#!/bin/bash
# claim.sh BASE DOMAIN CODE_ENV PW_ENV [WRONG]  — the household's „A szerver beállítása" page, headless.
# BASE = https://<box ip>; DOMAIN = the customer domain (Host: felhom.<domain>). CODE_ENV / PW_ENV are the NAMES
# of env vars holding the setup code and the new dashboard password (run under `sec run`). With WRONG=1 one letter
# of the code is changed (a household's typo). Prints status codes, the Location and the page's visible message —
# never a secret. Endpoint-level: the same POST the page's form sends.
set -euo pipefail
BASE=$1; DOM=$2; CODE=${!3}; PW=${!4}; WRONG=${5:-0}
H="Host: felhom.$DOM"; T=$(mktemp -d); chmod 700 "$T"; trap 'rm -rf "$T"' EXIT
if [ "$WRONG" = 1 ]; then CODE="${CODE:0:2}$( [ "${CODE:2:1}" = q ] && echo w || echo q )${CODE:3}"; fi
curl -sk -H "$H" -D "$T/h1" -o "$T/b1" "$BASE/claim"
echo "GET /claim $(head -1 "$T/h1" | tr -d '\r')"
CK=$(grep -oiE 'felhom_claim_csrf=[^;]+' "$T/h1" | head -1)
CS=$(grep -oE 'name="_csrf" value="[^"]+"' "$T/b1" | head -1 | sed 's/.*value="//;s/"$//')
echo "csrf_len ${#CS} cookie_present $([ -n "$CK" ] && echo yes || echo no)"
curl -sk -H "$H" -H "Cookie: $CK" -D "$T/h2" -o "$T/b2" -X POST \
  --data-urlencode "_csrf=$CS" --data-urlencode "code=$CODE" \
  --data-urlencode "new_password=$PW" --data-urlencode "confirm_password=$PW" "$BASE/claim"
echo "POST /claim $(head -1 "$T/h2" | tr -d '\r') $(grep -i '^location:' "$T/h2" | tr -d '\r')"
python3 - "$T/b2" <<'EOF'
import re, sys, html
t = open(sys.argv[1], encoding="utf-8", errors="replace").read()
for cls in ("error", "alert", "flash", "banner", "notice"):
    for m in re.finditer(r'class="[^"]*%s[^"]*"[^>]*>(.*?)</' % cls, t, re.S):
        s = re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", m.group(1)))).strip()
        if s:
            print("message:", s[:300])
EOF