#!/usr/bin/env python3
"""L38-A :443 TLS host (LE cert for rt18.x.ggez.cc) — serves rt18nov.pdf with CORS enabled,
logs every request (incl. Referer/Origin) to the engagement fetch-oracle log."""
import http.server, ssl, sys, datetime, os

port = int(sys.argv[1]) if len(sys.argv) > 1 else 443
cert = sys.argv[2] if len(sys.argv) > 2 else "fullchain.crt"
key = sys.argv[3] if len(sys.argv) > 3 else "domain.key"
LOG = '/root/hackspace/gun/recon/fingerprint4/broccoli-fetch-oracle.log'


class CORSLogHandler(http.server.SimpleHTTPRequestHandler):
    def _log(self):
        try:
            ts = datetime.datetime.now(datetime.timezone.utc).strftime('%F %T')
            with open(LOG, 'a') as f:
                f.write(f"\n=== {ts} {self.command} {self.path} from {self.client_address[0]} [tls-443 l38a]\n")
                for k, v in self.headers.items():
                    f.write(f"  {k}: {v}\n")
        except Exception:
            pass

    def end_headers(self):
        self.send_header('Access-Control-Allow-Origin', '*')
        super().end_headers()

    def do_GET(self):
        self._log()
        super().do_GET()

    def do_HEAD(self):
        self._log()
        super().do_HEAD()

    def log_message(self, *a):
        pass


httpd = http.server.ThreadingHTTPServer(("0.0.0.0", port), CORSLogHandler)
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
ctx.load_cert_chain(cert, key)
httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
print(f"serving TLS+CORS+log on 0.0.0.0:{port}", flush=True)
httpd.serve_forever()