# Check bash
bash --version

# Check curl
curl --version

# Create a directory for MCP Server setup
mkdir -p ~/mcp-server-setup
cd ~/mcp-server-setup

# Create the script file
cat > setup-verify-tenant.sh << 'EOF'
#!/bin/bash

##################################################################################
## This script is used to configure the Applications and STS client on IBM Verify Tenant to use the MCP Server
## Requirements:- Provide the Tenant URL and the API client credentials
##  - API Client needs to have the following entitlements
##    - manageAppAccessAdmin (Manage application lifecycle)
##    - manageSTSClients (Manage STS clients and token types)
##################################################################################

set -e

echo "===================================================================================="
echo "IBM Verify MCP Server - Tenant Setup Script"
echo "===================================================================================="
echo ""
echo "This script configures your IBM Verify tenant for use with the MCP Server by:"
echo "  1. Creating two OAuth applications (Actor and Subject)"
echo "  2. Setting up a Token Exchange (STS) client"
echo "  3. Generating all necessary credentials for your MCP Server configuration"
echo ""
echo "Requirements:"
echo "  - IBM Verify tenant URL"
echo "  - API Client credentials with the following entitlements:"
echo "    • manageAppAccessAdmin (Manage application lifecycle)"
echo "    • manageSTSClients (Manage STS clients and token types)"
echo "    (API client can be created in Admin Console: Security -> API access)"
echo ""
echo "===================================================================================="
echo ""

# Prompt for IBM Verify tenant URL
echo -n "Enter IBM Verify tenant URL: "
read TENANT_URL_INPUT

# Normalize TENANT_URL: add https:// if missing, remove trailing /
if [[ ! "$TENANT_URL_INPUT" =~ ^https?:// ]]; then
    TENANT_URL="https://${TENANT_URL_INPUT}"
else
    TENANT_URL="$TENANT_URL_INPUT"
fi
# Remove trailing slash if present
TENANT_URL="${TENANT_URL%/}"

# Prompt for API Client ID
echo -n "Enter API Client ID: "
read CLIENT_ID

# Prompt for API Client Secret (hidden input)
echo -n "Enter API Client Secret: "
stty -echo
read CLIENT_SECRET
stty echo
echo ""

echo ""
echo "Configuration:"
echo "  Tenant URL: $TENANT_URL"
echo ""

# Obtain access token
echo "Obtaining access token..."
TOKEN_RESPONSE=$(curl -s --request POST \
  --url "${TENANT_URL}/v1.0/endpoint/default/token" \
  --header 'accept: application/json' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data "client_id=${CLIENT_ID}" \
  --data "client_secret=${CLIENT_SECRET}" \
  --data scope=openid)

# Extract access token from response
ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)

if [ -z "$ACCESS_TOKEN" ]; then
    echo "Error: Failed to obtain access token. Check your Client ID, Client Secret, and tenant URL."
    exit 1
fi

echo "Access token obtained successfully"
echo ""

# Onboard application
echo "Onboarding application..."
APP_RESPONSE=$(curl -s --request POST \
  --url "${TENANT_URL}/v1.0/applications" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '
  {
    "visibleOnLaunchpad": true,
    "customization": {
        "themeId": "default"
    },
    "name": "IBM Verify MCP Server Actor",
    "applicationState": true,
    "description": "The template to access Connect type of application.",
    "templateId": "998",
    "owners": [],
    "provisioning": {},
    "attributeMappings": [],
    "providers": {
        "sso": {
        "userOptions": "oidc"
        },
        "oidc": {
        "properties": {
            "doNotGenerateClientSecret": "false",
            "additionalConfig": {
            "oidcv3": true,
            "requestObjectParametersOnly": "false",
            "requestObjectSigningAlg": "RS256",
            "requestObjectRequireExp": "true",
            "certificateBoundAccessTokens": "false",
            "dpopBoundAccessTokens": "false",
            "validateDPoPProofJti": "false",
            "dpopProofSigningAlg": "RS256",
            "authorizeRspSigningAlg": "RS256",
            "authorizeRspEncryptionAlg": "none",
            "authorizeRspEncryptionEnc": "none",
            "responseTypes": [],
            "responseModes": [],
            "clientAuthMethod": "default",
            "requirePushAuthorize": "false",
            "allowedClientAssertionVerificationKeys": [],
            "requestObjectMaxExpFromNbf": 1800,
            "restrictAuthDetailTypes": true,
            "ignoreUnknownAuthDetailTypes": true,
            "exchangeForSSOSessionOption": "default",
            "logoutOption": "none",
            "subjectTokenTypes": [
                "urn:ietf:params:oauth:token-type:access_token"
            ],
            "actorTokenTypes": [
                "urn:ietf:params:oauth:token-type:access_token"
            ],
            "requestedTokenTypes": [
                "urn:ietf:params:oauth:token-type:access_token"
            ],
            "actorTokenRequired": false,
            "useUserDefaultEntitlements": false,
            "tctxMapping": ""
            },
            "generateRefreshToken": "false",
            "renewRefreshToken": "true",
            "idTokenEncryptAlg": "none",
            "idTokenEncryptEnc": "none",
            "grantTypes": {
            "authorizationCode": "false",
            "clientCredentials": "true",
            "ropc": "false",
            "tokenExchange": "false",
            "deviceFlow": "false",
            "jwtBearer": "false",
            "policyAuth": "false"
            },
            "accessTokenExpiry": 3600,
            "refreshTokenExpiry": 86400,
            "idTokenSigningAlg": "RS256",
            "redirectUris": []
        },
        "token": {
            "accessTokenType": "default"
        },
        "grantProperties": {
            "generateDeviceFlowQRCode": "false"
        },
        "requirePkceVerification": "true",
        "consentAction": "always_prompt",
        "scopes": [],
        "restrictEntitlements": true,
        "entitlements": []
        },
        "saml": {
        "properties": {
            "companyName": "IBM Verify"
        }
        }
    },
    "apiAccessClients": []
  }')


