#!/usr/bin/env python3
"""HTTPS server for the StorageAccessGrantPermissionContext credentialless-gate
bypass POC.

Serves POC HTML/JS files and proxies /gen/* to the Chromium build's generated
MojoJS lite bindings so the credentialless iframe can talk Mojo directly.
"""
import http.server
import os
import ssl
import subprocess
import sys

PORT = 8443
HERE = os.path.dirname(os.path.abspath(__file__))
GEN_DIR = "/chromium/chromium/src/out/asan/gen"
CERT = os.path.join(HERE, "cert.pem")
KEY = os.path.join(HERE, "key.pem")


class Handler(http.server.SimpleHTTPRequestHandler):
    def translate_path(self, path):
        # Strip query string.
        path = path.split("?", 1)[0].split("#", 1)[0]
        if path.startswith("/gen/"):
            return os.path.join(GEN_DIR, path[len("/gen/"):])
        return os.path.join(HERE, path.lstrip("/"))

    def end_headers(self):
        # Permissive headers so the credentialless iframe can load the
        # cross-origin gen/ scripts.
        self.send_header("Access-Control-Allow-Origin", "*")
        self.send_header("Cache-Control", "no-store")
        super().end_headers()

    def log_message(self, fmt, *args):
        sys.stderr.write("[server] %s\n" % (fmt % args))


def ensure_cert():
    if os.path.exists(CERT) and os.path.exists(KEY):
        return
    sys.stderr.write("[server] generating self-signed cert\n")
    subprocess.check_call([
        "openssl", "req", "-x509", "-newkey", "rsa:2048",
        "-keyout", KEY, "-out", CERT, "-days", "7", "-nodes",
        "-subj", "/CN=poc",
    ])


def main():
    ensure_cert()
    httpd = http.server.ThreadingHTTPServer(("0.0.0.0", PORT), Handler)
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    ctx.load_cert_chain(CERT, KEY)
    httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
    sys.stderr.write("[server] listening on https://0.0.0.0:%d/\n" % PORT)
    httpd.serve_forever()


if __name__ == "__main__":
    main()