#!/usr/bin/env python3
"""
Multi-origin HTTP server for the Android WebAuthn BFCache POC.

Serves three origins on three ports so Chrome treats them as distinct:
  - attacker top frame  : http://localhost:8080  (poc.html)
  - attacker subframe   : http://localhost:8081  (subframe.html) - cross-origin to 8080
  - victim              : http://localhost:8082  (victim.html)
"""
import http.server
import os
import socketserver
import threading

ROOT = os.path.dirname(os.path.abspath(__file__))


class Handler(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, directory=ROOT, **kwargs)

    def end_headers(self):
        # Keep the attacker page BFCache-eligible.
        self.send_header("Cache-Control", "no-store")
        super().end_headers()


def serve(port):
    socketserver.TCPServer.allow_reuse_address = True
    httpd = socketserver.TCPServer(("0.0.0.0", port), Handler)
    print(f"[+] serving on http://localhost:{port}/")
    httpd.serve_forever()


if __name__ == "__main__":
    for p in (8081, 8082):
        threading.Thread(target=serve, args=(p,), daemon=True).start()
    serve(8080)