#!/bin/sh
# Jetable. Ce que le compte créé de l'extérieur atteint vraiment.
set -eu

BASE=http://127.0.0.1:4214
HOST='Host: advmfr.localhost:4214'
JAR=$(mktemp -d)/j.txt

curl -s -c "$JAR" -o /dev/null -H "$HOST" -H 'Content-Type: application/json' \
  -d '{"username":"intrus","password":"NotMyFactory1"}' \
  "$BASE/api/auth/sign-in/username"

echo "session obtenue :"; grep -c "session" "$JAR" || true

for route in /tasks /review /positions /admin/people /admin/holidays /team; do
  printf '%-20s %s\n' "$route" \
    "$(curl -s -o /dev/null -w '%{http_code} %{redirect_url}' -b "$JAR" -H "$HOST" "$BASE$route")"
done