#!/usr/bin/env python3
"""unlock.py [--wrong] — the recovery page's „Mentések feloldása": the same form POST (/recovery/unlock, recovery_code)
with the session and CSRF token. The code comes from env REHEARSAL_2026_10_20_RECOVERY_CODE (under `sec run`); with
--wrong its last word is replaced (a household's typo). Prints the status, the redirect and the visible message only."""
import html, os, re, sys, urllib.parse
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
import ctl
code = os.environ["REHEARSAL_2026_10_20_RECOVERY_CODE"].strip()
if "--wrong" in sys.argv:
    w = code.split()
    w[-1] = "alma" if w[-1] != "alma" else "korte"
    code = " ".join(w)
ctl.login()
page = ctl._curl(["-H", "Cookie: " + ctl._SESS, ctl.BASE + "/recovery"])
m = re.search(r'name="_csrf" value="([^"]+)"', page) or re.search(r'name="csrf_token" value="([^"]+)"', page)
fields = {"recovery_code": code}
if m:
    fields[m.group(0).split('"')[1]] = m.group(1)
hdr = os.path.join(ctl._T, "uh")
body = ctl._curl(["-D", hdr, "-H", "Cookie: " + ctl._SESS, "-H", "X-CSRF-Token: " + ctl._CSRF, "-X", "POST",
                  "-H", "Content-Type: application/x-www-form-urlencoded", "--data-binary", "@-", ctl.BASE + "/recovery/unlock"],
                 inp=urllib.parse.urlencode(fields), timeout=900)
h = open(hdr).read()
print("status:", [l for l in h.splitlines() if l.lower().startswith(("http/", "location"))])
body = re.sub(r"<(script|style)[^>]*>.*?</\1>", "", body, flags=re.S)
print("page:", re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", body))).strip()[:1500])