS WITH SUBGRAPHS:"
echo "   OBO_TOKEN=\"$OBO_TOKEN_1\""
echo ""
echo "5. Products-scoped OBO token - ❌ DEMO ONLY (will fail subgraph validation):"
echo "   OBO_PRODUCTS_TOKEN=\"$OBO_TOKEN_PRODUCTS\""
echo ""

echo "================================================================"
echo ""
echo -e "${CYAN}USAGE EXAMPLES:${NC}"
echo ""
echo -e "${YELLOW}✓ CORRECT: Client token → Router (Router exchanges it for OBO token)${NC}"
echo "curl -X POST http://localhost:4000/graphql \\"
echo "  -H \"Authorization: Bearer $CLIENT_TOKEN_1\" \\"
echo "  -H \"Content-Type: application/json\" \\"
echo "  -d '{\"query\": \"{ products { id name } }\"}'"
echo ""
echo -e "${YELLOW}✓ CORRECT: OBO token → Subgraph directly (for testing subgraph validation)${NC}"
echo "curl -X POST http://localhost:4001/products/graphql \\"
echo "  -H \"Authorization: Bearer $OBO_TOKEN_1\" \\"
echo "  -H \"Content-Type: application/json\" \\"
echo "  -d '{\"query\": \"{ products { id } }\"}'"
echo ""
echo -e "${YELLOW}✗ WRONG: Client token → Subgraph (will fail - missing 'act' claim)${NC}"
echo "# Don't do this:"
echo "# curl -H \"Authorization: Bearer $CLIENT_TOKEN_1\" http://localhost:4001/products/graphql"
echo ""
echo -e "${YELLOW}✗ WRONG: Products-scoped OBO token → Subgraph (will fail - wrong scope)${NC}"
echo "# Don't do this:"
echo "# curl -H \"Authorization: Bearer $OBO_PRODUCTS_TOKEN\" http://localhost:4001/products/graphql"
echo "# Error: Invalid scope. Token must include \"subgraph:access\" scope. Got: \"products:read\""
echo ""
echo "================================================================"
echo ""
echo -e "${CYAN}SCOPE REQUIREMENTS:${NC}"
echo ""
echo "All OBO tokens sent to subgraphs MUST have scope: \"subgraph:access\""
echo ""
echo "This implementation uses a SHARED AUDIENCE model:"
echo "  • Client tokens:  aud=\"supergraph-api\", scope=\"api:read api:write\""
echo "  • OBO tokens:     aud=\"supergraph-api\", scope=\"subgraph:access\""
echo "  • Subgraphs accept the shared \"supergraph-api\" audience"
echo "  • Authorization is controlled via SCOPES, not audiences"
echo ""
echo "================================================================"
echo ""

# Save tokens to a file for easy sourcing
cat > /tmp/test-tokens.env << EOF
# Generated test tokens - $(date)
# Source this file: source /tmp/test-tokens.env

export CLIENT_TOKEN="$CLIENT_TOKEN_1"
export TEST_CLIENT_TOKEN="$CLIENT_TOKEN_2"
export ADMIN_TOKEN="$CLIENT_TOKEN_ADMIN"
export OBO_TOKEN="$OBO_TOKEN_1"
export OBO_PRODUCTS_TOKEN="$OBO_TOKEN_PRODUCTS"
EOF

echo -e "${YELLOW}💾 Tokens saved to: /tmp/test-tokens.env${NC}"
echo "   Load them with: source /tmp/test-tokens.env"
echo ""