fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)

documentation/audits/fixes-2026-10-21/tools/unlock.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+"""unlock.py [--wrong] — the recovery page's „Mentések feloldása": the same form POST (/recovery/unlock, recovery_code)
+with the session and CSRF token. The code comes from env REHEARSAL_2026_10_20_RECOVERY_CODE (under `sec run`); with
+--wrong its last word is replaced (a household's typo). Prints the status, the redirect and the visible message only."""
+import html, os, re, sys, urllib.parse
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import ctl
+code = os.environ["REHEARSAL_2026_10_20_RECOVERY_CODE"].strip()
+if "--wrong" in sys.argv:
+    w = code.split()
+    w[-1] = "alma" if w[-1] != "alma" else "korte"
+    code = " ".join(w)
+ctl.login()
+page = ctl._curl(["-H", "Cookie: " + ctl._SESS, ctl.BASE + "/recovery"])
+m = re.search(r'name="_csrf" value="([^"]+)"', page) or re.search(r'name="csrf_token" value="([^"]+)"', page)
+fields = {"recovery_code": code}
+if m:
+    fields[m.group(0).split('"')[1]] = m.group(1)
+hdr = os.path.join(ctl._T, "uh")
+body = ctl._curl(["-D", hdr, "-H", "Cookie: " + ctl._SESS, "-H", "X-CSRF-Token: " + ctl._CSRF, "-X", "POST",
+                  "-H", "Content-Type: application/x-www-form-urlencoded", "--data-binary", "@-", ctl.BASE + "/recovery/unlock"],
+                 inp=urllib.parse.urlencode(fields), timeout=900)
+h = open(hdr).read()
+print("status:", [l for l in h.splitlines() if l.lower().startswith(("http/", "location"))])
+body = re.sub(r"<(script|style)[^>]*>.*?</\1>", "", body, flags=re.S)
+print("page:", re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", body))).strip()[:1500])