#!/bin/sh
set -eu

if [ -n "${DEMO_API_KEY:-}" ]; then
  echo "FAIL: the client unexpectedly received DEMO_API_KEY" >&2
  exit 1
fi

echo "== client environment =="
echo "DEMO_API_KEY is absent"

echo "== certificate seen by the client =="
echo | openssl s_client \
  -connect api.demo.local:443 \
  -servername api.demo.local \
  -CAfile /certs/mitm-ca.crt 2>/dev/null \
  | openssl x509 -noout -subject -issuer

echo "== normal request without an Authorization header =="
curl --noproxy '*' --silent --show-error \
  --cacert /certs/mitm-ca.crt \
  https://api.demo.local/hello

echo "== SNI/Host mismatch must not receive a credential =="
status="$(curl --noproxy '*' --silent --output /tmp/mismatch.out \
  --write-out '%{http_code}' \
  --cacert /certs/mitm-ca.crt \
  -H 'Host: attacker.example' \
  https://api.demo.local/hello)"
cat /tmp/mismatch.out
test "${status}" = "421"
echo "mismatch status: ${status}"