import urllib.request, ssl, paramiko, json, base64, bcrypt, socket, time, re
from cryptography.hazmat.primitives.serialization import load_der_public_key
from cryptography.hazmat.primitives.asymmetric import padding

BASE="http://sso.yunhaixingtong.com"; HOST="sso.yunhaixingtong.com"; PORT=80
ctx=ssl.create_default_context(); ctx.check_hostname=False; ctx.verify_mode=ssl.CERT_NONE
PLAIN="SsoTest@2026"
h=bcrypt.hashpw(PLAIN.encode(), bcrypt.gensalt(rounds=10)).decode()
if h.startswith("$2b$"): h=h.replace("$2b$","$2a$",1)
USER="ssotest_tmp"; UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0 Safari/537.36"

ssh=paramiko.SSHClient(); ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect("192.168.10.157", port=22, username="yunhai", password="123456", timeout=20)
def run(c):
    i,o,e=ssh.exec_command(c); out=o.read().decode('utf-8','ignore'); err=e.read().decode('utf-8','ignore'); return out+("ERR:"+err if err else "")
PWD="CVf^x$sW*b6CGHxh"
seed=f"DELETE FROM sys_user WHERE username='{USER}'; INSERT INTO sys_user(username,create_time,create_user,password,disabled,expired) VALUES('{USER}',NOW(),0,'{h}',0,0);"
sftp=ssh.open_sftp(); sftp.open('/tmp/seed.sql','w').write(seed); sftp.close()
print("seed:", run(f"docker exec -i mysql8 mysql -uroot -p'{PWD}' bsch_userbase < /tmp/seed.sql 2>&1").strip())

def raw_post(extra=None):
    pub=json.loads(urllib.request.urlopen(urllib.request.Request(BASE+"/api/public-key"),timeout=20,context=ctx).read().decode())["data"]["publicKey"]
    rsa_pub=load_der_public_key(base64.b64decode(pub))
    def enc(s): return base64.b64encode(rsa_pub.encrypt(s.encode(), padding.PKCS1v15())).decode()
    body=f"loginname={enc(USER)}&pwd={enc(PLAIN)}"
    hh={"Host":HOST,"User-Agent":UA,"Content-Type":"application/x-www-form-urlencoded","Content-Length":str(len(body))}
    if extra: hh.update(extra)
    req="POST /api/login HTTP/1.1\r\n"+"\r\n".join(f"{k}: {v}" for k,v in hh.items())+"\r\nConnection: close\r\n\r\n"+body
    s=socket.create_connection((HOST,PORT),timeout=20); s.sendall(req.encode()); data=b""
    while True:
        c=s.recv(4096)
        if not c: break
        data+=c
    s.close(); return data.decode('utf-8','ignore')

for _ in range(20):
    try:
        r=raw_post({"X-Requested-With":"XMLHttpRequest","Accept":"application/json"})
        if "200 OK" in r.split("\r\n\r\n",1)[0]: break
    except Exception: pass
    time.sleep(6)

print("\n=== AJAX (what the page SHOULD use) ===")
r=raw_post({"X-Requested-With":"XMLHttpRequest","Accept":"application/json"})
body=r.split("\r\n\r\n",1)[1] if "\r\n\r\n" in r else ""
print("RAW BODY:", body[:300])
m=re.search(r'"url"\s*:\s*"([^"]*)"', body)
print("-> data.url:", m.group(1) if m else "NONE / NOT PRESENT")

print("\n=== NATIVE FORM (what index.html currently does) ===")
r2=raw_post()
head=r2.split("\r\n\r\n",1)[0]; body2=r2.split("\r\n\r\n",1)[1] if "\r\n\r\n" in r2 else ""
print("STATUS LINE:", head.split("\r\n",1)[0])
print("BODY[:400]:", body2[:400])

sftp=ssh.open_sftp(); sftp.open('/tmp/del.sql','w').write(f"DELETE FROM sys_user WHERE username='{USER}';\n"); sftp.close()
print("cleanup:", run(f"docker exec -i mysql8 mysql -uroot -p'{PWD}' bsch_userbase < /tmp/del.sql 2>&1").strip())
ssh.close()