The FAPI trusted directory

#!/usr/bin/env bash

DOCKER_IMAGE="gcr.io/forgerock-io/ig/demo-fapi-trusted-directory:2025.9"

checkForDocker() {
  OUT=$(docker --version)
  RC=$?
  if [ $RC -ne 0 ]; then
      echo "### 'docker' command not found. The test trusted directory requires Docker to run."
      exit $RC
  else
    echo "Found ${OUT}"
  fi
}

checkForKeytool() {
  OUT=$(keytool --version)
  RC=$?
  if [ $RC -ne 0 ]; then
      echo "### 'keytool' command not found. The test trusted directory requires keytool to create test keys."
      exit $RC
  else
    echo "Found ${OUT}"
  fi
}

createKeys() {
  echo "### Creating trusted directory keystore ${PWD}/secrets/test-trusted-dir.p12..."
  echo
  mkdir -p secrets

  echo "### Generating CA keys..."
  echo
  keytool -keystore secrets/test-trusted-dir.p12 -storetype PKCS12 \
          -genkeypair -alias ca -dname "CN=Test Trusted Directory Root CA" \
          -ext bc=ca:true -keyalg RSA -keysize 2048 -validity 3650 \
          -storepass changeit -keypass changeit

  echo
  echo "### Generating JWT Signing keys..."
  echo
  keytool -keystore secrets/test-trusted-dir.p12 -storetype PKCS12 \
          -genkeypair -alias jwt-signer -dname "CN=Test Trusted Directory JWT Signer" \
          -keyalg RSA -keysize 2048 -validity 3650 \
          -storepass changeit -keypass changeit

  echo
  echo "### Listing keystore contents..."
  echo
  keytool -keystore secrets/test-trusted-dir.p12 -storetype PKCS12 \
          -list -storepass changeit

  echo
  echo "### Exporting CA certificate..."
  echo
  keytool -keystore secrets/test-trusted-dir.p12 -storetype PKCS12 \
          -exportcert -alias ca -rfc -file secrets/test-trusted-dir-ca.pem -storepass changeit

  echo
  echo "### Done."
}

runTestTrustedDirectory() {
  echo "### Running test trusted directory in Docker..."
  echo

  docker pull "${DOCKER_IMAGE}"

  docker run \
  --detach \
  --init \
  --tty \
  --rm \
  --env IG_METRICS_PASSWORD=password \
  --env IG_METRICS_USERNAME=user \
  --env IG_TEST_DIRECTORY_CA_KEYSTORE_ALIAS=ca \
  --env IG_TEST_DIRECTORY_CA_KEYSTORE_KEYPASS=changeit \
  --env IG_TEST_DIRECTORY_CA_KEYSTORE_PATH=/secrets/test-trusted-dir.p12 \
  --env IG_TEST_DIRECTORY_CA_KEYSTORE_STOREPASS=changeit \
  --env IG_TEST_DIRECTORY_CA_KEYSTORE_TYPE=PKCS12 \
  --env IG_TEST_DIRECTORY_FQDN=trustdir.example.com \
  --env IG_TEST_DIRECTORY_ISSUER_NAME="FAPI Test Trusted Directory" \
  --env IG_TEST_DIRECTORY_SIGNING_KEYSTORE_ALIAS=jwt-signer \
  --env IG_TEST_DIRECTORY_SIGNING_KEYSTORE_KEYPASS=changeit \
  --env IG_TEST_DIRECTORY_SIGNING_KEYSTORE_PATH=/secrets/test-trusted-dir.p12 \
  --env IG_TEST_DIRECTORY_SIGNING_KEYSTORE_STOREPASS=changeit \
  --env IG_TEST_DIRECTORY_SIGNING_KEYSTORE_TYPE=PKCS12 \
  --mount type=bind,source="${PWD}/secrets",target=/var/ig/secrets,readonly \
  --name test-trusted-directory \
  --publish 9080:8080 \
  "${DOCKER_IMAGE}"
}

checkForDocker

if [ ! -f ./secrets/test-trusted-dir.p12 ]; then
  checkForKeytool
  createKeys
else
  echo "### Trusted directory keystore already exists, skipping key creation."
  echo
fi

runTestTrustedDirectory