#!/usr/bin/env python3
# /// script
# requires-python = ">=3.14"
# dependencies = [
#     "oath>=1.4.4",
# ]
# ///

import argparse
import base64
import hashlib
import hmac
import json
import random
import re
import subprocess
import sys
import time
from pathlib import Path
from typing import Optional
from urllib.parse import urlencode
from urllib.request import Request, urlopen
from urllib.error import HTTPError

from oath import totp

# Datoteke za powerauth-java-cmd
STATUS_FILE = Path("./pa_status.json")
CONFIG_FILE = Path("./config.json")

# Vmesne datoteke (lahko so /dev/null, če jih ne želimo shranjevati)
OTP_REGISTERED_FLAG = Path("./otp_registered.flag")
ACTIVATION_FILE = Path("./pa_activation_code.txt")
OTP_SEED_FILE = Path("./otp_seed.txt")
PA_ACTIVATED_FLAG = Path("./pa_activated.flag")

# Izhodna datoteka
TOKEN_FILE = Path("./pa_token.txt")

# https://github.com/wultra/powerauth-cmd-tool/releases/download/1.10.1/powerauth-java-cmd.jar
POWERAUTH_JAR = Path("./powerauth-java-cmd.jar")


def http_post(
    url: str, data: dict, is_json: bool, headers: Optional[dict] = None
) -> str:
    content_type = (
        "application/json; charset=UTF-8"
        if is_json
        else "application/x-www-form-urlencoded"
    )
    headers = (headers or {}).copy()
    headers["Content-Type"] = content_type

    body = json.dumps(data) if is_json else urlencode(data)

    request = Request(url, data=body.encode("utf-8"), headers=headers, method="POST")
    print(request.method, request.full_url, "with body:", body)
    try:
        with urlopen(request) as response:
            return response.read().decode("utf-8")
    except HTTPError as e:
        raise RuntimeError(
            f"HTTP error {e.code}: {e.reason}\n{e.headers}\n{e.read().decode('utf-8')}"
        ) from e


def generate_config():
    # Hardcoded in the apk, same for everyone.
    config = (
        "ARCCQ47aWyZ5ryvwWQaYh2GkEF3PL/weCkvypJTVH+Tl+nkBAUEEFi4EhkGausAAnHPSVG"
        "qiya+PlMq4eZRHn5yQHIjJHs0X3BmXx5GnFIgS7t8kmj5+3ELb31WntQEzcoyUOmmDyQ=="
    )
    text = json.dumps({"applicationName": "NLB Klik", "mobileSdkConfig": config})
    CONFIG_FILE.write_text(text + "\n", encoding="utf-8")


def require_json_field(payload: str, field: str, error_message: str) -> str:
    try:
        data = json.loads(payload)
    except json.JSONDecodeError as exc:
        raise RuntimeError(f"Neveljaven JSON odgovor: {payload}") from exc
    value = data.get(field)
    if not value:
        print(
            f"Nepričakovan JSON odgovor; ni polja '{field}': {payload}", file=sys.stderr
        )
        raise RuntimeError(error_message)
    return value


def run_powerauth_command(*args: str) -> str:
    command = [
        "java",
        "-jar",
        str(POWERAUTH_JAR),
        "--url",
        "https://nlb-si-mtoken.wultra.app/enrollment-server",
        *args,
    ]
    try:
        result = subprocess.run(
            command,
            check=True,
            capture_output=True,
            text=True,
        )
    except FileNotFoundError as exc:
        raise RuntimeError("Ukaz java ni na voljo") from exc
    except subprocess.CalledProcessError as exc:
        stderr = exc.stderr.strip()
        raise RuntimeError(stderr or "PowerAuth ukaz ni uspel") from exc
    return result.stdout


def parse_token_fields(payload: str) -> tuple[str, str]:
    """Poberi tokenId in tokenSecret iz PowerAuthovega izhoda."""
    token_id_match = re.search(r'"tokenId"\s*:\s*"([^"]+)"', payload)
    token_secret_match = re.search(r'"tokenSecret"\s*:\s*"([^"]+)"', payload)

    if not token_id_match or not token_secret_match:
        print("Nepričakovan izhod PowerAuth ukaza:", payload, file=sys.stderr)
        raise RuntimeError("Nisem dobil tokenId in tokenSecret :(")

    return token_id_match.group(1), token_secret_match.group(1)


def luhn_digit(length: int, value: int) -> int:
    """Izračunaj Luhnovo kontrolno števko."""
    total = 0
    for i in range(length):
        digit = value % 10
        value //= 10
        if i % 2 == 0:
            digit = [0, 2, 4, 6, 8, 1, 3, 5, 7, 9][digit]
        total += digit
    mod = total % 10
    return 0 if mod == 0 else 10 - mod


def validate_activation(code: str) -> bool:
    """Preveri, ali je aktivacijska koda veljavna glede na Luhnovo formulo."""
    return len(code) == 16 and luhn_digit(15, int(code[:-1])) == int(code[-1])