# Extract application ID from response
ACTOR_APP_ID=$(echo "$APP_RESPONSE" | grep -o '"href":"/appaccess/v1.0/applications/[0-9]\+"' | sed 's/.*\/applications\///' | tr -d '"')

if [ -z "$ACTOR_APP_ID" ]; then
    echo "Error: Failed to create Actor application. Verify the API client has the 'manageAppAccessAdmin' entitlement."
    exit 1
fi

echo "Application onboarded successfully"
echo "Actor Application ID: $ACTOR_APP_ID"
echo ""

# Retrieve Actor application details to get client ID for subject mapping
APP_DETAILS_RESPONSE=$(curl -s --request GET \
  --url "${TENANT_URL}/v1.0/applications/${ACTOR_APP_ID}" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer ${ACCESS_TOKEN}")

# Extract client ID from response
ACTOR_APP_CLIENT_ID=$(echo "$APP_DETAILS_RESPONSE" | grep -o '"clientId":"[^"]*"' | head -1 | cut -d'"' -f4)

if [ -z "$ACTOR_APP_CLIENT_ID" ]; then
    echo "Error: Failed to retrieve Actor application details. Check tenant connectivity and API client permissions."
    exit 1
fi

# Onboard Subject application
echo "Onboarding Subject application..."
SUBJECT_APP_RESPONSE=$(curl -s --request POST \
  --url "${TENANT_URL}/v1.0/applications" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data "
  {
	\"visibleOnLaunchpad\": true,
	\"customization\": {
		\"themeId\": \"default\"
	},
	\"name\": \"MCP Server Subject\",
	\"applicationState\": true,
	\"description\": \"The template to access Connect type of application.\",
	\"templateId\": \"998\",
	\"provisioning\": {},
	\"providers\": {
		\"sso\": {
			\"userOptions\": \"oidc\"
		},
		\"oidc\": {
			\"properties\": {
				\"doNotGenerateClientSecret\": \"false\",
				\"additionalConfig\": {
					\"oidcv3\": true,
					\"requestObjectParametersOnly\": \"false\",
					\"requestObjectSigningAlg\": \"RS256\",
					\"requestObjectRequireExp\": \"true\",
					\"certificateBoundAccessTokens\": \"false\",
					\"dpopBoundAccessTokens\": \"false\",
					\"validateDPoPProofJti\": \"false\",
					\"dpopProofSigningAlg\": \"RS256\",
					\"authorizeRspSigningAlg\": \"RS256\",
					\"authorizeRspEncryptionAlg\": \"none\",
					\"authorizeRspEncryptionEnc\": \"none\",
					\"responseTypes\": [
						\"none\",
						\"code\"
					],
					\"responseModes\": [
						\"query\",
						\"fragment\",
						\"form_post\",
						\"query.jwt\",
						\"fragment.jwt\",
						\"form_post.jwt\"
					],
					\"clientAuthMethod\": \"default\",
					\"requirePushAuthorize\": \"false\",
					\"allowedClientAssertionVerificationKeys\": [],
					\"requestObjectMaxExpFromNbf\": 1800,
					\"restrictAuthDetailTypes\": true,
					\"ignoreUnknownAuthDetailTypes\": true,
