# A stand-in for the Caddy bootstrap endpoint, for testing ops/run-e2e.sh
# without the operator's password.
#
# It reproduces the three behaviours the client depends on:
#   correct credentials -> 200 with the blob
#   wrong credentials   -> 401
#   any other path      -> connection closed with no response (Caddy's `abort`)
#
# The blob is composed IN MEMORY from credentials already present on this
# machine. Nothing is written to disk and nothing is ever logged.
import base64, os, http.server

USER  = os.environ['MU']
PW    = os.environ['MP']
ROUTE = os.environ['MR']

with open(os.path.expanduser('~/.config/bitwarden/bws-token')) as f:
    bws = f.read().strip()
BLOB = ('PRIVATE_REPO_URL=%s\nBWS_ACCESS_TOKEN=%s\n' % (os.environ['MREPO'], bws)).encode()
WANT = 'Basic ' + base64.b64encode(('%s:%s' % (USER, PW)).encode()).decode()

class H(http.server.BaseHTTPRequestHandler):
    protocol_version = 'HTTP/1.0'

    def do_GET(self):
        if self.path != '/%s/bootstrap.env' % ROUTE:
            # Caddy's catch-all is `handle { abort }` -- no response at all, so
            # curl reports 000. Closing without writing reproduces that.
            self.close_connection = True
            return
        if self.headers.get('Authorization', '') != WANT:
            self.send_response(401)
            self.send_header('WWW-Authenticate', 'Basic realm="bootstrap"')
            self.send_header('Content-Length', '0')
            self.end_headers()
            return
        self.send_response(200)
        self.send_header('Content-Type', 'text/plain')
        self.send_header('Content-Length', str(len(BLOB)))
        self.end_headers()
        self.wfile.write(BLOB)

    # the default handler logs every request line to stderr; the path contains
    # the route, so it stays quiet
    def log_message(self, *a):
        pass

http.server.HTTPServer(('0.0.0.0', 8099), H).serve_forever()