"""claperproof.py — decision 45 proof on a FRESH claper: the known default fails, the generated one (read
from the app page the household sees) works, through claper's own authentication. The value is never printed."""
import re, sys, html as H
import walk as w
w.login()
page = w.page("/stacks/claper/deploy")
m = re.search(r'name="ADMIN_PASSWORD"[^>]*value="([^"]*)"', page) or re.search(r'value="([^"]*)"[^>]*name="ADMIN_PASSWORD"', page)
gen = H.unescape(m.group(1)) if m else ""
print("app page shows a first password for ADMIN_PASSWORD:", bool(gen), "length", len(gen))
info = w.page("/apps/claper")
print("app page: default-login card shown:", "admin@claper.co / claper" in info, "| known-login warning shown:", "ismert, közös jelszóval" in info)
auth = 'IO.puts("ANS=#{Claper.Accounts.get_user_by_email_and_password("admin@claper.co", "PW") != nil}")'
script = "set -u\n" + "\n".join(
    f"echo \"{label}: $(docker exec -e ELIXIR_ERL_OPTIONS=+fnu claper /app/bin/claper rpc '{auth.replace('PW', pw)}' 2>&1 | grep -o 'ANS=[a-z]*')\""
    for label, pw in (("NEGATIVE the known default admin@claper.co / claper", "claper"),
                      ("POSITIVE the generated first password from the app page", gen),
                      ("CONTROL a wrong password", "wrongxyz123")))
print(w.guest(script))
print(w.guest("grep -A3 '^after_install:' /opt/docker/stacks/claper/app.yaml"))