					\"exchangeForSSOSessionOption\": \"default\",
					\"logoutOption\": \"none\",
					\"subjectTokenTypes\": [
						\"urn:ietf:params:oauth:token-type:access_token\"
					],
					\"actorTokenTypes\": [
						\"urn:ietf:params:oauth:token-type:access_token\"
					],
					\"requestedTokenTypes\": [
						\"urn:ietf:params:oauth:token-type:access_token\"
					],
					\"actorTokenRequired\": false,
					\"authorizeRequestMap\": [],
					\"authorizeResponseMap\": [],
					\"tokenRequestMap\": [],
					\"tokenResponseMap\": [],
					\"refreshIntrospectMapClaimNames\": [
						\"may_act\"
					],
					\"refreshAttributeMapClaimNames\": [],
					\"requireConsentAttributeMapClaimNames\": [],
					\"suppressDefaultClaims\": false,
					\"useUserDefaultEntitlements\": false,
					\"tctxMapping\": \"\"
				},
				\"generateRefreshToken\": \"true\",
				\"renewRefreshToken\": \"true\",
				\"idTokenEncryptAlg\": \"none\",
				\"idTokenEncryptEnc\": \"none\",
				\"grantTypes\": {
					\"authorizationCode\": \"true\",
					\"implicit\": \"false\",
					\"clientCredentials\": \"false\",
					\"ropc\": \"false\",
					\"tokenExchange\": \"false\",
					\"deviceFlow\": \"false\",
					\"jwtBearer\": \"false\",
					\"policyAuth\": \"false\"
				},
				\"accessTokenExpiry\": 3600,
				\"refreshTokenExpiry\": 86400,
				\"idTokenSigningAlg\": \"RS256\",
				\"redirectUris\": [
					\"http://localhost:8000/auth/callback\"
				],
				\"renewRefreshTokenExpiry\": 86400,
				\"sendAllKnownUserAttributes\": \"false\"
			},
			\"token\": {
				\"accessTokenType\": \"default\",
				\"attributeMappings\": [
					{
						\"targetName\": \"may_act\",
						\"function\": {
							\"custom\": \"{\\n  \\\"sub\\\": \\\"${ACTOR_APP_CLIENT_ID}\\\"\\n}\"
						}
					}
				]
			},
			\"grantProperties\": {
				\"generateDeviceFlowQRCode\": \"false\"
			},
			\"requirePkceVerification\": \"true\",
			\"consentAction\": \"always_prompt\",
			\"applicationUrl\": \"http://localhost:8000\",
			\"scopes\": [],
			\"restrictEntitlements\": true,
			\"entitlements\": []
		},
		\"saml\": {
			\"properties\": {
				\"companyName\": \"IBM Verify MCP\"
			}
		}
	},
	\"apiAccessClients\": []
  }")

# Extract Subject application ID from response
SUBJECT_APP_ID=$(echo "$SUBJECT_APP_RESPONSE" | grep -o '"href":"/appaccess/v1.0/applications/[0-9]\+"' | sed 's/.*\/applications\///' | tr -d '"')

if [ -z "$SUBJECT_APP_ID" ]; then
    echo "Error: Failed to create Subject application. Verify the API client has the 'manageAppAccessAdmin' entitlement."
    exit 1
fi

echo "Subject application onboarded successfully"
echo "Subject Application ID: $SUBJECT_APP_ID"
echo ""