def derive_regcode(
    activation_bytes: bytes, serial_bytes: bytes, rng_bytes: Optional[bytes]
) -> str:
    """Izračunaj registracijsko kodo za OTP generator."""
    rng_bytes = rng_bytes or random.randbytes(2)

    password = activation_bytes + rng_bytes

    derived_key = hashlib.pbkdf2_hmac("sha256", password, serial_bytes, 8, 16)
    digest = hmac.new(derived_key, serial_bytes, hashlib.sha256).digest()
    derived13 = ((digest[-2] & 0x1F) << 8) | digest[-1]

    value = (derived13 << 16) | int.from_bytes(rng_bytes, "big")

    code = f"{value}{luhn_digit(9, value)}".zfill(10)
    return code[:5] + "-" + code[5:]


def main() -> int:
    parser = argparse.ArgumentParser(description="Registrira NLB Klik avtorizator")
    parser.add_argument("serial", help="serijska številka (iz emaila)")
    parser.add_argument("activation", help="aktivacijska koda (iz smsa)")
    parser.add_argument("rng_hex", nargs="?", help="2 naključna bajta, npr. '1337'")
    args = parser.parse_args()

    serial = args.serial.replace("-", "").strip()
    activation = args.activation.replace("-", "").strip()

    if not OTP_SEED_FILE.exists():
        # lahko nastavimo po želji, npr. rng_hex = "1337"
        rng_hex = args.rng_hex or random.randbytes(2).hex()
        assert re.fullmatch(r"[0-9a-fA-F]{4}", rng_hex), "neveljavn rng_hex"

        serial_bytes = serial.encode("utf-8")
        assert validate_activation(activation), "Neveljavna aktivacijska koda"
        activation_bytes = int(activation[:-1]).to_bytes(7, "big")
        rng_bytes = bytes.fromhex(rng_hex)

        regcode = derive_regcode(activation_bytes, serial_bytes, rng_bytes)

        key = hashlib.pbkdf2_hmac(
            hash_name="sha256",
            password=activation_bytes + rng_bytes,
            salt=serial_bytes,
            iterations=8,
            dklen=16,
        )
        print("OTP seme:", key.hex())
        print("Registracijska koda:", regcode)
        OTP_SEED_FILE.write_text(key.hex() + "\n" + regcode, encoding="utf-8")
    else:
        print(f"{OTP_SEED_FILE} že obstaja.")
        key_hex, regcode = OTP_SEED_FILE.read_text(encoding="utf-8").strip().split("\n")
        key = bytes.fromhex(key_hex)

    otp = totp(key.hex(), hash=hashlib.sha256, t=int(time.time()), format="dec8")

    if not OTP_REGISTERED_FLAG.exists():
        # stupid identifiers
        deviceid = str(random.randint(0, 2**32 - 1))
        instanceid = base64.b64encode(random.randbytes(8))
        http_post(
            "https://aam.nlb.si/igst/txnpoll",
            {
                "apiversion": "6",
                "platform": "ANDROID",
                "supportsoffline": "1",
                "serialnumber": serial,
                "deviceid": deviceid,
                "supportstransactions": "1",
                "cmd": "enroll",
                "instanceid": instanceid,
                "version": "9.1.1",
                "notifyenabled": "0",
                "supportsonline": "1",
                "type": "TOKEN",
                "appid": "co.infinum.nlb",
                "appscheme": "etrust",
                "otp": str(otp),
                "regcode": regcode,
            },
            is_json=False,
        )
        OTP_REGISTERED_FLAG.write_text(
            f"SERIAL={serial}\nACTIVATION={activation}\nREGCODE={regcode}\nDEVICEID={deviceid}\nINSTANCEID={instanceid.decode()}\n",
            encoding="utf-8",
        )
        print("OTP generator registriran.")
    else:
        print(f"{OTP_REGISTERED_FLAG} že obstaja.")

    if not CONFIG_FILE.exists():
        print(f"Generiram {CONFIG_FILE} ...")
        generate_config()
    else:
        print(f"{CONFIG_FILE} že obstaja.")

    if not ACTIVATION_FILE.exists():
        print("Pridobivam OIDC žeton ...")
        resp = http_post(
            "https://klik.nlb.si/authentication/realms/retail/protocol/openid-connect/token",
            {
                "client_id": "klik-device-registration",
                "grant_type": "password",
                "username": str(serial),
                "password": str(otp),
            },
            is_json=False,
        )
        oidc = require_json_field(resp, "access_token", "Ni OIDC žetona :(")

        print("Registriram Wultra uporabnika ...")
        resp = http_post(
            "https://klik.nlb.si/authentication/realms/retail/wultra-auth/register-wultra-user",
            {"appId": "Klik"},
            headers={"Authorization": f"Bearer {oidc}"},
            is_json=True,
        )
        pa_activ = require_json_field(resp, "activationCode", "Ni aktivacijske kode :(")
        ACTIVATION_FILE.write_text(f"{pa_activ}\n", encoding="utf-8")
        print("PA registracija uspela.")
    else:
        print(f"{ACTIVATION_FILE} že obstaja.")
        pa_activ = ACTIVATION_FILE.read_text(encoding="utf-8").strip()

