"""Synthetic HTTP illustration. No real credentials, third-party code or exploit."""
import json
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.request import Request, urlopen
from urllib.error import HTTPError

# Expectations are independent of implementation: valid imports remain available;
# disabled imports and unprivileged callers cannot invoke the optional parser.
CASES = [
    ('health', '/health', False, 'anonymous', 200, 0),
    ('disabled / anonymous', '/import', False, 'anonymous', 404, 0),
    ('disabled / editor', '/import', False, 'editor', 404, 0),
    ('enabled / anonymous', '/import', True, 'anonymous', 401, 0),
    ('enabled / reader', '/import', True, 'reader', 403, 0),
    ('enabled / editor', '/import', True, 'editor', 200, 1),
]

def run(version):
    state = {'enabled': False, 'calls': 0}
    class Handler(BaseHTTPRequestHandler):
        def log_message(self, *args): pass
        def do_POST(self):
            if self.path == '/health':
                self.send_response(200); self.end_headers(); self.wfile.write(b'healthy'); return
            if self.path != '/import':
                self.send_response(404); self.end_headers(); return
            def parse():
                state['calls'] += 1
                return json.loads(self.rfile.read(int(self.headers['Content-Length'])))
            # Deliberately premature parser in the baseline; guarded in the fix.
            if version == 'before': result = parse()
            role = self.headers.get('X-Demo-Role', 'anonymous')
            status = (404 if not state['enabled'] else
                      401 if role == 'anonymous' else
                      403 if role != 'editor' else 200)
            if version == 'after' and status == 200: result = parse()
            self.send_response(status); self.end_headers()
            if status == 200: self.wfile.write(json.dumps(result).encode())
    server = HTTPServer(('127.0.0.1', 0), Handler)
    thread = threading.Thread(target=server.serve_forever, daemon=True); thread.start()
    rows = []
    try:
        for name, path, enabled, role, expected_status, expected_calls in CASES:
            state.update(enabled=enabled, calls=0)
            request = Request(f'http://127.0.0.1:{server.server_port}{path}',
                              data=b'{"items":["demo"]}',
                              headers={'X-Demo-Role': role}, method='POST')
            try:
                with urlopen(request, timeout=3) as response:
                    status, body = response.status, response.read()
            except HTTPError as exc:
                status, body = exc.code, exc.read()
            assert status == expected_status, (version, name, status)
            if path == '/import' and status == 200:
                assert json.loads(body) == {'items': ['demo']}
            if version == 'after': assert state['calls'] == expected_calls
            rows.append({'case': name, 'status': status, 'parser_calls': state['calls']})
    finally:
        server.shutdown(); server.server_close(); thread.join()
    return rows

if __name__ == '__main__':
    print(json.dumps({'label': 'Synthetic illustration, not a model benchmark',
                      'before': run('before'), 'after': run('after')}, indent=2))