# Create STS client
echo "Creating STS client..."
STS_RESPONSE=$(curl -s -i --request POST \
  --url "${TENANT_URL}/oidc-mgmt/v1.0/sts/oauth/clients" \
  --header 'Accept: application/json' \
  --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{
        "clientId": "",
        "clientName": "IBM Verify MCP Server STS Client",
        "enabled": true,
        "tokenExchangeSettings": {
            "subjectTokenTypes": [
                "urn:ietf:params:oauth:token-type:access_token"
            ],
            "actorTokenTypes": [
                "urn:ietf:params:oauth:token-type:access_token"
            ],
            "requestedTokenTypes": [
                "urn:ietf:params:oauth:token-type:access_token"
            ],
            "actorTokenRequired": true
        },
        "clientAuthentication": {
            "clientAuthMethod": "default",
            "clientSecret": null,
            "clientAssertionSigningAlg": "RS256",
            "validateClientAssertionJti": true,
            "allowedClientAssertionVerificationKeys": [],
            "tlsClientAuthAttribute": "subject_dn",
            "tlsClientAuthAttributeValue": ""
        },
        "tokenSettings": {
            "signingAlg": "RS256",
            "signingKeyLabel": "",
            "encryptAlg": "none",
            "encryptEnc": "none",
            "encryptKey": "",
            "jwksUri": "",
            "attributeMap": [],
            "accessTokenLifetime": 3600,
            "accessTokenType": "jwt",
            "introspectMap": [],
            "certificateBoundAccessTokens": false,
            "dpopBoundAccessTokens": false,
            "validateDPoPProofJti": false,
            "dpopProofSigningAlg": "RS256",
            "restrictEntitlements": true,
            "entitlements": [
                "manageAccessRequest",
				"readAccessRequest",
                "manageAccessRequestActivities",
				"readAccessAsManager",
	            "manageAccessAsManager",
                "manageAppAccessOwner",
				"manageAppAccessAdmin",
                "manageEntitlements",
                "readAppConfig",
				"readAttributes",
	            "manageAttributes",
				"readAttributesForDisplay",
				"readUsers",
	            "readGroups",
            	"readStandardGroups",
            	"readGroupMembers",
            	"readStandardGroupMembers",
                "readUserGroups",
            	"readUsersGroupMembership",
            	"readUsersStandardGroupMembership",
	            "manageUsers",
            	"manageUsersInStandardGroups",   
            	"manageUserGroups",
            	"manageAllUserGroups",
            	"manageUserStandardGroups",
			    "manageGroups",
            	"manageStandardGroups",
            	"manageGroupMembers",
            	"manageStandardGroupMembers",
			    "readMFAMethods",
			    "manageMFAMethods",
	            "manageEnrollMFAMethodAnyUser",
                "readEnrollMFAMethodAnyUser",
                "manageEnrollMFAMethod",
                "readEnrollMFAMethod"
            ],
            "restrictScopes": false,
            "scopes": [],
            "exchangeForSSOSessionOption": "default",
            "tctxMapping": "",
            "restrictAuthDetailTypes": true,
            "ignoreUnknownAuthDetailTypes": true,
            "authDetailTypes": []
        },
        "clientGroups": {
            "tokenExchange": []
        },
        "policyId": null
    }')

# Extract location header from response
STS_LOCATION=$(echo "$STS_RESPONSE" | grep -i "^location:" | sed 's/location: //i' | tr -d '\r')

if [ -z "$STS_LOCATION" ]; then
    echo "Error: Failed to create STS client. Verify the API client has the 'manageSTSClients' entitlement."
    exit 1
fi

# Extract STS client ID from location URL
STS_CLIENT_ID=$(echo "$STS_LOCATION" | grep -o '[^/]*$' | tr -d '[:space:]')

if [ -z "$STS_CLIENT_ID" ]; then
    echo "Error: Failed to extract STS client ID from location header."
    exit 1
fi

echo "STS client created successfully"
echo ""
echo "---------------------------"
echo "IBM Verify MCP Server tenant setup complete."
echo ""
echo "Three components have been created in your IBM Verify tenant:"
echo "  • IBM Verify MCP Server Actor   (Application)"
echo "  • MCP Server Subject             (Application)"
echo "  • IBM Verify MCP Server STS Client (STS Client)"
echo ""
echo "IMPORTANT: Client IDs and Secrets are NOT printed here for security reasons."
echo "Retrieve them directly from your IBM Verify Admin Console:"
echo ""
echo "  Subject & Actor Application Client ID and Secret:"
echo "    Admin Console → Applications → Applications → [Application Name] → Settings → Sign-on"
echo ""
echo "  STS Client ID and Secret:"
echo "    Admin Console → Applications → STS clients → IBM Verify MCP Server STS Client"
echo ""
echo "Use the retrieved credentials when configuring your .env and config.yaml files"
echo "as described in the Installation Guide (Step 3 and Step 4)."
echo ""
echo "---------------------------"
echo ""
echo "IMPORTANT - Next Steps:"
echo "  Before using the MCP Server, you must entitle users to the 'MCP Server Subject' application."
echo "  To do this:"
echo "    1. Go to Admin Console"
echo "    2. Navigate to: Applications -> Applications -> MCP Server Subject"
echo "    3. Go to the Entitlements tab"
echo "    4. Add the required users or groups"
echo ""
echo "---------------------------"
EOF

# Make the script executable
chmod +x setup-verify-tenant.sh

./setup-verify-tenant.sh

# Test actor token — reads client_secret from stdin to avoid shell history exposure
# Replace <your-tenant>, <actor-client-id>, and <actor-client-secret> with real values
read -s -p "Enter actor client secret: " ACTOR_SECRET && echo
curl -s -X POST "https://<your-tenant>.verify.ibm.com/v1.0/endpoint/default/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=<actor-client-id>" \
  --data-urlencode "client_secret=${ACTOR_SECRET}"
unset ACTOR_SECRET