#!/bin/bash

# Permit.io Nested Groups Setup Script
# This script sets up nested groups across different resource types

set -e  # Exit on any error

PROJECT_ID="support"
ENV_ID="apitest"
API_KEY="permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD"

echo "=========================================="
echo "Permit.io Nested Groups Setup"
echo "=========================================="
echo ""

# Step 1: Create Company Resource Type
echo "[Step 1/11] Creating Company resource type..."
curl -X POST "https://api.permit.io/v2/schema/support/apitest/resources" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "key": "company",
    "name": "Company",
    "urn": "prn:gdrive:company",
    "description": "Company resource type",
    "actions": {
      "view": {}
    },
    "attributes": {},
    "roles": {
      "member": {
        "name": "Member",
        "permissions": ["view"]
      }
    },
    "relations": {}
  }'
echo -e "\n✓ Company resource type created\n"
sleep 1

# Step 2: Create Location Resource Type with Parent Relation
echo "[Step 2/11] Creating Location resource type..."
curl -X POST "https://api.permit.io/v2/schema/support/apitest/resources" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "key": "location",
    "name": "Location",
    "urn": "prn:gdrive:location",
    "description": "Location resource type",
    "actions": {
      "view": {}
    },
    "attributes": {},
    "roles": {
      "member": {
        "name": "Member",
        "permissions": ["view"]
      }
    },
    "relations": {
      "parent": "company"
    }
  }'
echo -e "\n✓ Location resource type created\n"
sleep 1

# Step 3: Configure Role Derivation
echo "[Step 3/10] Configuring role derivation for Location..."
curl -X PATCH "https://api.permit.io/v2/schema/support/apitest/resources/location/roles/member" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "granted_to": {
      "users_with_role": [
        {
          "linked_by_relation": "parent",
          "on_resource": "company",
          "role": "member"
        }
      ]
    }
  }'
echo -e "\n✓ Role derivation configured\n"
sleep 1

# Step 4: Create Company Group Instance
echo "[Step 4/10] Creating Company group instance (clarksons)..."
curl -X POST "https://api.permit.io/v2/schema/support/apitest/groups" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "group_resource_type_key": "company",
    "group_instance_key": "clarksons",
    "group_tenant": "default"
  }'
echo -e "\n✓ Company group created\n"
sleep 1

# Step 5: Create Location Group Instance
echo "[Step 5/10] Creating Location group instance (london)..."
curl -X POST "https://api.permit.io/v2/schema/support/apitest/groups" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "group_resource_type_key": "location",
    "group_instance_key": "london",
    "group_tenant": "default"
  }'
echo -e "\n✓ Location group created\n"
sleep 1

# Step 6: Create Relationship Tuple (Nested Group Connection)
echo "[Step 6/10] Creating relationship tuple (company -> location)..."
curl -X POST "https://api.permit.io/v2/facts/support/apitest/relationship_tuples" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "subject": "company:clarksons",
    "relation": "parent",
    "object": "location:london",
    "tenant": "default"
  }'
echo -e "\n✓ Relationship tuple created\n"
sleep 1

# Step 7: List All Groups (Verification)
echo "[Step 7/10] Listing all groups..."
curl -X GET "https://api.permit.io/v2/schema/support/apitest/groups" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD"
echo -e "\n✓ Groups listed\n"
sleep 1

# Step 8: List Relationship Tuples (Verification)
echo "[Step 8/10] Listing relationship tuples..."
curl -X GET "https://api.permit.io/v2/facts/support/apitest/relationship_tuples" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD"
echo -e "\n✓ Relationship tuples listed\n"
sleep 1

# Step 9: Create a Test User
echo "[Step 9/10] Creating test user..."
curl -X POST "https://api.permit.io/v2/facts/support/apitest/users" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "key": "testuser@example.com",
    "email": "testuser@example.com"
  }'
echo -e "\n✓ Test user created\n"
sleep 1

# Step 10: Assign User to Company Group
echo "[Step 10/10] Assigning user to Company group..."
curl -X POST "https://api.permit.io/v2/facts/support/apitest/role_assignments" \
  -H "Authorization: Bearer permit_key_6L1YSFni3Blhbfxs7TEjJnot0HZEf8qiJ0Krvbk41aqFfgPMjKa8AeUpjWFdJgv5fDIqi2t4uVJu28L9p6ObSD" \
  -H "Content-Type: application/json" \
  --data-raw '{
    "user": "testuser@example.com",
    "role": "member",
    "resource_instance": "company:clarksons",
    "tenant": "default"
  }'
echo -e "\n✓ User assigned to Company group\n"

echo "=========================================="
echo "Setup Complete!"
echo "=========================================="
echo ""
echo "The nested groups setup is complete."
echo "User 'testuser@example.com' should now have access to 'location:london' via the 'company:clarksons' membership."
echo ""