#!/usr/bin/env python3
"""HTTP server for the WebView 3PC-bypass POC.

Serves two cross-site origins on different ports so that an Android WebView
loading http://<host>:8080/victim.html embeds a genuinely cross-site iframe
from http://<host>:8081/tracker.html (different port + different
registrable hostname when mapped via /etc/hosts or --host-resolver-rules).

The tracker origin sets a SameSite=None cookie on its top-level visit, then
the iframe attempts to read it via document.cookie. With
setAcceptThirdPartyCookies(false) and an unmodified renderer the read returns
"". With the renderer patch (chromium-changes.patch) applied, the spoofed
site_for_cookies causes AwProxyingRestrictedCookieManager to treat the request
as first-party and the cookie is returned.
"""

import http.server
import socketserver
import threading
import sys

VICTIM_PORT = 8080
TRACKER_PORT = 8081


class _Handler(http.server.SimpleHTTPRequestHandler):
    extra_headers: dict = {}

    def end_headers(self):
        for k, v in self.extra_headers.items():
            self.send_header(k, v)
        super().end_headers()

    def do_GET(self):
        if self.path.startswith("/set"):
            self.send_response(200)
            self.send_header("Content-Type", "text/html")
            self.send_header(
                "Set-Cookie",
                "tracker_id=secret; Path=/; SameSite=None; Secure",
            )
            self.end_headers()
            self.wfile.write(b"<!doctype html><title>set</title>cookie set")
            return
        return super().do_GET()


def serve(port: int):
    socketserver.TCPServer.allow_reuse_address = True
    httpd = socketserver.TCPServer(("0.0.0.0", port), _Handler)
    print(f"[server] listening on 0.0.0.0:{port}", file=sys.stderr)
    httpd.serve_forever()


if __name__ == "__main__":
    threading.Thread(target=serve, args=(TRACKER_PORT,), daemon=True).start()
    serve(VICTIM_PORT)