#!/usr/bin/env python3
"""
Dual-origin HTTP server for the NinePieceImagePainter EXIF-orientation oracle POC.

  - Port 8000: "attacker" origin, serves poc.html
  - Port 8001: "victim" origin, serves victim-*.jpg WITHOUT CORS headers
               (so the images are opaque/no-CORS cross-origin from 8000)

Run:  python3 server.py
"""
import http.server
import os
import socketserver
import threading

ROOT = os.path.dirname(os.path.abspath(__file__))


class NoCORSHandler(http.server.SimpleHTTPRequestHandler):
    """Serves files from ROOT with NO Access-Control-Allow-Origin header."""

    def __init__(self, *a, **kw):
        super().__init__(*a, directory=ROOT, **kw)

    def end_headers(self):
        # Explicitly do NOT add CORS headers -> opaque cross-origin response.
        self.send_header("Cache-Control", "no-store")
        super().end_headers()

    def log_message(self, fmt, *args):
        print("[%s] %s" % (self.server.server_address[1], fmt % args))


class ReusableTCPServer(socketserver.TCPServer):
    allow_reuse_address = True


def serve(port):
    httpd = ReusableTCPServer(("127.0.0.1", port), NoCORSHandler)
    print(f"Serving on http://127.0.0.1:{port}/")
    httpd.serve_forever()


if __name__ == "__main__":
    threading.Thread(target=serve, args=(8001,), daemon=True).start()
    serve(8000)