    if not PA_ACTIVATED_FLAG.exists():
        print("Aktiviram PowerAuth ...")
        resp = run_powerauth_command(
            "--status-file",
            str(STATUS_FILE),
            "--config-file",
            str(CONFIG_FILE),
            "--method",
            "create",
            "--version",
            "3.3",
            "--password",
            "1234",
            "--algorithm",
            "EC_P384_ML_L5",
            "--activation-code",
            pa_activ,
        )
        PA_ACTIVATED_FLAG.write_text(resp, encoding="utf-8")
        print("PowerAuth aktiviran.")
    else:
        print(f"{PA_ACTIVATED_FLAG} že obstaja. PowerAuth je verjetno že aktiviran.")

    if not TOKEN_FILE.exists():
        print("Generiram avtorizacijski zeton ...")
        token_response = run_powerauth_command(
            "--status-file",
            str(STATUS_FILE),
            "--config-file",
            str(CONFIG_FILE),
            "--method",
            "create-token",
            "--version",
            "3.3",
            "--password",
            "1234",
            "--auth-code-type",
            "possession_knowledge",
        )
        token_id, token_secret = parse_token_fields(token_response)
        TOKEN_FILE.write_text(
            f"TOKEN_ID={token_id}\nTOKEN_SECRET={token_secret}\n",
            encoding="utf-8",
        )
        print(f"Žeton shranjen v {TOKEN_FILE}")
    else:
        print(f"{TOKEN_FILE} že obstaja. Pojdi na pivo")


if __name__ == "__main__":
    raise SystemExit(main())

#!/bin/bash
set -euo pipefail

STATUS_FILE="./pa_status.json"
CONFIG_FILE="./config.json"
TOKEN_FILE="./pa_token.txt"

source "$TOKEN_FILE"
#echo "Token ID: $TOKEN_ID"
#echo "Token Secret: $TOKEN_SECRET"

IP_ADDR=$(curl -sS --fail https://api64.ipify.org)
TIME=$(date -u +"%Y-%m-%dT%H:%M:%S.%3NZ")
echo "Time: $TIME"
echo "IP Address: $IP_ADDR"

read -p "Vnesi avtorizacijski URL: " URL
OPERATION_ID=$(echo "$URL" | sed -n 's/.*[?&]operationId=\([^&]*\).*/\1/p')
OTP=$(echo "$URL" | sed -n 's/.*[?&]proximityOtp=\([^&]*\).*/\1/p')

cat <<EOT > request.json
{
    "requestObject": {
        "id": "$OPERATION_ID"
    }
}
EOT
java -jar powerauth-java-cmd.jar \
    --url "https://nlb-si-mtoken.wultra.app/enrollment-server/api/auth/token/app/operation/detail/claim" \
    --status-file "$STATUS_FILE" \
    --config-file "$CONFIG_FILE" \
    --method "validate-token" \
    --http-method "POST" \
    --version "3.3" \
    --data-file "request.json" \
    --token-id "$TOKEN_ID" \
    --token-secret "$TOKEN_SECRET" 2>/dev/null


cat <<EOT > request.json
{
    "requestObject": {
        "data": "A2*Tspletna banka NLB Klik*T$IP_ADDR*T",
        "id": "$OPERATION_ID",
        "proximityCheck": {
            "otp": "$OTP",
            "timestampReceived": "$TIME",
            "timestampSent": "$TIME",
            "type": "DEEPLINK"
        }
    }
}
EOT
java -jar powerauth-java-cmd.jar \
    --url "https://nlb-si-mtoken.wultra.app/enrollment-server/api/auth/token/app/operation/authorize" \
    --status-file "$STATUS_FILE" \
    --config-file "$CONFIG_FILE" \
    --method "authenticate" \
    --http-method "POST" \
    --version "3.3" \
    --resource-id "/operation/authorize" \
    --auth-code-type "possession_knowledge" \
    --data-file "request.json" \
    --password "1234" 2>/dev/null

def derive_regcode(activation_bytes: bytes, serial_bytes: bytes):
    """Izračunaj registracijsko kodo za OTP generator."""
    rng_bytes = random.randbytes(2)

    password = activation_bytes + rng_bytes

    derived_key = hashlib.pbkdf2_hmac("sha256", password, serial_bytes, 8, 16)
    digest = hmac.new(derived_key, serial_bytes, hashlib.sha256).digest()
    derived13 = ((digest[-2] & 0x1F) << 8) | digest[-1]

    value = (derived13 << 16) | int.from_bytes(rng_bytes, "big")

    code = f"{value}{luhn_digit(9, value)}".zfill(10)
    return code[:5] + "-" + code[5:]

<network-security-config>
     <debug-overrides>
          <trust-anchors>
               <!-- Trust preinstalled CAs -->
               <certificates src="system" />
               <!-- Additionally trust user added CAs -->
               <certificates src="user" />
          </trust-anchors>
     </debug-overrides>
</network-security-config>