#!/usr/bin/env bash
# 05-revocar.sh — revoca la clave y comprueba que el token deja de funcionar.
#
# Demuestra:
#   * DELETE /api/ingest-keys/{id} -> 204 siempre (exista o no)
#   * repetir el DELETE            -> 204 (idempotente, no cambia revoked_at)
#   * reenviar con el token revocado -> 401 (igual que un token inventado)
#   * GET /api/ingest-keys muestra la clave con revoked_at relleno (no se borra)
#
# Uso:  ./05-revocar.sh
set -euo pipefail

BASE="${VALET_BASE:-http://127.0.0.1:3458}"
WORK="${WORKDIR:-/tmp/opencode/valet-847}"
KEYID="$(cat "$WORK/keyid.txt")"
TOKEN="$(cat "$WORK/token.txt")"

echo "== DELETE /api/ingest-keys/$KEYID =="
curl -s -w "\n[%{http_code}]\n" -X DELETE "$BASE/api/ingest-keys/$KEYID"

echo
echo "== DELETE otra vez (idempotente) -> 204 =="
curl -s -w "\n[%{http_code}]\n" -X DELETE "$BASE/api/ingest-keys/$KEYID"

echo
echo "== reenviar con el token revocado -> 401 =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/notifications" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" -d '{"message":"x"}'

echo
echo "== GET /api/ingest-keys  (revoked_at relleno; la fila NO se borra) =="
curl -s -w "\n[%{http_code}]\n" "$BASE/api/ingest-keys"