#!/usr/bin/env python3
"""
Minimal HTTP server for the HFM/Advanced-Protection bypass POC.

Listens on 127.0.0.1:8080 and serves a page that proves it was loaded
over plaintext HTTP. Every incoming request is logged to stderr with a
[HTTP-REQUEST-RECEIVED] marker so the absence/presence of the request
is the behavioural proof.
"""
import http.server
import socketserver
import sys

PAGE = b"""<!doctype html>
<html><head><title>HTTP LOADED</title></head>
<body style="font-family:monospace">
<h1>Plaintext HTTP page loaded</h1>
<p id="u"></p>
<script>
  document.getElementById('u').textContent = location.href;
  console.log('[BUG-CONFIRMED] plaintext HTTP page committed for ' +
              location.href +
              ' while Advanced Protection is active (HFM-Strict expected)');
</script>
</body></html>
"""

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        sys.stderr.write(
            f"[HTTP-REQUEST-RECEIVED] host={self.headers.get('Host')} "
            f"path={self.path}\n")
        sys.stderr.flush()
        self.send_response(200)
        self.send_header("Content-Type", "text/html")
        self.send_header("Content-Length", str(len(PAGE)))
        self.end_headers()
        self.wfile.write(PAGE)

    def log_message(self, fmt, *args):
        pass  # suppress default access log; we print our own marker above.

if __name__ == "__main__":
    port = int(sys.argv[1]) if len(sys.argv) > 1 else 7777
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("127.0.0.1", port), Handler) as httpd:
        sys.stderr.write(f"[server] listening on http://127.0.0.1:{port}/\n")
        sys.stderr.flush()
        httpd.serve_forever()